What are CIS Benchmarks?
CIS Benchmarks are free, consensus-based configuration guides from the Center for Internet Security (CIS) that describe, product by product, exactly which settings you need to change to configure an operating system, application, cloud platform or network device securely. They are one of the most widely used starting points for hardening and for a documented security baseline. In OT, ICS and OT convergence environments you mainly use them for the Windows and Linux systems around the process, such as SCADA servers, historians and engineering stations, and for the virtualisation, container and network layers underneath.
🧠 Who creates the CIS Benchmarks and how are they developed?
The Center for Internet Security is a US non-profit organisation founded in 2000. From the start, CIS worked with industry on prescriptive, widely recognised hardening standards, and the CIS Benchmarks grew out of that work. There are now more than 100 of them, covering over 25 vendor product families. They are guidelines rather than formal security standards.
Each benchmark goes through a fixed consensus process on the CIS WorkBench platform, in which more than 12,000 professionals take part:
- Scope and team - CIS assembles a team of subject matter experts and decides which product version the benchmark covers.
- Draft - the experts write an initial version with concrete recommendations.
- Community review - users, vendors and researchers test the draft and comment, often over several rounds.
- Publication - after a final two-week review period the benchmark is published. A new product version or new insights restart the process.
For Windows, CIS aims to cover a new build within 90 days of its release. There is no “CIS certification” for systems, although many auditors use the benchmarks as a reference for compliance.
🔧 How is a CIS Benchmark structured?
A benchmark is a document that often runs to hundreds of pages of numbered recommendations. Every recommendation has the same fixed parts:
| Part | Content | Example (Windows Server) |
|---|---|---|
| Profile Applicability | Which profile the recommendation belongs to | Level 1 - Member Server |
| Description | What needs to be set | Minimum password length |
| Rationale | Why the setting improves security | Short passwords are quickly cracked |
| Impact | Possible consequences for users or applications | Users must choose longer passwords |
| Audit | How you check the current state | Query the value via policy or registry |
| Remediation | How you change it | Set it via Group Policy to 14 characters or more |
| CIS Controls | Mapping to the strategic framework | Safeguard under Control 4 or 5 |
Each recommendation is also labelled Automated (a scanner can check it) or Manual (human review needed). These labels replaced the older terms Scored and Not Scored.
Recommendations are grouped into profiles:
| Profile | Intent | Impact |
|---|---|---|
| Level 1 | Baseline security that can be implemented fairly quickly | Limited effect on performance and functionality |
| Level 2 | An extra defence-in-depth layer for environments where security is paramount | Can affect functionality; needs careful roll-out |
| STIG | Recommendations aligned with the US Department of Defense STIGs (DISA) | Replaces the former Level 3 |
Benchmarks can be downloaded free of charge as PDF. Other formats, such as XCCDF for scanners and editable Word versions, are reserved for CIS SecureSuite members.
🔄 What is the difference between CIS Benchmarks and CIS Controls?
The two are often confused, but they work at different levels:
| Characteristic | CIS Controls | CIS Benchmarks |
|---|---|---|
| Level | Strategic cybersecurity framework | Technical configuration per product |
| Size | 18 Controls with 153 safeguards (version 8.1, June 2024) | More than 100 benchmarks, hundreds of settings each |
| Question answered | What must the organisation have in place? | Which setting do I put at which value? |
| Grouping | Implementation Groups IG1 to IG3 | Profiles Level 1, Level 2 and STIG |
| Audience | CISO, governance and risk management | System administrators and OT engineers |
The link is Control 4, Secure Configuration of Enterprise Assets and Software: it requires a documented secure configuration process, and the benchmarks supply the concrete settings. Every recommendation in a benchmark refers back to the matching safeguard.
