Key Takeaways
- CIS Benchmarks are consensus-built secure configuration guides from the Center for Internet Security (CIS), a nonprofit, and each maps to the CIS Critical Security Controls.
- CIS publishes 100+ benchmarks across 25+ vendor product families, all free as PDFs for non-commercial use.
- CIS Level 1 settings cause little or no loss of functionality, Level 2 settings suit higher-security environments, and there is no Level 3.
- CIS Benchmarks say how to configure a specific product, while the CIS Controls (18 controls, 153 safeguards) say what a security programme should do.
- Microsoft 365 Business Premium doesn't include Microsoft Defender's CIS baselines assessment, so check Windows devices with the CIS Configuration Assessment Tool (CIS-CAT) or add a Microsoft Defender Vulnerability Management Standalone licence.
- Microsoft Secure Score and Microsoft Intune security baselines reflect Microsoft's own recommendations, so neither is evidence of CIS compliance.
CIS Benchmarks are free, consensus-built configuration guides from the Center for Internet Security (CIS) that tell you exactly how to harden an operating system, cloud account or application. Most teams don't struggle to find them; they struggle to measure them and keep them applied across Windows, Intune, Azure and Microsoft 365. The verdict: start with Level 1, measure it with tools you already license or can get free, and document every exception.
What Are CIS Benchmarks?
CIS Benchmarks are step-by-step secure configuration guides for specific products, written and peer-reviewed by a volunteer community and published free by the Center for Internet Security (CIS). Each one tells you which settings to change on a single technology, such as Windows 11, Microsoft 365, Microsoft Intune, Linux or Kubernetes, and why.
CIS Benchmarks at a glance:
- Coverage: 100+ benchmarks across 25+ vendor product families.
- Review: two rounds of consensus review, first during drafting and again after publication.
- Cost: free PDFs for non-commercial use.
The counts and licence terms come from CIS, and the review process from Microsoft Learn.
What CIS Benchmarks Cover
CIS groups its benchmarks by technology type: operating systems, server software, cloud providers, mobile devices, network devices, desktop software and DevSecOps tools.
The Microsoft benchmarks most teams need, at their September 2026 versions:
- CIS Microsoft 365 Foundations Benchmark v7.0.0
- CIS Microsoft Windows 11 Enterprise Benchmark v5.1.0
- CIS Microsoft Intune for Windows 11 Benchmark v5.0.0
- CIS Microsoft Windows Server 2022 Benchmark v5.1.0
- CIS Microsoft Azure Foundations Benchmark
- CIS Microsoft SQL Server 2022 Benchmark v1.3.0
Microsoft Defender Antivirus settings now have their own CIS benchmark, and CIS has started removing them from the Windows benchmarks.
How a Benchmark Is Structured
Each benchmark is a list of recommendations, and every recommendation uses the same fields:
- Title and Assessment Status: the setting, and whether it can be checked automatically.
- Profile Applicability: Level 1, Level 2 or another profile.
- Description, Rationale and Impact Statement: what the setting does, why it matters and what it may break.
- Audit and Remediation Procedures: how to check the setting and how to fix it.
- Default Value, References and CIS Controls: the out-of-the-box value, supporting sources and the CIS Controls it maps to.
CIS Level 1 vs Level 2 (and Why There's No Level 3)
Level 1 is the baseline almost any system can apply without breaking things. Level 2 adds stricter settings for sensitive environments at some cost to functionality, and it includes every Level 1 setting. CIS also publishes separate STIG-aligned benchmarks, and there is no Level 3.
The Level 1 and Level 2 impact wording follows Microsoft Learn's description of the CIS profiles. Current STIG benchmark versions are listed in CIS's September 2026 benchmark update.
One variation matters in Microsoft environments. Windows Server benchmarks split each level into Domain Controller and Member Server profiles.
Any "Level 3" you come across is an internal or vendor standard layered on top of Level 2, not a CIS profile.
