What Are the CIS Benchmarks? CIS Controls and Benchmarks Explained

What the Benchmarks Contain

Recommendations, Not Requirements

A Benchmark is a numbered list of recommendations. Each has a rationale, an impact statement, an audit procedure describing how to check the setting, and a remediation procedure describing how to fix it. The Microsoft 365 Foundations Benchmark runs to several hundred pages across identity, Exchange Online, SharePoint and OneDrive, Teams, Defender, Purview, and Power Platform.

Level 1 and Level 2 Profiles

Every recommendation is assigned a profile. Level 1 recommendations are hardening steps with minimal operational impact that any organization should apply. Level 2 recommendations are for environments with higher security requirements and may reduce functionality or require compensating effort. A mid-market organization that has implemented all Level 1 recommendations for Microsoft 365 is in a defensible position. One that has not is carrying gaps the Benchmark names explicitly.

Scored Assessments

CIS publishes an assessment tool, CIS-CAT, and Microsoft and third parties publish scripts and Secure Score mappings that check tenant configuration against the Benchmark. The output is a pass or fail per recommendation, usually summarized as a percentage. The percentage is useful for tracking one tenant's drift over time. It is not comparable across organizations and it should never be reported to a board as a grade. One failed Level 1 recommendation on administrator MFA outweighs twenty passed recommendations on Teams meeting settings.

What the Controls Contain

CIS Controls v8.1 organizes 153 individual safeguards into eighteen controls, from inventory of enterprise assets (Control 1) through penetration testing (Control 18). The safeguards are grouped into three Implementation Groups. IG1 is the 56 safeguards CIS defines as essential cyber hygiene for every organization. IG2 adds 74 for organizations with more complexity and sensitive data. IG3 adds 23 for organizations facing sophisticated adversaries. The Implementation Groups are the most useful part of the framework for a board, because they answer the question what is the minimum? with a specific list rather than a maturity model.

Why Insurers, Auditors, and Acquirers Use Them

They Are Specific Enough to Verify

Most frameworks describe outcomes. NIST SP 800-53 requires that an organization implement multi-factor authentication for access to privileged accounts. The CIS Microsoft 365 Benchmark says which Conditional Access policy, applied to which directory roles, with which authentication strength, and how to check it in the admin center. That specificity is why the Benchmarks are the reference point when someone outside the organization needs to form an opinion quickly.

Cyber Insurance Applications Are Built on Them

The control questions on a modern cyber insurance application map almost one to one to Level 1 Benchmark recommendations: MFA on email and remote access, legacy authentication disabled, external forwarding blocked, EDR coverage, backup immutability, privileged account controls. An underwriter reviewing a tenant assessment is reading Benchmark results whether or not the word CIS appears. A cyber insurance attestation that says MFA is enforced, in a tenant where the Benchmark check for legacy authentication fails, is the kind of discrepancy that surfaces at claim time.

Diligence Reviewers Use Them as the Baseline

A PE buyer's technical reviewer has days, not weeks, to form a view of a target's environment. The efficient path is a Benchmark assessment of the Microsoft 365 and Azure tenants. The output is a list of failed recommendations, each with a documented rationale, that translates directly into remediation cost and, where the gaps are severe, into repricing or escrow conversations. A seller who has run the same assessment first controls that conversation. One who has not is learning the list from the buyer.

CIS Benchmarks and NIST SP 800-53

The two frameworks are complementary, not competing. NIST SP 800-53 is the comprehensive control catalog; it says what must be true. The Benchmarks say how to make it true on a specific platform. CIS publishes a mapping from the Controls to 800-53 control families, and the Benchmarks inherit that mapping. The result is that a single configuration finding can carry both an 800-53 control ID and a Benchmark recommendation number, which is how a risk register serves an auditor working from the catalog and an engineer working from the console with the same row.

What a Benchmark Assessment Actually Finds

The failures in a mid-market Microsoft 365 tenant are predictable. Legacy authentication protocols (POP, IMAP, SMTP AUTH, basic authentication) remain enabled because something once depended on them, and they bypass MFA entirely. Administrators hold standing global admin rights without phishing-resistant MFA. Service accounts are excluded from Conditional Access and nobody has reviewed the exclusion. The unified audit log is enabled but retention sits at the default, so the evidence of a compromise ages out before anyone looks. Anonymous sharing links are permitted tenant-wide. Automatic external forwarding is allowed, which is the exact mechanism attackers use to exfiltrate payroll and invoice correspondence after a mailbox takeover. Conditional Access policies exist but run in report-only mode, which produces reports and prevents nothing.

