# CIS Benchmark (Center for Internet Security Benchmark)

> A consensus-developed configuration baseline that prescribes how to securely configure a specific operating system or application.

A **CIS Benchmark** is a configuration baseline published by the Center for Internet Security, a non-profit that develops them through a consensus process involving vendors, practitioners, and government bodies. Each benchmark is specific to a target — Ubuntu 24.04, RHEL 9, Windows Server 2022 — and prescribes concrete settings: password policy, filesystem permissions, kernel parameters, which services should not be running.

Benchmarks are published at two profile levels:

- **Level 1** is the practical baseline. It applies hardening that materially reduces attack surface while remaining safe for a general-purpose server. Applying Level 1 does not usually break a working system.
- **Level 2** is defense-in-depth, intended for environments where security outranks convenience. It restricts more aggressively and is more likely to interfere with an application that expects a permissive default.

CIS Benchmarks are frequently cited by compliance frameworks as an acceptable way to satisfy a hardening requirement, which is much of why they are widely adopted: they translate a vague control ("systems must be securely configured") into a specific, checkable list.

Because the settings are machine-checkable, benchmarks are usually applied and audited with tooling such as [OpenSCAP](https://primcoat.app/glossary/openscap) rather than by hand.

## Related

- https://primcoat.app/glossary/disa-stig.md
- https://primcoat.app/glossary/openscap.md
- https://primcoat.app/glossary/golden-image.md

---

Source: https://primcoat.app/glossary/cis-benchmark
Primcoat — a managed VM image factory. https://primcoat.app