CIS Benchmarks
What is CIS Benchmarks?
Consensus-based configuration guidelines developed by the Center for Internet Security for securely configuring IT systems and applications.
Terms that appear alongside cis benchmarks
Each of these is named in at least one of the same controls as cis benchmarks. The number is how many controls name both.
- patch management 7 shared controls
- secure configuration 6 shared controls
- hardening 6 shared controls
- zero trust 4 shared controls
- vulnerability 4 shared controls
- microsegmentation 4 shared controls
- disa stig 4 shared controls
- firewall 4 shared controls
Frameworks that govern cis benchmarks
What the standards actually require on cis benchmarks
Requirements naming cis benchmarks across 6 standards, quoted from the control text.
ISMAP Cloud Infrastructure controls cover the underlying compute + network + storage + management plane. (1) Virtual Network Segmentation: VPC Virtual Private Cloud isolation + subnets + security groups + NACLs + microsegmentation + service mesh (Istio + Linke...
ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement · ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC →Section 9.4 of IRS Publication 1075 establishes specific requirements for cloud services and addresses the prohibition on offshore processing of FTI.
IRSPub1075-Section94-Cloud-FedRAMP-Offshore-Prohibition-CSP-USRegion-PrivateGovCloud-AzureGov-AWSGov · IRS Pub 1075 Section 9.4 + Cloud Services + FedRAMP Authorisation Required + Offshore Prohibition + AWS GovCloud + Azure Government + Oracle US Federal + Google Workspace Federal + US-Region Data Residency →Establish and document configuration settings for system components in the most restrictive mode consistent with operations, using established benchmarks such as DISA STIGs, CIS Benchmarks or FIPS; implement them;
fbi-cjis-security-policy::CM-6 · CM-6 Configuration Settings →Kuwait NCF Protect function (Infrastructure). Network Security and Segmentation: defense in depth + perimeter (firewall + WAF + DDoS mitigation) + internal segmentation (microsegmentation + VLAN + zero-trust network access ZTNA) + east-west traffic inspection...
KNCF-Protect-Network-Configuration-Vulnerability-Physical-Secure-SDLC-Hardening-Patching-Drift · Kuwait NCF Protect + Network + Configuration + Vulnerability + Physical + Secure SDLC →Apply D3FEND HARDEN tactic to make compromise more difficult prior to attack. D3-AH Application Hardening (D3-DCE Dead Code Elimination + D3-EAL Exception Handler Pointer Validation + D3-PSL Pointer Authentication + D3-SU Software Update + D3-DLIC Driver Load...
MITRE-D3FEND-Harden-Tactic-Application-Credential-Message-Platform-Hardening-MFA-Encryption-Secure-Boot · MITRE D3FEND Harden Tactic + Application + Credential + Message + Platform + MFA + Encryption + Secure Boot →Apply Section 3 secure installation including: server selection per organizational requirements + OS hardening per CIS Benchmarks + DISA STIGs + NSA SecGuide + vendor security guides (Microsoft + Red Hat + SUSE + Ubuntu + macOS) + remove unnecessary services +...
NISTSP123-2 · Secure Server Installation and Configuration →Questions people ask about cis benchmarks
What is CIS Benchmarks?
Why is CIS Benchmarks important for compliance?
Which compliance frameworks address CIS Benchmarks?
Where can I learn more about CIS Benchmarks?
See how CIS Benchmarks applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.