Center for Internet Security
CIS Benchmarks
The most concrete framework in the catalog. A CIS Benchmark says exactly how a platform should be configured, setting by setting, so a reading either matches or it does not. Cloud scanning compares your accounts against them; the CIS Controls turn the findings into a programme.
Do you need it?
If you run on a cloud, a benchmark already exists for it.
Yes
You run on AWS, Azure, GCP or a workspace suite.
Each has a benchmark. Root account hygiene, public buckets, logging, encryption at rest, admin two-factor: the checks are specific and the fixes are known.
Yes
An auditor asks what your baseline is.
ISO 27001, SOC 2 and NIS2 all require secure configuration without saying what that is. A CIS Benchmark is the accepted answer.
Partly
You run only on managed platforms.
Vercel, Supabase or Fly.io carry much of the baseline themselves. The workspace and identity benchmarks still apply to the tools your people log in to.
What the benchmarks hold
Benchmarks
A baseline per platform
A document per product with numbered recommendations, each with a rationale, an audit procedure and a remediation. Versioned as the platform changes.
Level 1 and Level 2
Two depths
Level 1 is the practical baseline every account should meet. Level 2 is defence in depth for environments where security outweighs convenience.
Scored and automated
Checks a machine can run
Most recommendations are automatable: a reading from the provider's API answers them. The rest are documented as manual.
CIS Controls v8.1
Eighteen controls, three implementation groups
The programme view: inventory, data protection, access, vulnerability management, logging, backups, awareness and the rest, with IG1 as the minimum for every company.
The versions
Benchmarks follow the platforms; the Controls follow the threat landscape. The benchmarks at CIS.
- Per platformEach benchmark carries its own version and date. The AWS Foundations, Google Workspace and Microsoft 365 benchmarks are revised as the platforms change.
- 25 June 2024CIS Controls v8.1 published, aligning the eighteen controls with the NIST CSF 2.0 governance function.
- ContinuousA benchmark check runs each time the cloud is scanned, so drift shows up as a changed reading, not at the next audit.
How the evidence lands
Cloud scanning against the benchmark
AWS, Google Workspace and Microsoft 365 accounts read through the provider's API and compared with the benchmark check by check. Each result is a reading on a control.
Drift, as it happens
A bucket made public or two-factor switched off is a reading that changed. The event log keeps when, and the control shows it.
One finding, several frameworks
A failed benchmark check is also a gap in ISO 27002 8.9, in SOC 2 CC6 and in NIS2 Article 21. The catalog maps it once.
The programme
CIS Controls as a framework you can adopt, with implementation group 1 as the floor and the readings showing where you stand.
See your clouds against the benchmark
Thirty minutes. We connect one of your integrations live and show the first readings landing on your controls.