CIS Benchmarks and DISA STIGs are a strong starting point, but few organizations apply them exactly as written. From 26 October, Nipper InfraSight will reflect that – giving you the option to choose which controls you assess, set the values your own policies use, and record why. That will result in reports that reflect your standards and stand up to an auditor, a regulator, or your board.
Best practice frameworks like the CIS Benchmarks are thorough, but broad. For most organizations, not everything within them is applicable. Some controls don’t fit your environment. Some can’t be met on a legacy device you’ve protected another way. Some use values that differ from your own policy.
You can, of course, clean up the report afterwards: verifying each finding independently, removing the ones you’ve already accepted, or simply ignoring them. But separating the findings you need to fix from the exceptions you’ve already accepted takes time – and then you must explain the difference to an auditor.
Imagine configuring the assessment before you start: excluding the controls you don’t want to assess against and entering the values your organization does use.
Your report then reflects your standards. It doesn’t fill up with findings for controls you’ve deliberately excluded, and it doesn’t confirm that you’ve met standards that don’t apply to you.
The latest release of Nipper InfraSight (available 26 October 2026) lets you do exactly this. You can selectively include or exclude specific CIS Benchmarks on a per-device basis.
For benchmarks based on set parameters, you will soon be able to customize expected values at the benchmark level, such as reducing a maximum SSH session timeout from 10 minutes to 5 minutes to reflect your operation.
The result is a report you can defend: it shows what matters to your organization, with the settings you chose, and the reasons why (provided you record them).
We’ll be adding the same capability to Nipper OmniSight by the end of January 2027.
If you conduct assessments for third parties, this matters even more. You can define a distinct policy for each customer, store all their exclusions and preferences, and then apply those every time you assess their network. That means your reports consistently reflect that customer’s requirements without hours of manual clean-up.
October’s release brings similar configurability to DISA STIG assessment in Nipper InfraSight. You can apply existing waivers – a particular STIG that doesn’t apply to your operational/mission purpose for example – and introduce new ones, and you can document the reasons why. Waived items are excluded from the report, and the reason is stored with the policy.
The resulting report is far more useful to the people accountable for compliance, because it doesn’t report known, approved exceptions as compliance failures. You spend less time answering questions up the chain about findings that don’t apply, and more time on the issues that really matter – with a stored rationale an auditor can follow.
Outside the US military environment, organizations in other countries and sectors use the STIGs as a best practice framework, or to provide security assurance for joint working.
For these organizations, configurability for assessments in Nipper solutions works the same way as it does for CIS Benchmarks: you opt in to the STIGs you want to measure against and deselect those that aren’t relevant.
That matters because organizations outside the US defense sector may have different risk profiles from military organizations. They can now conduct assessments with Nipper InfraSight against the parts of the framework that fit their risk and requirements.
If you must comply with CIS Benchmarks, you can start using this in Nipper InfraSight from 26 October 2026. Our team will support you as you do. DISA STIGs will follow in January 2027, along with Nipper OmniSight.
Beyond that, we are exploring how similar configurability can be built into Nipper assessments for other compliance frameworks.
We are also examining whether Nipper OmniSight users could build fully custom policies from scratch, creating automated assessments for devices where no formal benchmarks exist. We’ll keep you informed of progress on both fronts.
Contact our teamWe’ll be providing customers with more details of this new feature, and other changes in the next releases of Nipper InfraSight and Nipper OmniSight. To discuss how configurable assessment could work for your network, contact our team. |
Find out how Nipper solutions support accurate, repeatable DISA STIG assessments.
Discover our CIS Benchmarks-accredited Nipper solutions.
About Nipper SolutionsTitania’s Nipper solutions assess configuration files from firewalls, routers, switches, and wireless access points – physical and virtual, with expanding coverage for SD-WAN and software-defined network (SDN) environments – finding security issues, compliance gaps, and weak settings. They find access rules that are not working as intended – the gaps other tools can’t see because they check that a rule exists, not that it still functions as intended. The key distinction: they work without agents, live-network scanning, or cloud dependency, so sensitive and air-gapped networks can be assessed safely without disrupting production systems. Analysis also goes deeper than individual settings, examining how rules, routes, segmentation, and device relationships combine – then prioritizing what to fix and why, ranking each gap by exploitability and impact so teams act on what matters most first. The result is evidence teams can use to harden devices, prove compliance, and reduce exposure – helping close gaps before AI-accelerated attackers reach them. |