> For the complete documentation index, see [llms.txt](https://docs.platform9.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.platform9.com/private-cloud-director/getting-started/platform9-os/platform9-os-cis-hardening.md).

# Platform9 OS CIS Hardening

Review the CIS compliance posture of a Platform9 OS host, reported live from the OS Hardening page in the Host Management Console.

## Overview

Platform9 OS ships pre-hardened against the CIS RHEL 10 Benchmark. Every host reports its live compliance status through the **OS Hardening** page in the Host Management Console, rather than through a static document. This page explains what that report shows, why some controls are intentionally relaxed, and how to export the full report. It assumes you have already reached the Host Management Console (see [Host Management Console](/private-cloud-director/getting-started/platform9-os/platform9-os-host-management-console.md)).

In this guide, you will learn how to read the OS Hardening page's compliance breakdown and export a report for audit purposes.

## Hardening Baseline

Platform9 OS is scanned against:

* **Benchmark:** CIS RHEL 10 Benchmark v1.0.1 (2025-09-30)
* **Profile:** Level 1 - Server
* **Baseline:** PCD Hardening Baseline v1
* **Scanner:** OpenSCAP 1.4.4

## First-Boot Hardening Flow

On first boot, a `pcd-hardening-remediate` service runs `oscap xccdf eval --remediate` against the baseline, applying the CIS controls to the host. Once remediation completes, a `pcd-hardening-scan` service re-scans the host without remediating, producing the compliance report shown on the **OS Hardening** page. Both services run automatically as part of first boot; no operator action is needed.

Artifacts from both runs are written to `/var/log/pcd-hardening/`, including the remediation results and the final compliance report in HTML, XCCDF, and ARF formats.

## Reading the OS Hardening Page

The **OS Hardening** page shows a real-time breakdown of every control in the baseline, categorized as:

* **Passed:** the control is compliant.
* **Failed:** the control is not compliant.
* **Not Applicable:** the control does not apply to this host's configuration.
* **Relaxed for PCD:** the control is intentionally not enforced at the OS level, because <code class="expression">space.vars.product\_acronym</code> owns the equivalent behavior at a different layer.

Each control also reports a compliance score summarizing the overall pass rate for the host.

Each **Relaxed for PCD** control carries a stated reason on the page. Representative categories of why a control is relaxed include:

* **Firewall and IP forwarding controls:** the Networking Service manages `firewalld`/`nftables` rules and IP forwarding `sysctl` settings directly, so the equivalent OS-level firewall lockdown controls are relaxed.
* **SELinux enforcement:** the host runs SELinux in permissive mode rather than enforcing mode.
* **AIDE and USBGuard:** these controls are disabled.
* **GRUB password for unattended reboot:** the control requiring a GRUB bootloader password is relaxed so that hosts can reboot unattended.
* **`/tmp` and `/var/tmp` noexec:** the controls requiring `noexec` on these mounts are relaxed because QEMU/libvirt helper processes need to execute from these paths.
* **`rpcbind`:** the control requiring `rpcbind` to be disabled is relaxed as an intentional hardening relaxation.

Because the live page always reflects the host's current, authoritative compliance state, this page does not reproduce the full control list. Use the OS Hardening page (or its exported report) as the source of truth for a specific host's compliance detail.

## Exporting a Report

The OS Hardening page supports exporting the full compliance report for audit or record-keeping, in any of the following formats:

* HTML
* XCCDF
* ARF

## Limitations

* **First-boot remediation takes time.** Because `oscap --remediate` runs synchronously as part of first boot, SSH or console access to the host may be unresponsive for up to a few minutes immediately after first boot while remediation completes.
* **CIS Level 2 partition-layout rules are deferred.** The current baseline covers CIS Level 1 in full; Level 2 partition-layout controls are not yet implemented.

## Related Pages

* [Host Management Console](/private-cloud-director/getting-started/platform9-os/platform9-os-host-management-console.md): return to the Host Management Console pages.
* [Platform9 OS](/private-cloud-director/getting-started/platform9-os.md): return to the install overview and limitations.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.platform9.com/private-cloud-director/getting-started/platform9-os/platform9-os-cis-hardening.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.