Putting security risks on simmer with Chef

To remain PCI-compliant, I conduct quarterly security assessments of our infrastructure. This means external testing of our internet-facing PCI resources, using an approved scanning vendor (ASV), and what I call internal PCI full-population scans.Trouble TicketAt issue: Too many servers with too many different configurations make it tough to stay in compliance.
Action plan: Use Chef and the CIS guidelines to ensure that servers are properly configured.
We do the external scanning ever