---
- name: Normalize CIS input
  ansible.builtin.set_fact:
    cis_enabled: "{{ cis is defined and (cis is mapping or cis | bool) }}"
    cis_input: "{{ cis if cis is mapping else {} }}"

- name: Normalize CIS configuration
  when: cis_enabled and cis_cfg is not defined
  ansible.builtin.set_fact:
    cis_cfg: "{{ cis_defaults | combine(cis_input, recursive=True) }}"