CIS benchmark checklists
Every control of a CIS benchmark in one spreadsheet, in plain English, with the CIS ID, profile and section. Download as CSV, no login.
- Microsoft 365 · CSVCIS Microsoft 365 Foundations v7.0.0
- 160 controls in 9 sections
- 114 Level 1 · 46 Level 2
- Google Cloud · CSVCIS Google Cloud Platform Foundation v5.0.0
- 93 controls in 8 sections
- 54 Level 1 · 39 Level 2
About the checklists
What is in the file
One row per control: the CIS ID, the check in ConfigCobra's own wording, the profile (Level 1 or Level 2) and the section. Microsoft 365 rows also carry the CIS assessment status (Automated or Manual).
Level 1 and Level 2
Level 1 controls are the baseline every organisation should meet with little impact on users. Level 2 adds defence in depth for higher-risk environments and may limit functionality.
How to use it
Open the CSV in Excel or Google Sheets, add columns for owner, status and evidence, and work through it section by section. Check links lead to the explanation and fix where a page exists.
Why only some benchmarks
We publish checklists only where every check is written in our own words. More benchmarks follow as their pages are written.
Go further
- Read-only PowerShell script generatorBuild a script that lists inactive users, guests, users without MFA, expiring app secrets and more.
- Microsoft 365 tenant lookupFind the tenant ID behind any domain, its region, cloud and sign-in type.
- Email domain checkerCheck SPF, DKIM and DMARC for any domain in seconds, with what to fix.
- Check libraryEvery CIS check ConfigCobra runs, explained
- All free tools6 no-login helpers for admins
Skip the spreadsheet
ConfigCobra runs these benchmarks against your cloud, read-only, with evidence for every finding.