CIS Benchmark

A CIS Benchmark is a configuration baseline published by the Center for Internet Security, a non-profit that develops them through a consensus process involving vendors, practitioners, and government bodies. Each benchmark is specific to a target — Ubuntu 24.04, RHEL 9, Windows Server 2022 — and prescribes concrete settings: password policy, filesystem permissions, kernel parameters, which services should not be running.

Benchmarks are published at two profile levels:

• Level 1 is the practical baseline. It applies hardening that materially reduces attack surface while remaining safe for a general-purpose server. Applying Level 1 does not usually break a working system.
• Level 2 is defense-in-depth, intended for environments where security outranks convenience. It restricts more aggressively and is more likely to interfere with an application that expects a permissive default.

CIS Benchmarks are frequently cited by compliance frameworks as an acceptable way to satisfy a hardening requirement, which is much of why they are widely adopted: they translate a vague control (“systems must be securely configured”) into a specific, checkable list.

Because the settings are machine-checkable, benchmarks are usually applied and audited with tooling such as OpenSCAP rather than by hand.