How do I automate CIS benchmark scanning?

More context

The manual alternative is running a point-in-time scanner, exporting results, and reconciling them against framework spreadsheets by hand. That workflow breaks down on three axes: coverage (every system, every benchmark), frequency (drift accumulates between runs), and evidence (auditors want a continuous operational record, not snapshots).

An automated pipeline schedules scans, stores results centrally, alerts on drift the moment a setting changes, and produces framework-mapped reports without human reconciliation. CISGuard deployments are onboarded by CISGuard engineers, so scan scheduling and framework mapping are configured during rollout rather than left as customer homework.