Frameworks · CIS Benchmarks

CIS Benchmarks: the standard per setting.

CIS Benchmarks are configuration standards from the Center for Internet Security, per operating system and application, written by a worldwide community of security experts. Not law, but the most concrete description of what a hardened system is. That is why in practice they provide the technical substance of the other frameworks: take measures and prove they are actually in place on every system.

Request a demo → View a sample report

Statusnot law but a standard; over 100 benchmarks for more than 25 product families, free as PDF; Windows benchmarks are updated within 90 days of a new release

Who it applies toeveryone who manages systems; nobody falls under it, you choose it yourself as the hardening standard for Windows, Linux, Active Directory, databases and cloud

Supervisionno supervisor; the benchmarks emerge by consensus through CIS WorkBench and are only published once the community agrees

Relationshiprecommendations are mapped, where applicable, to the CIS Controls (18 controls, now v8.1); NIST publications and PCI DSS refer to them, and NIS2, BIO2, NEN 7510, DORA and ISO 27002 ask for secure configuration without spelling it out per setting

What it requires

Not what to arrange, but how it must be set.

LEVEL 1 The basics, without disruption

Recommendations you can roll out quickly, designed to have no major impact on operations. This is the profile to start with.

LEVEL 2 Defence in depth

Meant for environments where security comes first. Stricter, and without careful rollout the settings can work against your organisation. You choose per system whether this profile fits.

CONTROLS Linked to the Controls

Benchmark recommendations are mapped, where applicable, to the CIS Controls with their Safeguards and Implementation Groups. So you know per setting which measure it fulfils, and you can carry that link through to the other frameworks.

How you make it demonstrable

Measured, not claimed.

Easy2audit measures your systems and accounts against the technical controls of the CIS Benchmarks for Windows, Linux, Active Directory, databases and Entra, and scores the same scan against the other frameworks as well.

Controls

01Inventory and Control of Enterprise Assets85.7%

01.01Establish and maintain a detailed enterprise asset inventory85.7%

02Inventory and Control of Software Assets81.3%

02.01Establish and maintain a software inventory81.3%

03Data Protection72.8%

03.03Configure data access control lists74.5%

03.04Enforce data retention71.1%

04Secure Configuration of Enterprise Assets and Software76.9%

04.01Establish and maintain a secure configuration process79.4%

04.06Securely manage enterprise assets and software73.2%

04.07Manage default accounts on enterprise assets and software78.1%

05Account Management83.5%

05.02Use unique passwords88.2%

05.03Disable dormant accounts77.6%

06Access Control Management78.4%

06.03Require MFA for externally-exposed applications74.9%

06.05Require MFA for administrative access81.7%

07Continuous Vulnerability Management69.8%

07.03Perform automated operating system patch management69.8%

08Audit Log Management74.2%

08.02Collect audit logs74.2%

demo environment · sample scores · a selection, the application covers the full framework

Traceableevery finding traceable to system and setting

Reproduciblesame scan, same outcome: evidence an auditor can verify

No duplicate work6 frameworks from one scan, no separate projects per standard

CIS Benchmarks: the standard per setting.

Not what to arrange, but how it must be set.

Measured, not claimed.

See how you make CIS Benchmarks demonstrable.