diff --git a/ironic/conductor.sls b/ironic/conductor.sls
index e566200..bc0fc7f 100644
--- a/ironic/conductor.sls
+++ b/ironic/conductor.sls
@@ -137,4 +137,21 @@
 {%- endfor %}
 {%- endif %}
 
+{# we have disabled iscsi by default according to CIS requirement, enable it explicitly #}
+ironic_iscsi_packages:
+  pkg.installed:
+    - names:
+      - open-iscsi
+    - require_in:
+      - {{ conductor.service }}
+
+ironic_scsi_service:
+  service.running:
+    - names:
+      - iscsid
+    - enable: true
+  {%- if grains.get('noservices') %}
+    - onlyif: /bin/false
+  {%- endif %}
+
 {%- endif %}