- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyCIS Controls
- Regulatory ContextTypeGuidanceLegal InstrumentGuidelineSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailUnited StatesPublisherCenter for Internet Security (CIS)
- VersioningVersionVersioned per technology; new releases announced monthlyEffective DateContinuously releasedIssue DateContinuously released
- AdoptionAdoption ModelVoluntaryImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
CIS distributes the Benchmarks free of charge in PDF format from cisecurity.org, and CIS SecureSuite members can download additional formats. The text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- CIS Benchmarks are consensus-developed secure configuration guides that state exactly which settings to apply to harden a specific technology.
- The Center for Internet Security publishes them free in PDF format, covering more than 25 vendor product families.
- They are voluntary and not a certification, although audits and contracts often name them.
- Each benchmark offers Level 1, Level 2, and STIG profiles for one technology and version.
- SmartSuite Cyber & IT Risk holds each benchmark and profile by platform, approved exceptions, scan results, and remediation tasks.
Overview
The CIS Benchmarks are secure configuration guides, developed by the Center for Internet Security (CIS) through a consensus process of cybersecurity professionals and subject matter experts, that tell an organization exactly which settings to apply to harden a specific technology such as an operating system, cloud platform, database, browser or network device. CIS says they cover more than 25 vendor product families, and they are distributed free of charge in PDF format.
CIS, a nonprofit organization, publishes them and develops them with volunteer experts, technology vendors and the CIS Benchmark development team. They are voluntary and not a certification, and they do not bind an organization by law, although audits and contracts often name them.
Organizations implement them by choosing the benchmark and profile for each platform, tailoring exceptions, applying settings through images, configuration management or CIS Build Kits, scanning with CIS-CAT Pro or another benchmark-aware scanner, and remediating drift on a cycle.
Why does it matter?
CIS Benchmarks answer the practical question that policy standards leave open: which exact setting should be applied on this system. Each is specific to one technology and version, so a team can harden a platform to a published, peer-reviewed baseline instead of inventing its own.
Key benefits include:
- Prescriptive, platform-specific settings
Each Benchmark targets a single product and version and lists recommendations with the setting, rationale, audit procedure and remediation.
- Profiles for different risk
Level 1 is a base recommendation that can be implemented fairly promptly, and Level 2 is defense in depth for environments where security is paramount.
- STIG alignment
Where a DISA STIG exists, a STIG profile provides all the recommendations that are STIG specific.
- Consensus, not vendor opinion
Benchmarks are developed through a consensus process of cybersecurity professionals and subject matter experts.
- Tooling to measure them
CIS-CAT Pro assesses system conformance to the Benchmarks, and Build Kits and Hardened Images apply them.
How does it work?
A CIS Benchmark is a document for one technology. Recommendations are grouped into profiles. Level 1 lowers the attack surface while keeping machines usable. Level 2 is intended for environments where security is paramount and can cause problems if not implemented with care. The STIG profile replaced the previous Level 3 and includes the recommendations specific to the relevant DISA STIG, with overlapping Level 1 and Level 2 items shown where they apply.
CIS releases new Benchmarks as the community develops them, and sends monthly emails announcing new and updated ones. CIS Windows Benchmarks cover the latest Windows build within 90 days of its release. Older versions and archived Benchmarks sit in CIS WorkBench, and CIS SecureSuite members can download Benchmarks in additional formats and tailor the recommendations.
CIS-CAT Pro is CIS's assessor for checking system conformance, Build Kits configure systems in accordance with a Benchmark, and Hardened Images are virtual images hardened to the Benchmarks on cloud service provider marketplaces. The Benchmarks map to the CIS Critical Security Controls, such as safeguard 4.1, establish and maintain a secure configuration process.
Key Elements
- Recommendations
Each recommendation states a single configuration setting for the technology, usually with a description, rationale, how to audit it and how to remediate it.
- Level 1 and Level 2 profiles
Level 1 is the base recommendation that can be implemented promptly, keeping machines usable. Level 2 adds defense-in-depth settings for high-security environments and needs careful testing. Organizations choose a profile per platform based on risk.
