Yeah .. voting around here is interesting from time to time.

On a positive note, I hadn't heard of the Linux Security Audit Project, looks interesting, thank you.

I only briefly skimmed through the readme so I might have missed it, but I wonder how they're able to claim compliance with specific standards.

It was my understanding that it's typically a drawn out expensive process with a certificate to hang on the wall after the fact.

This seems, at best, some general security checks but not mapped to any framework in particular.

So. Yes. Ssh access should be passwords only, etc. Some common sense. We don’t need standard to that

UPDATE: sorry for the typo, meant passwordless