On this page
What are CIS Benchmarks?
The CIS Benchmarks are configuration recommendations published by the Center for Internet Security (CIS), a non-profit. Each benchmark covers one product, such as a version of Windows, macOS, a browser, Microsoft 365 or a cloud platform, and lists the settings that make it harder to attack, with the reasoning and how to check each one. CIS describes them as the consensus-based work of security experts, and its Benchmarks FAQ says they are distributed free of charge in PDF format, with other formats for CIS SecureSuite members.
Most benchmarks come with two profiles:
- Level 1 is a baseline meant to be applied fairly quickly, reducing the attack surface without getting in the way of normal work.
- Level 2 adds stricter, defence-in-depth settings for environments where security is paramount. CIS warns these can cause problems if applied carelessly.
CIS recommends trying benchmark settings in a test environment first, whatever the level.
CIS Benchmarks versus CIS Controls
The two are easy to confuse. The CIS Controls are a prioritised set of security practices for a whole organisation, such as keeping an inventory of devices or managing access. The CIS Benchmarks are product-by-product configuration guides. Many MSPs use the Controls to decide what a client's security programme should cover and the Benchmarks to check how individual systems are set up.
How do MSPs use CIS Benchmarks with clients?
A workable process looks like this:
- Choose the benchmarks. Match them to what the client actually runs: their Windows version, Microsoft 365, browsers, firewalls and cloud services. Don't import benchmarks for products they don't use.
- Start with Level 1. It gives the biggest improvement for the least disruption. Reserve Level 2 for systems or clients with higher risk.
- Assess. Check each setting, by hand, with a script, or with a configuration audit tool, and record the result and evidence.
- Decide what to change. Some recommendations will conflict with how the client works. Agree exceptions with the client and record the reason, rather than leaving them as silent failures.
- Fix in a tested way. Apply changes to a pilot group first, then roll out. Track each fix like any other piece of work.
- Reassess on a schedule. Settings drift as software updates and staff change things. Repeat the assessment regularly and compare results over time.
- Report in plain language. Share progress at business reviews and in the client's portal.
Also check CIS's terms of use for how your business uses the benchmark content, especially if you build it into a paid service.
How to explain CIS Benchmark results to clients
Clients don't know what a CIS Benchmark is, and they don't need to. Translate:
| Instead of | Say |
|---|---|
| "We are 68% compliant with CIS Windows 11 L1." | "About two thirds of the recommended security settings are in place on your laptops. Here are the most important ones still missing." |
| "Control 18.9.x failed." | "Laptops still allow an older, less secure way of signing in. We plan to switch it off next month." |
| "L2 exception approved." | "We've agreed to leave this stricter setting off because it would block your accounting software. We'll review that in a year." |
Lead with the handful of gaps that matter most, explain the business impact, and say what happens next. The full list can sit behind that summary for anyone who wants it. How can MSPs show clients their compliance status? covers how to share this without overwhelming clients.
Common pitfalls
- Treating a benchmark score as certification. A high score means the assessed settings match the recommendations; it does not prove the client meets a regulation or contract.
- Applying Level 2 everywhere. Strict settings without testing can break line-of-business software and erode the client's trust.
- One-off assessments. A benchmark checked once and never again tells the client little about today.
- Unrecorded exceptions. When a setting is intentionally left off, write down why and when it will be reviewed.
How MSPortal uses CIS Benchmarks
MSPortal includes many built-in CIS Benchmark checks that MSP staff import from the Playbooks catalog into Compliance:
- Import by product and level. Search the catalog by operating system, browser, cloud or infrastructure product, and add the L1 entry, the L2 entry or both. Some benchmarks also offer a Full entry. An Imported badge marks benchmarks already in your tenant.
- Target device types. During import you choose a status list and review the suggested device types, which receive the imported check group automatically.
- No automatic changes. Importing adds checks. It does not change device settings or mark a company compliant. Use of CIS Benchmark content is subject to your CIS licensing.
- Run and score. Assign the checks to companies, locations or devices in a run, which can be scheduled to repeat. Weighted scores map to an A to F grade you configure.
- Plain-language results for clients. Clients see their score, failed checks and the public notes you write. AI can draft a client-ready note with summary, business impact and remediation from your private notes. The draft saves straight into the client-visible public notes, so review and edit it right away.
- From gap to fix. Open a ticket or Planner item from a failed check, or record it in the risk register.
The CIS Benchmarks import guide walks through each step. To see imported benchmark checks on a sample client, book a demo.
Related questions
Are CIS Benchmarks free?
CIS says the benchmarks are distributed free of charge in PDF format, while other formats are available to CIS SecureSuite members. Check CIS's terms of use for how your business uses the content, especially within a paid service.
What is the difference between CIS Level 1 and Level 2?
Level 1 is a baseline that can be applied fairly quickly without hindering normal work. Level 2 adds stricter defence-in-depth settings for high-security environments and can cause problems if applied without testing.
Do CIS Benchmarks make a client compliant with a regulation?
No. They describe recommended secure configurations for specific products. Meeting a law, insurance requirement or contract depends on that obligation's own rules, though benchmark results can be useful evidence.
How can MSPs help clients prepare for NIS2?
By helping clients confirm their scope with legal advisers, reviewing their security against the directive's risk-management measures, closing gaps and keeping evidence. See How can MSPs help clients prepare for NIS2?