How to assess AIX 7.3 against CIS — when no free assessor exists
CIS publishes a consolidated CIS IBM AIX 7 Benchmark (v1.2.0) covering supported AIX 7.x releases, including 7.3. What doesn't exist is a free, supported assessor for it: CIS-CAT Pro Assessor v4 has no AIX coverage, Assessor v3 is end-of-life, and PowerSC and Tenable are licensed products. Every free route is a generic Unix audit, a manual review, or an explicitly bounded cross-check.
Published
Direct answer: The consolidated CIS IBM AIX 7 Benchmark v1.2.0 covers AIX 7.3, but no free, supported assessor exists. Use a licensed assessor for a benchmark result. For any free route, record which controls you cross-check and label every gap. PTxray is a free, read-only assessment with a documented subset of DISA STIG requirements known-covered. For CIS, it provides a numeric cross-check mapped to a small set of CIS L1 control IDs — a given report shows verdicts only for the controls actually assessed on that system; anything unreached stays not assessed.
The practical options differ mainly in the standard they can actually evaluate, the evidence they retain, and what they cost. Licensed PowerSC and Tenable routes can assess CIS content, while CIS-CAT does not provide a supported AIX assessor and free routes remain generic Unix audits, manual reviews, or bounded cross-checks.
Rather not do this alone? Book a Walkthrough
IBM PowerSC: licensed, release-specific profiles
PowerSC ships CIS compliance profiles for AIX; which benchmark version you get depends on your PowerSC release — confirm the profile's benchmark and date in IBM's documentation for your level before citing the result.
Limit: PowerSC is licensed IBM software, and the report inherits the scope and date of the profile it ran.
CIS-CAT: no supported AIX assessor
CIS-CAT Pro Assessor v3 is end-of-life (final release Nov 2021, availability ended Nov 2022). The CIS-CAT Pro Assessor v4 coverage guide lists no AIX benchmark, including the consolidated one.
Limit: there is no CIS-native assessor route on AIX: v3 is end-of-life, and v4 has no AIX coverage. CIS documents the v3 timeline in its Assessor v3 end-of-life notice.
Tenable audit files: repeatable, paid scanning
Tenable distributes CIS IBM AIX 7 v1.2.0 L1/L2 audit files, updated 2026-06, through its commercial scanner feeds. Paid Tenable scanning can produce a current consolidated-benchmark result for AIX 7.3 when the matching audit file is selected.
Limit: this is a paid route. Record whether you ran the L1 or L2 audit file, its version and update date, and the scanner and feed versions. Tenable’s CIS IBM audit-file report lists the required scanner and feed components.
Lynis: useful generic Unix checks
Lynis supports AIX and can identify generic Unix hardening issues using the commands and files available on the host. It is useful for a broad second opinion and for finding configuration hygiene problems outside a narrow benchmark.
Limit: generic Unix checks are not an AIX 7.3 CIS result. You still have to identify which finding supports which AIX-specific requirement and keep that cross-reference current.
Manual review: transparent, labor-intensive
You can review security attributes with lssec, network tunables with no, accounts with lsuser, services with lssrc, and file ownership and modes with ls -ldn. This is the no-product route and gives you direct control of the evidence.
Limit: you must choose and version the control list, run the same commands consistently on every host, preserve the output, handle unreadable evidence honestly, and repeat the review when either the system or the reference changes.
What PTxray does
PTxray is a free, open-source (Apache-2.0), ungated, single-file, read-only AIX assessment. It installs no agent, makes no configuration changes, and produces a plain-English report that stays with the operator.
- DISA STIG for IBM AIX 7.x: A documented subset of requirements known-covered, with PASS, FAIL, or not-assessed evidence reported per covered V-ID.
- CIS: PTxray's CIS check is a numeric cross-check mapped to a small set of CIS L1 control IDs — a given report shows verdicts only for the controls actually assessed on that system; anything unreached stays not assessed. This is a bounded cross-check; PTxray does not implement the CIS IBM AIX 7 Benchmark.
The source and releases are public in the PTxray GitHub repository. For the wider operational evidence around lifecycle, patch currency, storage, resilience, errors, security, configuration, monitoring, and backups, use the complete AIX audit guide.
Questions practitioners usually ask
Can I call the result CIS-compliant?
No. The consolidated CIS IBM AIX 7 Benchmark v1.2.0 covers AIX 7.3, but no free, supported assessor exists and PTxray does not implement the CIS IBM AIX 7 Benchmark. PTxray provides a numeric cross-check mapped to a small set of CIS L1 control IDs — a given report shows verdicts only for the controls actually assessed on that system; anything unreached stays not assessed. That bounded cross-check is not a full or certified benchmark result.
Why use the DISA STIG as the primary reference?
The DISA STIG for IBM AIX 7.x has a published requirement inventory and stable V-IDs. PTxray can therefore name the requirements it covers and report the evidence for each covered V-ID instead of implying an unknown denominator.
What evidence should I retain?
Keep the exact tool or script version, the reference-data attestation, the raw or rendered report, the assessment date, and every not-assessed result. That is enough for another administrator to reproduce what was checked and see what still requires manual review.
Start with evidence you can inspect.
Read the single file, run the assessment locally, and keep the report. The standards boundaries travel with the findings. Then upload the report for a free Black Box Blueprint.