Inheritance & overlays

Reuse and tailor baselines.

You rarely write a whole baseline from scratch — you inherit one and tailor it. A profile can depend on another and then include, skip, or modify its controls. This is the overlay pattern: take an upstream CIS or DISA baseline as the base, and your organization’s profile overlays it — skipping controls that do not apply, adjusting inputs, and adding org-specific controls the baseline lacks. You get the rigor of a maintained baseline plus your own tailoring, without forking it.

# include controls from the inherited baseline, with tailoring
include_controls 'cis-dil-benchmark' do
  # skip a control that genuinely does not apply, with justification
  skip_control 'xccdf_org.cisecurity.benchmarks_rule_1.1.1.1'
  # override a control’s expectation for your environment
  control 'sshd-01' do
    describe sshd_config do
      its('ClientAliveInterval') { should cmp <= 900 }
    end
  end
end

Base plus overlay, maintained separately

The value is separation: the upstream baseline is maintained by its community and you consume new versions, while your overlay holds only your deltas — the skips, the tightened thresholds, the extra controls — which stay small and reviewable. When the baseline updates, you adopt it and re-check your overlay, rather than diffing a forked copy. It is the same base/overlay discipline as Kustomize or Terragrunt, applied to compliance content.