Academy · Benchmarks and baselines

CIS Benchmarks

CIS Benchmarks are free, consensus-built configuration guides from the Center for Internet Security that list, setting by setting, how a given product or cloud should be configured to be secure. They matter because they give you a neutral, widely recognised yardstick, so you do not have to invent your own list of what good looks like.

How it works

Each benchmark covers one technology and one version, for example a cloud platform or an operating system. It is a numbered list of recommendations. Each recommendation names a setting, the value to aim for, and how to check and change it.

How they are made

CIS describes the process as consensus-based: volunteer practitioners from industry, government and academia draft and review each benchmark, and CIS publishes new versions as the product changes. That is why benchmarks carry version numbers and why you should always state which version you measure against.

Benchmarks for the main clouds

Microsoft 365: the CIS Microsoft 365 Foundations Benchmark covers admin center, Entra, Defender, Purview, Intune, Exchange Online, SharePoint and OneDrive, Teams and Fabric.
Azure: a Foundations benchmark plus separate Compute, Database and Storage Services benchmarks.
Google Cloud: the CIS Google Cloud Platform Foundation Benchmark.
AWS: a Foundations benchmark plus Compute, Database and Storage Services benchmarks.

Profile levels

Recommendations are grouped into profiles. Level 1 is the practical baseline with limited impact on how people work. Level 2 is stricter and meant for environments that need more protection, and it may cost some convenience or functionality. Some benchmarks add finer profiles, for instance by licence tier.

Why it matters

Without a reference, "secure enough" is whatever the last person who touched the tenant believed. A benchmark replaces opinion with a list you can count, review and re-run.

Benchmarks also make findings easier to act on. A failed recommendation points at one concrete setting, and the number lets you discuss it with colleagues, auditors or clients without confusion. Microsoft, Google and AWS publish their own security guidance, and CIS benchmarks are a vendor-neutral complement to it.

One limit to keep in mind: a benchmark describes secure settings, not your risk. A control that fails may be low priority for you, and an organization can have a good reason to deviate. Record those decisions instead of ignoring the finding.

How it compares

Term	What it is
CIS Benchmark	Detailed, per-product, per-version configuration recommendations
Security baseline	Any agreed minimum configuration. A CIS Benchmark can be your baseline, or you can use a vendor baseline or your own.
Vendor secure score	A tool-specific rating, such as Microsoft Secure Score. It measures against that vendor's own recommendations.
CIS Controls	A separate, higher-level set of safeguards for an organization, not setting-by-setting product guidance

Level 1 and Level 2 are about how strict a recommendation is, not about how important a product is.

Getting started

Download the benchmark for each platform you run from cisecurity.org and note the version.
Start with Level 1. It is the minimum most organizations can adopt without major disruption.
Check which recommendations can be tested by a script and which need a person to look. Plan time for the manual ones.
Work in small batches, and test changes on a pilot group first.
Keep a list of accepted deviations with an owner and a review date.
Move to the next benchmark version when CIS publishes it, since settings and products change.

How ConfigCobra fits

ConfigCobra's CSPM module is based on CIS benchmarks.

Microsoft 365: CIS Microsoft 365 Foundations Benchmark v7.0.0, 160 controls in 9 sections, of which 114 are Level 1 and 46 are Level 2. 143 are marked Automated and 17 are Manual.
Azure: Foundations v6.0.0 (127 controls), Compute Services v2.0.0 (99), Database Services v2.0.0 (49) and Storage Services v2.0.0 (64). That is 339 controls, covered by one scan.
Google Cloud: Foundation Benchmark v5.0.0 with 93 controls.
AWS: Foundations v7.0.0 (70), Compute Services v2.0.0 (82), Database Services v2.0.0 (98) and Storage Services v1.0.0 (56). That is 306 controls.

The severity shown for each control is ConfigCobra's estimate for prioritising fixes. CIS itself publishes no severity. Access is read-only.

Go further

See where your cloud stands

ConfigCobra checks Microsoft 365, Azure, Google Cloud and AWS against the CIS benchmarks, read-only, with evidence for every finding.

Start free trial All academy terms