Chef Premium Content is curated, ready-to-use content built on published security benchmarks and distributed to licensed Chef users. It’s maintained by Chef against the source benchmarks, so you assess and correct systems against a recognized standard without authoring and tracking that content yourself.
Premium Content comes in two forms:
| Content | Description | How you run it |
|---|---|---|
| Audit | Chef InSpec profiles that assess a system against a benchmark and report which requirements pass and fail | Chef InSpec, the Compliance Phase, or an Automate scan job |
| Remediation | Chef Infra cookbooks that correct the configuration behind a failed requirement | Chef Infra Client |
Both are built from the same published benchmarks — the CIS Benchmarks and DISA STIGs — but they’re maintained as separate content, which is why coverage is tracked separately for each.
Access Chef Premium Content
Premium Content is part of the Chef Enterprise entitlement. See Progress Chef Enterprise Edition for what the entitlement includes, and contact your Chef account representative to confirm your access.
Benchmark coverage
Audit and remediation coverage are tracked independently: a benchmark can have one, the other, or both, and the versions available for each can differ. Every version is listed — version sets are never reduced to a single latest version — because which version of a benchmark you’re covered against is usually the question that matters.
Current coverage is 127 benchmarks:
| Coverage | Benchmarks |
|---|---|
| Audit and remediation | 53 |
| Audit only | 66 |
| Remediation only | 8 |
| Total | 127 |
Across those benchmarks there are 191 audit versions and 84 remediation versions.
Browse coverage by category:
| Category | Benchmarks |
|---|---|
| Operating Systems | 66 |
| Desktop / Client | 23 |
| Databases | 15 |
| Applications / Middleware | 9 |
| Cloud | 4 |
| Web Servers | 5 |
| Containers / Kubernetes | 2 |
| Network / Infrastructure | 2 |
| Virtualization | 1 |
How to read the coverage tables
| Term | Meaning |
|---|---|
| Audit + Remediation | Both audit and remediation content cover this benchmark |
| Partial Audit + Remediation | Both are present, but the version sets overlap only partly |
| Audit Ahead | Audit content covers a newer benchmark version than remediation content does |
| Remediation Ahead | Remediation content covers a newer benchmark version than audit content does |
| Audit Only | Audit content only; no current remediation content |
| Remediation Only | Remediation content only; no current audit content |
An entry in a coverage table means Chef currently publishes content for that benchmark version. It isn’t a statement about your own compliance posture, which depends on the systems you assess and the results you act on.
Before you plan work around remediation content
Remediation coverage is narrower than audit coverage, and available versions differ by benchmark, so check the category tables before committing to a remediation approach for a specific benchmark. Benchmarks are revised and Chef updates content to follow them, so treat coverage as current state rather than a fixed guarantee.
For what to check before you run remediation content against production systems, see before you use remediation content.
Use Premium Content
The coverage tables tell you what exists. For how to run audit content, read its results, and correct what fails, see the Chef Compliance solution, which covers the workflow end to end.
When your requirement isn’t covered by a published benchmark, you can write your own Chef InSpec controls instead. See The Chef way of custom compliance checks.