> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kikimora.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Hardening overview

> Automated Security Configuration Assessment benchmarks that measure how closely your endpoints follow standards such as the CIS benchmarks.

**Compliance → Hardening** runs automated Security Configuration Assessment (SCA) benchmark evaluations against every connected endpoint. These assessments continuously verify whether your operating systems and configurations follow recognized industry standards, such as the Center for Internet Security (CIS) benchmarks.

## Purpose

Hardening evaluates endpoint security posture against standardized policies. By automatically checking system configuration, password policy, user rights assignment, registry settings, and auditing settings, it lets you:

* identify misconfigurations across Windows, Linux, and other enterprise operating systems;
* measure compliance scores per endpoint and per benchmark;
* track remediation using check-level descriptions, rationales, and step-by-step remediation commands.

## Key concepts

* **Policy / benchmark** — a structured set of security recommendations from a standards body, such as the CIS Microsoft Windows 11 Enterprise Benchmark, or defined internally. Policies group checks by platform and functional domain.
* **Check** — a single security configuration rule evaluated on an endpoint, for example "Ensure 'Enforce password history' is set to '24 or more password(s)'".
* **Custom policy** — your own benchmark, built by selecting a subset of checks from a base benchmark and applying them to chosen endpoints.

### Check statuses

| Status             | Meaning                                                              |
| :----------------- | :------------------------------------------------------------------- |
| **Passed**         | The endpoint's configuration meets or exceeds the check's criteria.  |
| **Failed**         | The endpoint's configuration violates the rule.                      |
| **Not Applicable** | The check does not apply to this OS version or system configuration. |

### Pass score

The overall compliance percentage. Not Applicable checks are excluded from the calculation entirely:

```
Pass Score = ( Passed Checks / (Passed Checks + Failed Checks) ) × 100
```

## Controls and filtering

* **Select Policy** — the combobox in the top header filters every chart and summary statistic to one benchmark, such as *CIS Microsoft Windows 11 Enterprise Benchmark v3.0.0*, or shows aggregate data across *All Policies*.
* **Endpoint / hostname filter** — narrows results to specific hostnames or IP addresses.
* **Advanced Filters** — multi-criteria filtering across endpoints, connectivity status, and score ranges.

## Related modules

* [Endpoints](/endpoints/index) — inventory, connectivity, and system details for every monitored agent.
* [Approved software](/compliance-approved-software/index) — software inventory compliance and baseline rules.
* [Integrity monitoring](/compliance-integrity-monitoring/index) — file and registry integrity changes.