They make it clear it’s an assessment aid rather than a replacement for professional audits.
Ultimately, you need to be accredited by a third party to whatever standard you’re targeting. Linux Security Audit Project just gives you some checks to help review your current posture and start tackling things ahead of the audit.
Definitely not NIST 800-53, PCI-DSS, or ISO 27001; all of which stipulate ssh key management not password-based authentication.
Whoever downvoted you probably doesn’t understand what you’re saying. This package doesn’t stipulate as to what regulations, frameworks, standards etc it is checking compliance against.
If it doesn’t say what it’s checking it’s compliant against, how can it determine if you’re compliant to it or not?
ISO 27001? SOC2? CIS Benchmarks? HIPAA? GDPR? NIST CSF? 800-53? PCI DSS? Cyber Essentials? Vendor guidance?
This seems, at best, some general security checks but not mapped to any framework in particular.
The Linux Security Audit Project is far more mature in this regard and maps checks to specific frameworks.
I don’t miss the PowerBook’s battery life though…
Framework upon framework, abstraction upon abstraction. In pursuit of consistency and ease of development, the art of computer programming was lost and replaced with careless consumption of resources.