a CIS benchmark pack would be tight