CIS Level 1 vs Level 2

Each recommendation in a CIS Benchmark is tagged with one or more profiles. You choose the profile you want to meet, and Level 2 is meant to be applied on top of Level 1 and adds the stricter settings. CIS describes Level 1 as designed not to have an extensive performance impact while lowering the attack surface, and Level 2 as defence in depth for environments where security is paramount, with a warning that it can have an adverse effect if not implemented appropriately.

Examples of the difference

• Microsoft 365: the benchmark further tags recommendations by licence, such as E3 and E5 Level 1 and Level 2. A single section can therefore mix Level 1 and Level 2 recommendations, and you read the profile on each one rather than assuming a whole section is one level.
• Azure, Google Cloud and AWS: each cloud has its own CIS benchmark with the same two levels. Which settings fall into which level is decided per recommendation by the benchmark authors, so check the profile of each recommendation instead of guessing from the topic.

Not every benchmark uses both levels evenly. In the CIS AWS Storage Services Benchmark v1.0.0, for instance, all 56 recommendations are Level 2, and no Level 1 items exist.

Applying a stricter profile everywhere on day one is a common way to break things: blocked sign-ins, failed integrations, angry users. Applying only the minimum can leave high-value systems under-protected. The profile levels give you a defensible way to tier the work.

The levels also help with communication. When you tell a business owner that a change is a Level 2 recommendation, you are saying it is a deliberate step up in strictness that deserves testing and a rollback plan, not routine hygiene. When you report progress, splitting results by level shows how much of the low-risk baseline is already done and how much of the stricter work remains.

CIS itself states the trade-off: Level 2 recommendations can have an adverse effect on an organisation if not implemented appropriately. Reading the level on each recommendation tells you where to test first. The CIS FAQ explains the profile definitions in its own words.

Level is not the same as importance. A Level 2 item can matter more for your environment than a Level 1 item. It is also separate from automated versus manual assessment status, which says how a check can be verified, not how strict it is.

1. Pick a target per environment. Many teams choose Level 1 for everything and Level 2 for regulated or high-value workloads.
2. Baseline first. Measure where you are before changing anything.
3. Close Level 1 gaps first. They are meant to be low-risk.
4. Pilot Level 2 changes. Test on a small group before rolling out tenant-wide.
5. Tell users in advance. A stricter sign-in or sharing rule is easier to accept with a short notice and a named contact.
6. Document exceptions. If a recommendation cannot be met, record why and who accepted the risk.

ConfigCobra assesses against CIS benchmarks and reports each control with its profile. For Microsoft 365 it covers the CIS Microsoft 365 Foundations Benchmark v7.0.0: 160 controls, of which 114 are Level 1 and 46 are Level 2. Across the four CIS Microsoft Azure benchmarks it covers 339 controls, 205 Level 1 and 134 Level 2.

The Level 1 profile is the safe, minimal-impact set and Level 2 is stricter and security-focused. ConfigCobra is read-only: it reads your configuration and never changes your tenant, and the remediation impact analysis shows what a fix would change in your environment before you apply it. Every connected cloud is scanned automatically every day, and you can start an ad hoc scan at any time. Start a 14-day free trial with full access.