Introducing the Compliance Enforcement Modules

The Puppet Compliance Enforcement Modules (CEM) were developed to enforce the secure configuration of IT infrastructures and thus protect operations and data. You can use CEM with Puppet Enterprise (PE) or open source Puppet. You can enforce the Center for Internet Security (CIS) compliance rules, which embody internationally recognized standards. You can also enforce the Security Technical Implementation Guides (STIGs) developed by the US Defense Information Systems Agency (DISA). DISA STIG standards are implemented by many US government agencies.

After you install and configure CEM, PE or open source Puppet runs on any classified nodes without user intervention to enforce compliance. By default, CEM enforces CIS rules for the Level 1 profile. However, you can enforce a variety of security standards and levels, depending on the operating system of the nodes where your servers and workstations are installed. For a list of supported standards for Linux nodes, see Prepare to install the module. For a list of supported standards for Microsoft Windows nodes, see Prepare to install the module.

The following sections provide instructions for installing CEM and customizing the configuration settings, if necessary, to meet your organization’s requirements.