- STIG profile
The STIG profile provides all recommendations that are STIG specific, so organizations subject to DISA STIGs can use one document. It replaced the earlier Level 3 profile.
- Consensus development
Benchmarks result from a consensus-based process among volunteer experts, technology vendors and the CIS development team. Once consensus is reached the final Benchmark is published online.
- Versioning and currency
Benchmarks are versioned per product, and CIS announces updates monthly. The Windows Benchmarks track a new Windows build within 90 days. Organizations record the benchmark version applied to each system.
- Assessment and implementation tools
CIS-CAT Pro scans for conformance, Build Kits configure systems to a Benchmark and Hardened Images provide pre-hardened virtual machines on cloud marketplaces. CIS SecureSuite membership adds tailoring and additional formats.
What does it cover?
CIS Benchmarks apply to the specific technologies they cover: operating systems, cloud platforms, databases, browsers and network devices, across more than 25 vendor product families. A Benchmark applies to systems running the version it names, and organizations can tailor recommendations to operational needs with documented exceptions.
What are its objectives?
CIS Benchmarks give organizations a consensus baseline for secure configuration.
Provide prescriptive, peer-reviewed secure configuration settings for specific technologies.
Offer profiles that match a system's risk, from base hardening to defense in depth.
Align with DISA STIGs where a STIG exists.
Support measurement of conformance with scanning tools.
Keep recommendations current as vendors release new versions.
Framework in Context
The Benchmarks are the technical complement to the CIS Critical Security Controls: where the Controls say to maintain a secure configuration process, a Benchmark states the settings. They are used in audits and contracts as an accepted configuration baseline, but they do not replace a control framework such as ISO/IEC 27001 or NIST SP 800-53.
Common Framework Mappings
Organizations commonly map CIS Benchmarks to other leading security frameworks to simplify compliance efforts, identify control overlaps, and unify risk management across multiple regulatory or contractual obligations.
Mapped frameworks include:
CIS Controls v8
ISO/IEC 27001
ISO/IEC 27002
NIST Cybersecurity Framework
NIST SP 800-53
PCI DSS
SOC 2
FedRAMP
HIPAA Security Rule
How SmartSuite Supports CIS Benchmarks
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Cyber & IT Risk records to hold each benchmark and profile by platform, the approved exceptions, scan results from CIS-CAT Pro or other scanners and the remediation tasks.
Benchmark and Profile Selection
Record which CIS Benchmark, version and profile (Level 1, Level 2 or STIG) applies to each platform in scope.
Configuration Baselines
Document the hardened configuration and approved settings per platform, with version history.
Scan Results and Evidence
Attach scan outputs from CIS-CAT Pro or another assessor to each recommendation and platform.
Exceptions and Compensating Controls
Capture each exception with approval, rationale, compensating control and expiry date.
Drift Reviews
Schedule recurring reviews to detect configuration drift and adopt new benchmark versions.
Coverage Reporting
Report conformance, exceptions and remediation status by platform and team on a dashboard.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
NIST SP 800-53 Rev. 5 is the NIST catalog of security and privacy controls in 20 families, mandatory for federal systems under OMB A-130 and FISMA; Release 5.2.0 issued August 27, 2025.
Frequently Asked Questions For CIS Benchmarks (Consensus Security Configuration Guidelines)
Secure configuration guides for specific technologies, developed by the Center for Internet Security through a consensus process of cybersecurity professionals and subject matter experts. Each Benchmark lists the settings to apply to harden one product and version.
Level 1 is a base recommendation that can be implemented fairly promptly and lowers the attack surface while keeping machines usable. Level 2 is defense in depth for environments where security is paramount and can cause problems if not implemented with care.
It provides all the recommendations that are specific to the relevant DISA STIG. It replaced the earlier Level 3 profile, and overlapping Level 1 and Level 2 recommendations appear in it where applicable.
CIS distributes them free of charge in PDF format. CIS SecureSuite members can also download additional formats via CIS WorkBench and tailor recommendations. They are voluntary and not a certification.
The Benchmarks provide the platform-specific settings, and the Controls provide the broader program. For example, CIS Controls safeguard 4.1 asks an organization to establish and maintain a secure configuration process, and the Benchmarks supply the configurations.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.