Skip to main content

CIS Hardening Exceptions

While the CIS Benchmarks provide an excellent security baseline, not every rule can or should be applied in every environment. In cloud-native infrastructures, certain benchmark rules may conflict with cloud provider agents, break essential connectivity, or require physical access that is not possible in a virtualized environment.

To address these challenges, Klarity ImageFactory maintains a set of CIS Hardening Exceptions.

What are Hardening Exceptions?​

Hardening exceptions are specific CIS Benchmark rules that are intentionally skipped during the hardening process. These exceptions are carefully vetted by the Nordcloud security team to ensure that they do not significantly compromise the security posture of the image while maintaining its functionality and manageability in the cloud.

Exception Management​

ImageFactory manages exceptions on a per-distribution basis. Each supported OS distribution has its own set of excepted rules, maintained by the Nordcloud security team. Exceptions are applied automatically during the hardening process — no configuration is needed on your part.

Common Exception Categories​

Exceptions typically fall into one of the following categories:

  1. Physical Access Requirements: Rules that require physical access to the machine (e.g., securing the physical console or disabling USB ports) are generally not applicable to cloud instances and are excluded.
  2. Cloud Provider Agent Conflicts: Some hardening rules may interfere with the operation of essential cloud provider agents (e.g., AWS Systems Manager, Azure Guest Agent, or GCP Ops Agent). These rules are skipped to ensure the instance remains manageable by the cloud platform.
  3. Image Creation Process Incompatibility: Certain rules may break the image build process. For example, rules that immediately disable the temporary user account used for provisioning must be excluded or deferred.
  4. Connectivity and Remote Management: Rules that would break SSH or WinRM connectivity are often excluded or modified to ensure that administrators can still access the instance after it is launched.
  5. Filesystem and Partitioning: CIS rules often recommend specific partitioning schemes (e.g., separate partitions for /var or /tmp). In many cloud environments, images are built on a single root volume, making these rules impractical to enforce without complex custom partitioning logic.

Supported Distributions​

ImageFactory maintains exception lists for all supported distributions, including:

  • Linux: Amazon Linux 2, Amazon Linux 2023, CentOS 7, Oracle Linux 7/8/9, RHEL 7/8/9/10, Rocky Linux 8/9, SLES 12/15, Ubuntu 18.04/20.04/22.04/24.04.
  • Windows: Windows Server 2012 R2, 2016, 2019, 2022, 2025.

Viewing Exceptions​

Customers can view the list of exceptions applied to a specific distribution through the ImageFactory UI or API. This transparency allows security teams to understand exactly which rules are being skipped and why, facilitating internal security reviews and audits.

Custom Exceptions​

Currently, the exception lists are managed globally by the ImageFactory administrators to ensure a consistent security baseline for all customers. If your organization has a specific requirement to skip additional rules, please contact the support team to discuss a custom exception profile.

Impact on Compliance Scoring​

When a rule is included in the exception list, it is excluded from the compliance score calculation. This means that an image can still achieve a "100% compliance" score even if certain rules were skipped, provided that all other applicable rules passed the scan. The compliance reports will clearly indicate which rules were excluded as exceptions.