CIS publishes updated Benchmarks for Windows, Apache Tomcat, PostgreSQL, Chrome, macOS, and Linux systems

Original title: CIS Benchmarks September 2026 Update

CIS Security published updates to 19 CIS Benchmarks in September 2026, including significant revisions to Windows Server 2022, Windows 11, Windows Server 2025, Apache Tomcat, PostgreSQL, Chrome, ChromeOS, macOS, and Linux distributions. The updates align with latest software versions and add enhanced security guidance, including generative AI recommendations for Chrome platforms. Organizations using these systems and applications should review and implement the updated recommendations to maintain alignment with current security best practices.

What changed

• CIS Microsoft Windows Benchmarks (Server 2022 v5.1.0, Windows 11 Enterprise v5.1.0, Server 2025 v2.1.0, and Server 2025 Stand-alone v2.0.0) removed all Microsoft Defender Antivirus recommendations as Defender now has its own dedicated Benchmark. Windows Server 2025 v2.1.0 updated 7 recommendations and removed 1 recommendation. Windows Server 2025 Stand-alone v2.0.0 added 8 recommendations, updated 1, removed 6, and renamed 1. All updated Windows Benchmarks modified 18 Control Mappings.
• CIS Apache Tomcat Benchmarks (Application Server 9 STIG v1.1.0, Tomcat 11 v1.1.0, and Tomcat 10.1 v1.2.0) updated audit and remediation sections to reflect improvements and enhancements to recommendations, created additional scans and automations, and removed deprecated settings.
• CIS PostgreSQL 17 Benchmark v2.0.0 updated recommendations to reflect PostgreSQL version changes and ticket corrections, added a new recommendation requiring passwords for all accounts capable of login, and updated CIS Control mappings.
• CIS Google Chrome Benchmarks (Group Policy v1.1.0 and Enterprise Core Browser v1.1.0) updated to align with Chrome v150, added generative AI recommendations, and added 20 new recommendations to enhance security guidance. CIS GoogleOS Benchmark v1.2.0 updated to align with ChromeOS v150 and included additional generative AI recommendations and 20 new security guidance recommendations.
• CIS Apple macOS 15 (Sequoia) STIG Benchmark v1.1.0, CIS Microsoft Windows 11 STIG Benchmark v1.2.0, CIS Debian 13 Linux Benchmark v1.1.0, and CIS Linux distributions for AlmaLinux OS 9, Oracle Linux 9, Red Hat Enterprise Linux 9, and Rocky Linux 9 (all v3.0.0) were published with updates and enhancements for current versions and security alignment.

Who is affected

Organizations globally using Microsoft Windows Server and Enterprise systems, Apache Tomcat application servers, PostgreSQL databases, Google Chrome and ChromeOS platforms, Apple macOS systems, and Linux distributions (including RHEL, Debian, AlmaLinux, Oracle Linux, Rocky Linux) in their IT infrastructure and applications.