🖥️ Which systems do CIS Benchmarks cover?
| Category | Example benchmarks | Typical topics |
|---|---|---|
| Operating systems | Windows Server, Windows 11, Ubuntu, Red Hat Enterprise Linux | Account policy, services, audit policy, SMB, RDP, PowerShell, SSH, kernel parameters, file permissions |
| Virtualisation | VMware ESXi | Isolating the management network, Secure Boot, RBAC, logging on the hypervisor |
| Containers | Docker, Kubernetes | No privileged containers, daemon permissions, API server, kubelet, network policies, secrets |
| Cloud | Foundations Benchmarks for AWS, Microsoft Azure and Google Cloud | IAM, MFA, logging, network security, encryption |
| Network equipment | Cisco IOS, Palo Alto and other firewalls | Disabling unused ports, management ACLs, SNMP hardening, secure management protocols, port security |
| Databases and applications | Microsoft SQL Server, Oracle, PostgreSQL, browsers | Permissions, auditing, encryption |
Important for OT: there are no CIS Benchmarks for PLCs, field devices or the firmware of an HMI panel. For those devices, the vendor’s hardening guidance and IEC 62443 take precedence. The benchmarks do cover the general IT components that increasingly appear in OT: Windows workstations, Linux gateways for edge computing and IoT, container platforms for soft PLCs and IIoT applications, and the industrial switches, routers and firewalls between zones. Container clusters in OT also bring real-time requirements that a generic benchmark does not address.
Two OT situations need extra attention. Legacy systems often run an operating system for which CIS no longer updates the benchmark, while an installation can stay in service for 15 to 20 years or more; there, segmentation and compensating controls remain the main defence. Edge gateways, on the other hand, often sit outside a locked server room, so besides the benchmark they also need physical security, remote management and secure provisioning.
🏭 How do you apply CIS Benchmarks safely in OT?
An IT administrator often rolls out a Level 1 baseline in one go via Group Policy. In a production environment that can freeze an HMI or break a historian interface. A proven approach in OT:
- Inventory - start with an asset inventory and decide per system type (SCADA server, engineering station, historian, jump server) which benchmark and profile fit.
- Ask the vendor - many OT vendors publish their own hardening guides or state which settings their software cannot tolerate. Record approved deviations with a reason and a compensating control.
- Test in a representative environment - apply the baseline first in an OTAP (DTAP) environment or on a spare system, with performance tests, process impact analysis and a tested recovery procedure.
- Roll out in phases - make changes during maintenance windows via change management, one system at a time.
- Monitor drift - periodically compare the actual configuration against the baseline via configuration management and report drift to the SIEM or other security monitoring.
Typical values and OT nuances:
| Setting | CIS recommendation (Level 1) | OT consideration |
|---|---|---|
| Minimum Windows password length | 14 characters or more | Usually feasible; combine with MFA for remote access |
| Account lockout | After no more than 5 failed attempts | On an operator HMI lockout can be dangerous; use compensating controls such as physical access control |
| SSH root login | Disabled (PermitRootLogin no) |
Almost always applicable on Linux gateways |
| Unnecessary services | Disabled | First check which services the SCADA software needs |
| Antivirus and real-time scanning | Enabled | Only with vendor-approved exclusions; often supplemented or replaced by application whitelisting |
The same tension between security and availability applies to logging (storage load), patching (production risk) and extra firewall rules (latency). Hardening in OT is therefore always a risk-based trade-off, not a quest for a 100% score.
🛠️ Which tools support CIS Benchmarks?
- CIS-CAT Lite - a free scanner with a graphical interface for a limited set of benchmarks; useful to get started.
- CIS-CAT Pro Assessor - for CIS SecureSuite members; assesses systems against more than 80 benchmarks, also from the command line, with reports in formats including HTML, CSV, XML and JSON.
- Build kits - ready-made Group Policy objects and scripts that configure a system according to a benchmark in one step.
- CIS Hardened Images - virtual machines already hardened to a benchmark, available in the marketplaces of major cloud providers.
- Open-source checks - kube-bench assesses Kubernetes clusters and Docker Bench for Security assesses Docker hosts against the relevant benchmark.