Start with Level 2 on:
- Privileged access workstations used for admin tasks
- Domain controllers and other identity servers
- Systems in audit scope or holding regulated data
CIS Benchmarks vs CIS Controls vs Microsoft and CISA Baselines
CIS Benchmarks tell you how to configure a specific product. The CIS Controls tell you what an overall security programme must do. Microsoft security baselines and the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Secure Cloud Business Applications (SCuBA) baselines are other organisations' recommended settings for many of the same products. They overlap but aren't interchangeable, so an Intune security baseline is not a CIS baseline.
The Controls figures come from CIS's Implementation Groups page. In practice, pick one standard as your measure of record, usually CIS when an auditor or insurer asks for it, and treat the others as cross-checks. If you're still deciding which framework should drive your assessments, our guide on choosing between CIS, NIST and ISO for a security assessment walks through that decision.
How CIS Benchmarks Map to NIST, ISO 27001, PCI DSS and Cyber Essentials
CIS Benchmark evidence supports most major frameworks.Each recommendation maps to one or more CIS Controls, and the CIS Controls map to the U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), NIST SP 800-53, the ISO 27000 series, the Payment Card Industry Data Security Standard (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA).
For UK organisations, benchmark evidence also supports the Cyber Essentials secure configuration control. That control covers changing default passwords, removing unnecessary accounts and software, and disabling auto-run.
What benchmark evidence can't do is make you compliant on its own. An ISO 27001 auditor still assesses your policies, risk management and processes, which is why the ISO 27001 certification process reaches well beyond configuration.
Microsoft Secure Score vs CIS Benchmarks
Microsoft Secure Score measures your tenant against Microsoft's own recommended actions, so a high score isn't evidence of CIS compliance.
Each recommended action is worth up to 10 points, and most are all-or-nothing: turn on the setting and you get the full points. Admins can also mark an action as resolved through a third-party tool or an alternate mitigation, which records it as addressed without any change to the tenant setting Secure Score checks. See Microsoft's Secure Score documentation.
The two overlap on basics like multifactor authentication (MFA), but an auditor asking for CIS needs an assessment against the CIS Microsoft 365 Foundations Benchmark itself. CISA's free ScubaGear tool adds a third, independent view of the same tenant.
How to Check CIS Benchmark Compliance in a Microsoft Environment
Which tool checks CIS compliance depends on your licence. Microsoft Defender checks Group Policy-managed Windows devices if you hold the Defender Vulnerability Management add-on or Standalone licence. Every other device and tenant maps to the CIS Configuration Assessment Tool (CIS-CAT) or Microsoft Defender for Cloud, as shown below.
On Microsoft 365 Business Premium, Defender for Business doesn't include the baselines assessment, so CIS-CAT is your check unless you add a Defender Vulnerability Management Standalone licence. Microsoft sets out the split in its Defender Vulnerability Management plan comparison. If you'd rather have the endpoint side run for you, see managed endpoint security with Microsoft Defender.
Windows Devices: What Defender's Baseline Assessment Won't Tell You
Microsoft lists 40 CIS checks in its baselines assessment that may return inaccurate or incomplete results, and recommends excluding them from your profiles.
Section 17 is Advanced Audit Policy Configuration, the settings that decide which security events your security operations centre (SOC) can see. Verify them on the device with auditpol /get /category:* rather than trusting the dashboard. Microsoft doesn't say which benchmark version these numbers refer to, so match them against the version you assess.
Those logs are what an investigation runs on. In CyberQuell's Microsoft 365 phishing investigation, Microsoft Entra ID sign-in logs were the primary evidence of what the attacker did and didn't access.
Microsoft's baselines assessment documentation notes two more limits:
- The benchmarks support Group Policy Object configurations "and not Microsoft Configuration Manager (Intune)", so settings delivered through Intune aren't assessed.
- Configurations marked Manual check are never assessed automatically.
Azure, AWS, GCP and Kubernetes in Defender for Cloud
Defender for Cloud assesses CIS standards for Azure, AWS, Google Cloud Platform (GCP) and managed Kubernetes, but only the Microsoft Cloud Security Benchmark is assigned by default.