None of these are exotic. All of them are Level 1 recommendations. Every one of them appears in the reconstruction of business email compromise cases that cost mid-market organizations six figures.

The Limits of a Benchmark

A Benchmark describes configuration state. It does not ask whether the configuration was ever bypassed, whether credentials are already circulating in stealer logs, or whether an attacker registered a device six weeks ago and is signing in from a compliant endpoint today. A tenant can pass every recommendation and still be compromised, because the compromise predates the hardening. Configuration assessment and compromise assessment are different questions. The organizations in the Breach Library with the most painful timelines had, in several cases, hardened after the attacker was already in.

Executive Implications

For a CFO or GC, the Benchmarks are the reasonableness standard. If an incident leads to litigation, a regulatory inquiry, or a coverage dispute, the question was the environment configured reasonably? will be answered by comparing it to the Benchmark in effect at the time. Knowing the answer before the incident is the entire point. For a PE operating partner, a Benchmark assessment across portfolio tenants is the cheapest consistent measure of security posture that exists, and it produces a remediation list an engineer can execute without interpretation.

Related Reading

• What is NIST SP 800-53?
• What is CISA SCuBA?
• What is the Microsoft Cloud Security Benchmark?
• What is a Cyber Insurance Attestation?
• What is a Compromise Assessment?

What is the difference between CIS Benchmarks and CIS Controls?

CIS Controls are 18 prioritized safeguard categories that describe what a security program should do, technology-agnostic. CIS Benchmarks are product-specific configuration guides that describe how to set up a particular platform securely: Microsoft 365, Azure, Windows Server, iOS, and more than a hundred others. The Controls tell you to enforce MFA; the Benchmark for Microsoft 365 tells you which Entra ID Conditional Access settings satisfy that.

What are Level 1 and Level 2 profiles in a CIS Benchmark?

Level 1 recommendations are baseline hardening that can be applied with little operational impact. Level 2 recommendations are for higher-security environments and may reduce functionality or require compensating operational effort. Most cyber insurance questionnaires and PE technical reviews assume Level 1 as the floor.

Are CIS Benchmarks mandatory?

No. They are consensus guidance published by the Center for Internet Security. They become mandatory indirectly: cyber insurers, auditors, and acquirers use them as the reference point for whether a configuration is reasonable, and several regulators cite them as an acceptable baseline.

How do CIS Benchmarks relate to NIST SP 800-53?

The CIS Controls publish a mapping to 800-53 control families, and the Benchmarks inherit that mapping. A Benchmark recommendation for MFA enforcement maps to 800-53 IA-2; a recommendation on audit log retention maps to AU-11. That is why a risk register can carry both identifiers on the same row.

What is a CIS Benchmark score and does it mean anything?

Assessment tools produce a percentage of recommendations passed. The score is useful for tracking drift over time within one tenant. It is not comparable across organizations, because scope, exclusions, and Level 1 versus Level 2 selection differ. A single failed Level 1 recommendation on MFA can matter more than twenty passed recommendations on lesser settings.

How often do the Benchmarks change?

Frequently for cloud platforms. The Microsoft 365 Foundations Benchmark and Azure Foundations Benchmark receive point releases several times a year as Microsoft changes features and defaults. A configuration assessed against last year's version is not current.

What does a CIS Benchmark assessment find in a typical mid-market Microsoft 365 tenant?

Legacy authentication protocols still enabled, MFA gaps for administrators and service accounts, unified audit log retention at defaults, anonymous sharing links permitted, external forwarding allowed, and Conditional Access policies that exist but are in report-only mode. These are the recommendations attackers rely on remaining unaddressed.

Illustrative Example: Hardened After the Fact

A composite drawn from the pattern our assessments find. It does not describe a specific client.

An internal team completes a Microsoft 365 hardening project and can show a Benchmark assessment with strong Level 1 coverage. Conditional Access is enforced, legacy authentication is disabled, and external forwarding is blocked.

A compromise assessment then finds mailboxes already under attacker control. The intrusions began before the hardening project, through adversary-in-the-middle phishing that captured session tokens after MFA was satisfied. Persistence set up earlier keeps working after the new settings go in: a device registered before device-based Conditional Access was tightened now looks like a compliant endpoint, and inbox rules planted before forwarding was blocked still hide payment and payroll mail.

The Benchmark assessment is accurate. The tenant is configured well. The configuration simply postdates the compromise. The lesson for anyone reading a Benchmark score in a board deck or a diligence report: it measures the walls, not who is already inside them.