How do I run the CIS Kubernetes Benchmark?

More context

The control-plane and node split matters for tooling: control-plane checks read API server, etcd, and controller flags and files, while node checks verify kubelet configuration and file permissions on every worker. On managed services such as AKS and EKS the provider controls the control plane, which is why CIS publishes distribution-specific benchmark variants that scope the checks to what the customer can actually configure.

Point-in-time runs answer "is this cluster compliant today?" but Kubernetes environments change constantly as workloads deploy and nodes rotate. Continuous agentless scanning keeps every cluster verified between audits, flags drift as it happens, and maps results to NIST 800-53, ISO 27001, and SOC 2, which is the operating model CISGuard provides.