To add a CIS standard, you need any Defender for Cloud plan except Defender for Servers Plan 1 or Defender for APIs Plan 1, and you assign it under Regulatory compliance in the Azure portal. A standard with no matching resources won't appear on the dashboard. From 27 October 2026, the free Foundational cloud security posture management (CSPM) plan is opt-in for new Azure subscriptions. For how this fits a wider posture programme, see running Defender for Cloud as your CSPM layer.
The Microsoft 365 Tenant
The CIS Microsoft 365 Foundations Benchmark v7.0.0 covers tenant settings across Entra ID, Exchange Online, SharePoint, Teams and Purview. CIS-CAT Pro currently assesses v6.0.1, and Compliance Manager's CIS template was last published at v4.0.0. Use Compliance Manager for tracking, not as your score of record, and don't treat Secure Score as a substitute, for the reasons covered in the Secure Score section above.
If you'd rather not work through this alone, CyberQuell's free security assessment reviews your Microsoft 365, Defender and Intune configuration and maps the findings to CIS Controls and the other frameworks you report against.
How to Actually Use CIS Benchmarks in Your Environment
Pick the benchmarks that match the systems you actually run, measure against Level 1 first, and fix in rings starting with a pilot group. Record every exception with a reason and an expiry date, and re-assess continuously rather than once a year.
Exceptions are normal: CIS's own benchmark text calls them common and acceptable, as long as they're documented. The fixes themselves need owners and deadlines, which our guide to building a remediation plan that gets finished covers step by step.
Applying CIS Settings Through Intune or Group Policy
Domain-joined devices take the CIS Windows benchmark through Group Policy. Intune-managed devices take the CIS Microsoft Intune for Windows 11 Benchmark (v5.0.0), which is written for Intune policy settings rather than Group Policy. CIS SecureSuite members can import the matching CIS Build Kit instead of configuring each setting by hand.
Don't layer a Microsoft Intune security baseline over CIS settings without checking for conflicts. When two policies set the same value differently, the device reports a conflict and neither setting is guaranteed. If your team is short on Intune time, see Microsoft Intune device management.
Five Mistakes That Break CIS Rollouts
- Applying Level 2 everywhere. It breaks line-of-business apps, and the rollback erodes trust in the whole programme.
- Leaving dev and test out of scope. In a cloud secrets investigation, a development server running a Symfony application in debug mode exposed AWS credentials and connection strings. No CIS benchmark covers application debug settings, but the server was outside every baseline review. The credentials were rotated before any access occurred.
- Treating Microsoft's Intune security baseline as the CIS Intune benchmark. They are different documents from different publishers.
- Leaving exceptions unrecorded. An undocumented exception reads as a failure to an auditor.
- Trusting dashboard scores for audit-policy settings. Check Section 17 on the device, as covered above.
Tools That Make Applying CIS Benchmarks Easier
CIS-CAT Lite is the free starting point, and CIS-CAT Pro adds 80+ benchmarks with remediation content. Microsoft-stack teams with the right licences can assess continuously in Defender Vulnerability Management and Defender for Cloud. CISA's ScubaGear adds a free Microsoft 365 check against the SCuBA baselines.
CIS lists the Lite and Pro differences on its CIS-CAT Lite page. Tools measure the gap; closing it is the work. If you want help with that part, CyberQuell's security assessments and remediation service turns findings into a prioritised fix plan and checks the remediated areas afterwards.
Final Thoughts
The hard part of CIS Benchmarks isn't reading them. It's measuring them honestly with the licences you already have. For most Microsoft-first organisations with 50 to 500 employees, that comes down to three decisions: which benchmark versions you hold yourself to, which tool is your score of record, and who owns the exceptions register.
Get those right and Level 1 becomes a routine check instead of a pre-audit scramble. Get them wrong and you end up with a healthy-looking dashboard score while the audit-policy settings your security team depends on go untested.
Book a call with CyberQuell to work out which CIS benchmarks and assessment tools fit your Microsoft licences, and which gaps to close first.
%20for%20Microsoft%20365%20(1).png)
.png)
.png)