Scan carefully in OT. An agentless configuration scan of a server is different from an active vulnerability scan of the process network, but run configuration scans in a test environment first as well, and outside critical production moments. A CIS baseline does not replace EDR, IDS or network monitoring; it shrinks the attack surface those controls build on, which also makes ransomware harder to spread.
🔐 How do CIS Benchmarks relate to standards and legislation?
| Framework | Relationship with CIS Benchmarks |
|---|---|
| IEC 62443 | IEC 62443-3-3 requires, among other things, documented network and security configuration settings (SR 7.6) and least functionality (SR 7.7); a benchmark makes this concrete for Windows and Linux components |
| ISO 27001 | Annex A of the 2022 edition contains the control configuration management (8.9); CIS provides the technical detail |
| NIST CSF | CIS maps the Controls to NIST CSF 2.0, including the Platform Security category |
| NIST SP 800-82 | NIST’s OT security guide (Rev. 3, 2023) recommends hardening OT components, with attention to testing and vendor coordination |
| NIS2 | The duty of care includes basic cyber hygiene practices; in the Netherlands this applies through the Cyberbeveiligingswet since 15 August 2026, and a documented CIS baseline is a demonstrable way to meet it |
CIS Benchmarks also fit into broader models. They restrict rights and services according to least privilege, support Zero Trust and microsegmentation because each system is less vulnerable on its own, and complement segmentation and application control. They are also used in building automation, for example for the servers of a BMS or HVAC control system, and in the water sector for telemetry servers.
❓ Frequently asked questions
Are CIS Benchmarks free?
Yes, all CIS Benchmarks can be downloaded free of charge as PDF after registering with the Center for Internet Security. Machine-readable formats such as XCCDF, editable versions, build kits and the CIS-CAT Pro scanner are part of the paid CIS SecureSuite membership.
What is the difference between Level 1 and Level 2 in a CIS Benchmark?
Level 1 contains baseline settings that are quick to implement and have little effect on performance and functionality. Level 2 adds stricter settings for environments where security is paramount, but can interfere with applications and therefore needs more testing. In OT, Level 1 is a common starting point for servers and workstations.
Are there CIS Benchmarks for PLCs?
No, CIS does not publish benchmarks for PLCs, field devices or embedded HMI panels. For those devices the vendor’s hardening guides and the requirements of IEC 62443 apply. In OT, CIS Benchmarks are useful for the Windows and Linux systems, hypervisors, container platforms and network equipment around the control system.
How do I check whether a system complies with a CIS Benchmark?
Every recommendation in a CIS Benchmark includes an audit procedure you can carry out manually. Automated assessment is possible with CIS-CAT Lite (free, limited) or CIS-CAT Pro (for SecureSuite members), and for Kubernetes and Docker with the open-source tools kube-bench and Docker Bench for Security. In OT, run scans in a test environment first.
Are CIS Benchmarks mandatory under NIS2?
No, NIS2 and the Dutch Cyberbeveiligingswet do not prescribe a specific framework. They do require appropriate measures, including basic cyber hygiene and secure configuration. A documented CIS baseline with recorded deviations is a common way to demonstrate this.
How often are CIS Benchmarks updated?
There is no fixed schedule: CIS updates a benchmark when a product gets a new version or insights change. For Windows, CIS aims to cover a new build within 90 days. So check at every upgrade whether your baseline still matches the right benchmark version.
📌 In summary
CIS Benchmarks give concrete, community-reviewed settings per product for hardening, with Level 1 as the baseline and Level 2 and STIG as stricter profiles. They are free, align with the CIS Controls, IEC 62443, ISO 27001 and NIS2, and can be assessed automatically with CIS-CAT. Within IT and OT they are valuable for servers, workstations, virtualisation, containers and network equipment, but not for PLCs and field devices.
CIS Benchmarks are the fastest route to a demonstrable, secure baseline for the IT components in your OT environment, provided you test them first, agree them with the vendor and record deviations deliberately.