CIS Benchmarks
The Center for Internet Security (CIS) is a not-for-profit organization that aims to identify and promote best-practice cybersecurity standards and policies. It develops and promotes IT security guidance with the input from a community of cybersecurity experts. CIS draws members from a range of backgrounds including private companies, government, and research institutions. The aim is to take a collaborative approach to improving cybersecurity and responding to known cyber threats.
To achieve this, CIS provides a range of tools, resources and programs to enable best-practice IT governance within organizations and government. Many of these tools and resources can be accessed free of charge. CIS actively monitors cyber threats to help national and local governments to promote cybersecurity procedures through the Multi-State Information Sharing and Analysis Center (MS-ISAC).
MS-ISAC provides members with resources and tools for improved IT governance, cybersecurity notifications, and reports on active cyber threats. CIS offers different programs to organizations to promote cybersecurity procedures.
What is CIS Compliance?
CIS compliance means your systems are configured to satisfy the recommendations in the applicable CIS Benchmarks, of which there are more than 100 covering operating systems, cloud platforms, databases, network devices, and desktop software.
Though CIS benchmarks stand alone, compliance with them is part of a broader IT risk management strategy. CIS publishes mappings from its benchmarks to the NIST Cybersecurity Framework and other regulatory requirements, so hardening against a benchmark also makes measurable progress toward those obligations.
The benchmarks are free to download, and each recommendation is developed through a consensus process of security practitioners. In practice that means you get specific settings and the audit steps to verify them, rather than abstract principles, and applying them closes off the default-configuration weaknesses that common attacks rely on.
CIS Controls
CIS publishes two complementary bodies of guidance. The CIS Critical Security Controls (currently version 8.1) describe what an organization should do across its security program: a prioritized set of safeguards for defending against the most common attack techniques. The CIS Benchmarks describe how to configure specific products in line with that guidance, and each benchmark recommendation maps back to the Controls. Hardening systems against benchmarks therefore also advances a CIS Controls implementation, and many organizations pursue the two together.
The Controls are voluntary best practices rather than a mandated standard, and version 8.1 organizes them into 18 categories:
- Inventory and Control of Enterprise Assets
- Inventory and Control of Software Assets
- Data Protection
- Secure Configuration of Enterprise Assets and Software
- Account Management
- Access Control Management
- Continuous Vulnerability Management
- Audit Log Management
- Email and Web Browser Protections
- Malware Defenses
- Data Recovery
- Network Infrastructure Management
- Network Monitoring and Defense
- Security Awareness and Skills Training
- Service Provider Management
- Application Software Security
- Incident Response Management
- Penetration Testing
Each control breaks down into individual safeguards, which are the unit you actually implement and evidence. Not every safeguard produces evidence automatically; for the artifacts that typically satisfy manually evidenced control areas, see Example Evidence.
Implementation Groups
Every safeguard is assigned to one of three cumulative Implementation Groups (IGs), which tell you where to start based on your organization's size, resources, and risk profile:
- IG1: Essential cyber hygiene, the minimum baseline CIS recommends for every enterprise. It targets smaller organizations with limited IT and security resources and defends against the most common, non-targeted attacks.
- IG2: Everything in IG1 plus safeguards for organizations with dedicated IT or security staff managing more operational complexity and more sensitive data.
- IG3: Everything in IG1 and IG2 plus advanced safeguards for larger or higher-risk organizations, particularly those handling sensitive or regulated data that attracts targeted attacks.
We recommend starting with IG1 regardless of organization size, because it establishes the foundation the later groups build on and covers the attack techniques most organizations actually face.
What Are CIS Benchmarks?
Each CIS Benchmark is a set of consensus configuration recommendations for a specific product, such as an operating system, cloud platform, database, or network device. Every recommendation states the setting to apply, the rationale for it, and the audit steps to verify it, which is what makes the benchmarks directly actionable rather than abstract guidance.
CIS Benchmarks are compatible with existing IT risk management policies and procedures like internal audit. Internal audit can use CIS Benchmarks as a tool to evaluate configurations for systems and data, and teams can then remediate the recommendations the audit found unmet.
What Is the Structure of CIS Benchmarks?
Each benchmark follows a similar structure. The beginning provides an overview of the benchmark, outlining definitions and the benchmark’s intended audience. The bulk of the CIS Benchmarks document is a series of recommendations to ensure the correct configuration of an IT system. Each CIS Benchmark may have hundreds of recommendations grouped into different policies and areas of the IT system.
