CIS Benchmarks

CIS Benchmarks provide prescriptive guidance for securing operating systems, cloud platforms, applications, and network devices.

What CIS Benchmarks cover

• Operating systems (Windows, Linux, macOS).
• Cloud providers (AWS, Azure, GCP).
• Databases (MySQL, PostgreSQL, Oracle).
• Web servers (Apache, Nginx, IIS).
• Containers (Docker, Kubernetes).
• Network devices (Cisco, Palo Alto).

Benchmark levels

• Level 1: Essential security settings with minimal impact on functionality.
• Level 2: Defense-in-depth settings that may reduce functionality.
• STIG: More stringent, often required for government systems.

How to use CIS Benchmarks

1. Download relevant benchmark from cisecurity.org.
2. Assess current configuration against recommendations.
3. Implement applicable controls based on risk tolerance.
4. Use CIS-CAT or cloud-native tools to automate assessment.
5. Document exceptions with business justification.

Cloud-native implementation

• AWS Security Hub includes CIS AWS Foundations Benchmark.
• Azure Policy has CIS Microsoft Azure Foundations Benchmark.
• GCP Security Command Center supports CIS Google Cloud Benchmark.