---
- name: Build cis_cfg from defaults and user overrides
  ansible.builtin.set_fact:
    cis_cfg: "{{ cis_defaults | combine(cis | default({}), recursive=true) }}"