Scored & Unscored CIS Recommendations
Each recommendation is either ‘scored’ or ‘not scored.’ ‘Scored’ recommendations are mandatory to achieve CIS compliance, and if not met, they lower the total benchmark score. Recommendations that are ‘not scored’ have no impact on the overall score of the benchmark. CIS Benchmarks contain a checklist appendix that helps compliance monitoring for each recommendation.
What Are CIS Benchmark Profiles?
To help organizations with implementation, each recommendation within a CIS Benchmark is assigned a level-1 or level-2 profile. The profile levels represent the potential impact of a recommendation on the organization’s IT systems and cybersecurity defense. It helps organizations understand which recommendations meet their cybersecurity needs and available resources. Profiles reiterate the importance of using a test environment when implementing CIS Benchmark recommendations.
- Level-1 Profile: Baseline recommendations that harden a system with little or no impact on its normal functionality. Most organizations can apply these without disrupting existing operations.
- Level-2 Profile: Defense-in-depth recommendations for high-security environments. These settings provide stronger protection but can reduce functionality or conflict with existing configurations, so test them before rolling them out broadly.
How to Use CIS Benchmarks
CIS Benchmarks provide configuration standards for a wide range of IT technologies. You do not have to adopt them wholesale: pick the benchmarks for the systems you actually run, apply the profile that fits your risk tolerance, and use the audit steps in each recommendation to verify the result.
CIS Benchmarks can be grouped into seven main areas:
| Area | Coverage |
|---|---|
| Server Software | Proper configuration of server software from various vendors, including commonly used software such as VMware and Microsoft Windows Server, plus database servers, web servers, DNS servers, and authentication servers. Recommendations cover storage settings and restrictions, admin controls, and server settings. |
| Multi-Function Print Devices | Print devices have become targets for cyber threats as a gateway into an organization’s network. Recommendations cover topics like file sharing, server configurations, and secure access to wireless networks. |
| Cloud Providers | Best practice cybersecurity configurations for the most well-known cloud services and infrastructure, including Amazon Web Services, Microsoft Azure, Oracle Cloud Infrastructure, and Google Cloud Computing Platform. Recommendations cover network settings, safeguards to ensure compliance with regulations, and IT governance and management. |
| Mobile Devices | Guidance for configuring Apple iOS, iPadOS, and Google Android operating systems and devices. Recommendations cover browser and developer settings, app permissions and privacy, and mobile operating system settings. |
| Desktop Software | Best practice configuration for commonly used desktop software, including the Microsoft Office suite and the top web browsers (Google Chrome, Mozilla Firefox, Safari, and Microsoft's browser). Recommendations cover browser settings, management of third-party software, server settings, and device management. |
| Network Devices | Configuration of network devices and hardware from various vendors, including Cisco, Juniper, Check Point Firewall, and Palo Alto Networks, ensuring cybersecurity standards across all network hardware to strengthen the overall IT governance strategy. |
| Operating Systems | Proper cybersecurity configurations for the top operating systems, including Linux, Microsoft Windows and servers, and Apple macOS, mapped to different iterations, with guidance for both enterprise and personal versions. Recommendations cover driver installation, user profile management, and remote access restrictions. |
What Is CIS Certification?
Organizations that provide cybersecurity products as a service can get CIS certification for the product. This certifies that the product in question is compatible with the cybersecurity recommendations in the relevant CIS Benchmark.
Organizations must have CIS Security Software Vendor (SSV) membership before getting certified. Certification proves that the IT product or system meets best-practice cybersecurity standards. It also means users can configure the product to meet CIS Benchmark recommendations.
Organizations will need to test and document the product to demonstrate compliance with CIS Benchmarks. CIS will then need to validate the test results before providing certification. Once certified, organizations can display the CIS-certified logo alongside the product to highlight CIS compliance. Potential customers will know that the product complies with CIS Benchmarks, informing IT governance decisions.
What is the CIS certification process?
To achieve CIS certification, organizations must first be members of CIS Security Software Vendor (SSV) group. The next step is to record and submit evidence to prove compliance with a CIS Benchmark. Certification is against one CIS Benchmark.
To prove compliance, organizations will need to perform tests against each recommendation in the CIS Benchmark. Results are collected and submitted in the main section of the application. Documentation explores each recommendation’s pass or fail state and highlights any exemptions or mitigating factors. This includes detailed explanations for any failure.
It will usually take around two weeks for CIS to review a certification application. This process will take longer if the organization isn’t compliant, needs to make improvements or submits an incomplete application.