How to Generate Guidance

The generate_guidance.py script creates outputs from your baseline. By default it generates documentation (AsciiDoc, HTML, PDF). With additional flags, you can also generate compliance scripts, configuration profiles, and more.

Generate Guidance

Run the script with your baseline

./scripts/generate_guidance.py baselines/BASELINE_NAME.yaml

Example:

./scripts/generate_guidance.py baselines/800-53r5_moderate.yaml

Add flags for additional outputs
Terminal window
```
./scripts/generate_guidance.py -s -p baselines/800-53r5_moderate.yaml
```
This generates guidance docs plus compliance script (-s) and configuration profiles (-p).
Find your files

All outputs are saved to build/BASELINE_NAME/:
- Directorybuild/
  - Directory800-53r5_moderate/
    800-53r5_moderate.adoc - AsciiDoc source
    800-53r5_moderate.html - Web documentation
    800-53r5_moderate.pdf - Printable documentation
    800-53r5_moderate_compliance.sh - Compliance script (if -s)
    800-53r5_moderate.xls - Excel spreadsheet (if -x)
    Directorymobileconfigs/ - Configuration profiles (if -p)
    Directoryunsigned/ - Unsigned profiles
    …
    Directorysigned/ - Signed profiles (if -H)
    …
    Directorypreferences/ - Preference plists
    …
    Directorydeclarative/ - DDM components (if -D)
    Directoryactivations/
    …
    Directoryconfigurations/
    …
    Directoryassets/
    …
    Directorypreferences/ - Audit preference files
    …

Command Reference

Flag	Output
(none)	Guidance documents (.adoc, .html, .pdf)
`-s`	Compliance script
`-p`	Configuration profiles (one per payload)
`-P`	Single consolidated configuration profile
`-D`	Declarative Device Management (DDM) components
`-x`	Excel spreadsheet

Additional options:

Flag	Description
`-h`	Show help message
`-l LOGO`	Include custom logo in documentation
`-H HASH`	Sign configuration profiles with certificate
`-a NAME`	Custom name for audit plist and log
`-r REF`	Use reference ID instead of rule ID

Common Examples

Generate documentation only:

./scripts/generate_guidance.py baselines/800-53r5_moderate.yaml

Generate everything for MDM deployment:

./scripts/generate_guidance.py -s -p -D baselines/DISA-STIG.yaml

Generate with signed profiles:

./scripts/generate_guidance.py -p -H YOUR_CERT_HASH baselines/cis_lvl2.yaml

Generate documentation with custom logo:

./scripts/generate_guidance.py -l /path/to/logo.png baselines/800-53r5_moderate.yaml

Built-in vs Custom Baselines

You can use either type of baseline:

Type	Location	Use Case
Built-in	`baselines/`	Standard frameworks without customization
Custom	`build/baselines/`	Tailored baselines for your organization

Both produce the same outputs. Custom baselines reflect your organization’s specific settings and excluded rules.

Next Steps

How to Generate Configuration Profiles - Details on the -p flag
How to Generate Compliance Scripts - Details on the -s flag
Guidance File Example - See a sample PDF output