What are the CIS Benchmarks? CIS Controls and Benchmarks Explained

What the Benchmarks Contain

Recommendations, Not Requirements

A Benchmark is a numbered list of recommendations. Each has a rationale, an impact statement, an audit procedure describing how to check the setting, and a remediation procedure describing how to fix it. The Microsoft 365 Foundations Benchmark runs to several hundred pages across identity, Exchange Online, SharePoint and OneDrive, Teams, Defender, Purview, and Power Platform.

Level 1 and Level 2 Profiles

Every recommendation is assigned a profile. Level 1 recommendations are hardening steps with minimal operational impact that any organization should apply. Level 2 recommendations are for environments with higher security requirements and may reduce functionality or require compensating effort. A mid-market organization that has implemented all Level 1 recommendations for Microsoft 365 is in a defensible position. One that has not is carrying gaps the Benchmark names explicitly.

Scored Assessments

CIS publishes an assessment tool, CIS-CAT, and Microsoft and third parties publish scripts and Secure Score mappings that check tenant configuration against the Benchmark. The output is a pass or fail per recommendation, usually summarized as a percentage. The percentage is useful for tracking one tenant's drift over time. It is not comparable across organizations and it should never be reported to a board as a grade. One failed Level 1 recommendation on administrator MFA outweighs twenty passed recommendations on Teams meeting settings.

What the Controls Contain

CIS Controls v8.1 organizes 153 individual safeguards into eighteen controls, from inventory of enterprise assets (Control 1) through penetration testing (Control 18). The safeguards are grouped into three Implementation Groups. IG1 is the 56 safeguards CIS defines as essential cyber hygiene for every organization. IG2 adds 74 for organizations with more complexity and sensitive data. IG3 adds 23 for organizations facing sophisticated adversaries. The Implementation Groups are the most useful part of the framework for a board, because they answer the question what is the minimum? with a specific list rather than a maturity model.

Why Insurers, Auditors, and Acquirers Use Them

They Are Specific Enough to Verify

Most frameworks describe outcomes. NIST SP 800-53 requires that an organization implement multi-factor authentication for access to privileged accounts. The CIS Microsoft 365 Benchmark says which Conditional Access policy, applied to which directory roles, with which authentication strength, and how to check it in the admin center. That specificity is why the Benchmarks are the reference point when someone outside the organization needs to form an opinion quickly.

Cyber Insurance Applications Are Built on Them

The control questions on a modern cyber insurance application map almost one to one to Level 1 Benchmark recommendations: MFA on email and remote access, legacy authentication disabled, external forwarding blocked, EDR coverage, backup immutability, privileged account controls. An underwriter reviewing a tenant assessment is reading Benchmark results whether or not the word CIS appears. A cyber insurance attestation that says MFA is enforced, in a tenant where the Benchmark check for legacy authentication fails, is the kind of discrepancy that surfaces at claim time.

Diligence Reviewers Use Them as the Baseline

A PE buyer's technical reviewer has days, not weeks, to form a view of a target's environment. The efficient path is a Benchmark assessment of the Microsoft 365 and Azure tenants. The output is a list of failed recommendations, each with a documented rationale, that translates directly into remediation cost and, where the gaps are severe, into repricing or escrow conversations. A seller who has run the same assessment first controls that conversation. One who has not is learning the list from the buyer.

CIS Benchmarks and NIST SP 800-53

The two frameworks are complementary, not competing. NIST SP 800-53 is the comprehensive control catalog; it says what must be true. The Benchmarks say how to make it true on a specific platform. CIS publishes a mapping from the Controls to 800-53 control families, and the Benchmarks inherit that mapping. The result is that a single configuration finding can carry both an 800-53 control ID and a Benchmark recommendation number, which is how a risk register serves an auditor working from the catalog and an engineer working from the console with the same row.

What a Benchmark Assessment Actually Finds

The failures in a mid-market Microsoft 365 tenant are predictable. Legacy authentication protocols (POP, IMAP, SMTP AUTH, basic authentication) remain enabled because something once depended on them, and they bypass MFA entirely. Administrators hold standing global admin rights without phishing-resistant MFA. Service accounts are excluded from Conditional Access and nobody has reviewed the exclusion. The unified audit log is enabled but retention sits at the default, so the evidence of a compromise ages out before anyone looks. Anonymous sharing links are permitted tenant-wide. Automatic external forwarding is allowed, which is the exact mechanism attackers use to exfiltrate payroll and invoice correspondence after a mailbox takeover. Conditional Access policies exist but run in report-only mode, which produces reports and prevents nothing.

None of these are exotic. All of them are Level 1 recommendations. Every one of them appears in the reconstruction of business email compromise cases that cost mid-market organizations six figures.

The Limits of a Benchmark

A Benchmark describes configuration state. It does not ask whether the configuration was ever bypassed, whether credentials are already circulating in stealer logs, or whether an attacker registered a device six weeks ago and is signing in from a compliant endpoint today. A tenant can pass every recommendation and still be compromised, because the compromise predates the hardening. Configuration assessment and compromise assessment are different questions. The organizations in the Breach Library with the most painful timelines had, in several cases, hardened after the attacker was already in.

Executive Implications

For a CFO or GC, the Benchmarks are the reasonableness standard. If an incident leads to litigation, a regulatory inquiry, or a coverage dispute, the question was the environment configured reasonably? will be answered by comparing it to the Benchmark in effect at the time. Knowing the answer before the incident is the entire point. For a PE operating partner, a Benchmark assessment across portfolio tenants is the cheapest consistent measure of security posture that exists, and it produces a remediation list an engineer can execute without interpretation.

Related Reading

• What is NIST SP 800-53?
• What is CISA SCuBA?
• What is the Microsoft Cloud Security Benchmark?
• What is a Cyber Insurance Attestation?
• What is a Compromise Assessment?

Real-World Example: Hardened After the Fact

A Cloudskope engagement with a mid-market organization illustrates the gap between configuration and state. The internal team had recently completed a Microsoft 365 hardening project and could show a Benchmark assessment with strong Level 1 coverage. Conditional Access was enforced, legacy authentication was disabled, external forwarding was blocked.

The compromise assessment found nine mailboxes under attacker control. The intrusions had begun months before the hardening project through adversary-in-the-middle phishing that captured session tokens after MFA was satisfied. One attacker had registered a rogue device in Entra ID before device-based Conditional Access was tightened, so their sign-ins now arrived from what the tenant considered a compliant endpoint. Inbox rules planted before forwarding was blocked continued to hide payroll correspondence. More than $150,000 had been wired to attacker-controlled accounts.

The Benchmark assessment was accurate. The tenant was configured well. The configuration simply postdated the compromise. The lesson for anyone reading a Benchmark score in a board deck or a diligence report: it measures the walls, not who is already inside them.