How often should CIS benchmark scans run?

More context

The right frequency question is really a drift-exposure question: every day between scans is a day a broken control can sit undetected in production. Environments with frequent change (active administration, configuration management rollouts, cloud infrastructure churn) drift fastest and justify continuous scanning most strongly.

Scheduled-scan tooling forces a tradeoff between scan load and blind-window length. CISGuard is built for continuous scanning with drift detection, so the operational record has no gaps for auditors to question, which is what SOC 2 Type II operating-effectiveness testing and NIST 800-53 CA-7 both look for.