Stupid security guys! They only know concepts and has no technical knowledge about their technical field. They just read some documentations. But most important steps of having security is applying configuration and reviewing current configuration. Also, they have no idea that what are they doing on servers and client. CIS benchmarks are reference for hardening most popular operating systems, but you cannot apply the desired configurations in large scale of servers or clients without using some tools.
