A security engineer is tasked with evaluating the security posture of a fleet of newly commissioned Linux web servers. The organization has an approved secure configuration baseline documented in its policy. The engineer wants to determine which servers deviate from the mandated settings (e.g., password policy, disabled services, file permissions, audit logging) without relying solely on generic vulnerability CVE detection. Which assessment approach BEST meets this specific need?