To evaluate the security compliance of a group of servers against best practices, which of the following BEST applies?