CIS and audit rules