CIS Benchmarks
Also known as: CIS Benchmark, Center for Internet Security Benchmarks, CIS hardening guides, CIS secure configuration
CIS Benchmarks are a set of internationally recognized, consensus-developed configuration guidelines published by the Center for Internet Security for securing operating systems, cloud platforms, browsers, databases, middleware, and applications.
Each benchmark specifies exact configuration settings (registry keys, file permissions, network settings, service configurations) with two profiles: Level 1 (practical security with minimal impact on functionality) and Level 2 (stronger security that may affect usability or services). CIS Benchmarks are free to use and are widely referenced in compliance frameworks including PCI DSS, HIPAA, and FedRAMP.
CIS Benchmarks, explained at three levels
At home
CIS Benchmarks answer the question 'exactly how should I configure this?' for specific systems and software. Rather than saying 'configure your systems securely' in abstract terms, a CIS Benchmark for Windows 11 tells you that the 'Minimum password length' policy should be set to at least 14 characters, that the built-in Administrator account should be renamed, and hundreds of other specific settings. Think of it as the manufacturer's recommended configuration settings, except written by independent security experts instead of the company that sold you the product.
At work
CIS Benchmarks are the most commonly referenced secure configuration baseline in the industry. When your organization says 'systems must be configured to CIS Benchmark Level 1', it means each server, workstation, or cloud account must be configured according to those specific guidelines before being placed in production. Compliance teams use them to define technical baselines; vulnerability scanners use them to check whether systems are configured correctly; auditors use them to verify secure configuration controls.
At home
Each CIS Benchmark recommendation is rated by its profile: Level 1 recommendations are designed to be lower risk in terms of impact on system functionality: applying them should not break normal operations. Level 2 recommendations provide stronger security but may prevent certain features from working or require additional configuration effort. Most organizations apply Level 1 as a baseline for all systems and Level 2 selectively for high-sensitivity systems. Each recommendation includes a description, rationale, remediation steps, and audit procedure.
At work
CIS Benchmarks exist for a wide range of technology: operating systems (Windows, Linux, macOS), cloud platforms (AWS Foundations, Microsoft Azure, Google Cloud Platform), virtualization platforms (VMware), containers (Docker, Kubernetes), databases (MySQL, PostgreSQL, SQL Server, MongoDB), web servers (Apache, IIS, Nginx), browsers (Chrome, Firefox), mobile devices (iOS, Android), and major applications. New benchmarks are added as technology evolves; existing benchmarks are updated when vendors release new versions.
At home
CIS Benchmarks are used in automated configuration compliance scanning. Tools like CIS-CAT (CIS Configuration Assessment Tool) scan systems against the relevant benchmark and produce pass/fail results for each recommendation. Cloud providers offer native tooling: AWS Security Hub's CIS AWS Foundations Benchmark standard, Microsoft Defender for Cloud's CIS controls, and Google Cloud's Security Command Center all include automated CIS Benchmark compliance checks. This automation enables continuous configuration compliance monitoring rather than periodic manual audits.
At work
From a practitioner standpoint, the most common challenge with CIS Benchmark implementation is the conflict between security hardening and application functionality. Some Level 1 recommendations (disabling legacy protocols, restricting PowerShell execution policy, removing certain Windows features) break specific applications that were designed for less-hardened environments. Pragmatic implementation requires testing benchmark application in a non-production environment first and documenting justified exceptions for recommendations that cannot be applied without breaking critical functionality. Exceptions must be compensated for with alternative controls.
Real-world examples
At home
Thomas set up a new Linux server for a personal project and wanted to ensure it was configured securely from the start. He downloaded the CIS Benchmark for Ubuntu Linux, worked through the Level 1 recommendations, and used a free scanning tool to verify compliance. The scan flagged eight recommendations he had missed, including SSH configuration settings and unnecessary service accounts.
At work
The DevSecOps team at Clearwater Insurance embedded CIS Benchmark scanning into their Terraform deployment pipeline. Every new cloud instance was automatically checked against the CIS AWS Foundations Benchmark before being approved for production use. Instances failing more than five Level 1 recommendations were automatically quarantined and the deploying team was notified with specific remediation steps.
Common confusions
- CIS Benchmarks are not the same as CIS Controls. CIS Controls define what security outcomes to achieve (Control 4: Secure Configuration of Enterprise Assets and Software); CIS Benchmarks define how to achieve those outcomes for specific technologies (the Ubuntu Linux CIS Benchmark tells you exactly which settings to apply). The Controls are the strategy; the Benchmarks are the technical implementation guidance.
- Level 1 compliance does not make a system fully secure: it establishes a documented minimum baseline. A system perfectly configured to CIS Level 1 can still be compromised through application vulnerabilities, unpatched software, misconfigured network access, or social engineering. CIS Benchmarks address configuration; they are one part of a comprehensive security program, not a substitute for it.
- CIS Benchmarks require maintenance. A benchmark for Windows Server 2019 does not apply without modification to Windows Server 2022. When operating system versions are upgraded, the relevant benchmark must be reviewed and the configuration baseline updated. Organizations that implement a benchmark once and do not update it when systems are patched or upgraded gradually drift from the original baseline without realizing it.
For analysts
In BA artefacts, CIS Benchmarks generate specific, verifiable NFRs for infrastructure and application configuration. When documenting security requirements for a system that will run on a specific OS or cloud platform, reference the applicable CIS Benchmark level as the configuration baseline. This makes the NFR verifiable: the security team can scan the deployed system and produce a pass/fail report. Useful NFR: 'All production servers running Ubuntu Linux 22.04 must be configured to CIS Level 1 compliance, verified by an automated CIS-CAT scan with no more than five accepted exceptions, documented and approved by the Information Security team.'
History & origin
CIS Benchmarks originated from the effort to operationalize the CIS Controls' Secure Configuration control with specific, implementable guidance. The first CIS Benchmarks were published in the early 2000s and have been maintained through a consensus process involving security practitioners, technology vendors, government agencies, and academia. Today, more than 100 benchmarks cover everything from Windows Server 2022 to AWS Foundations, Docker, Kubernetes, Apache, and browser configurations. Microsoft, Google, and Amazon Web Services actively participate in developing the cloud-specific benchmarks for their platforms.