How are you applying CIS benchmarks across Linux and Windows servers?

For Windows, Group Policy is a straightforward place to start. Intune may also be an option depending on how you manage the machines. For Linux, Ansible roles can apply settings across groups of hosts, with separate variables or roles for each distribution and version.

Ansible can also work with Windows Desired State Configuration, though that may be more appealing if your team already relies heavily on Ansible.

I'd put a lot of effort into testing before choosing the tool. Applying a whole benchmark to existing production servers can break applications or access. Try the controls on representative test systems, work out what each workload needs, and roll changes out gradually.

You don't necessarily have to accept every Level 1 or Level 2 recommendation unchanged. Document the controls you exclude or adjust and why, so those decisions can be reviewed.

Consider building the hardening into your base images for new servers instead of relying entirely on changes after deployment. An image pipeline using Packer and Ansible can apply the selected controls, and Terraform can be part of the provisioning process.

Keep separate templates for the operating systems and versions you support, then test and refresh the images as patches and benchmark requirements change. Existing servers still need their own migration plan.

For RHEL systems, take a look at its security guidance and OpenSCAP as well. That gives you another way to assess settings against a security profile. Check which profile and benchmark version you're using before treating a scan result as your target.