AWS security assessment

I have been tasked to do a security assessment/auditing in a small AWS infrastructure where they have some 20 EC2 instances. The AWS has mostly their DevOps environment with Github, Jenkins, secret managers etc. I am planning to check the security assessment against the CIS rules.
https://www.cisecurity.org/benchmark/amazon_web_services

Anyone has suggestion that I should be following else than CIS? Again, it not a penetration testing but a security assessment.
Thanks for your suggestions.

assessment auditing aws check cis cybersecurity devops ec2 environment etc github infrastructure jenkins managers planning rules secret security security assessment