CIS Benchmarks

1. 2026-11-03 Medium
   CIS publishes updated Benchmarks for Microsoft, AWS, Kubernetes, Docker, and NGINX

   CIS released and updated Benchmarks in November 2026 covering multiple platforms including Microsoft, AWS, Kubernetes, Docker, and NGINX. Organizations should review the updated guidance to ensure …

   New version Action required

2. 2026-10-06 Medium
   CIS Benchmarks updated in October 2026

   CIS Benchmarks have been updated during October 2026, with major updates highlighted and full changelogs provided for each benchmark. Organizations implementing CIS Benchmarks should review the …

   New version Action required

3. 2026-09-11 Medium
   CIS publishes updated Benchmarks for Windows, Apache Tomcat, PostgreSQL, Chrome, macOS, and Linux systems

   CIS Security published updates to 19 CIS Benchmarks in September 2026, including significant revisions to Windows Server 2022, Windows 11, Windows Server 2025, Apache Tomcat, PostgreSQL, …

   New version Action required

That is the last 90 days. Sign in to read further back.

1. 2026-10-06 CIS Benchmarks October 2026 Update published
2. 2026-09-11 CIS Benchmarks September 2026 Update published

1. 2026-10-06
   CIS Benchmarks October 2026 Update RevisionCurrent

   Eight Benchmarks updated in the past month, including VMware ESXi 7.0 v1.6.0 and 8 v1.4.0, MongoDB 8 and 7 v2.0.0, Apache HTTP Server 2.4 v2.4.0 and Windows 10 Enterprise v5.0.0. source

   More

   • Also updated YugabyteDB v2.0.0 and Talos Linux v2.0.0.
   • Each Benchmark includes a full changelog of its modifications.
2. 2026-09-11
   CIS Benchmarks September 2026 Update Revision

   Nineteen Benchmarks updated, including Windows Server 2022 v5.1.0, Windows 11 Enterprise v5.1.0, Windows Server 2025 v2.1.0 and Red Hat Enterprise Linux 9 v3.0.0. source

   More

   • In the Windows Server 2022 and Windows 11 Enterprise Benchmarks, all Microsoft Defender Antivirus recommendations were removed because Defender now has its own Benchmark.
   • Also updated PostgreSQL 17 v2.0.0, Debian 13 Linux v1.1.0 and Google Workspace Foundations v1.4.0.
3. 2026-08-11
   CIS Benchmarks August 2026 Update Revision

   Six Benchmarks updated, including Microsoft Azure Database Services v2.0.0, AWS Database Services v2.0.0 and PostgreSQL 13 and 14 v1.3.0. source

4. 2026-07-15
   CIS Benchmarks July 2026 Update Revision

   Benchmarks updated include Microsoft SQL Server 2022 v1.3.0, Apple macOS 26 Tahoe v1.1.0, Microsoft Intune for Windows 11 and 10 v5.0.0 and Snowflake Foundations v2.0.0. source

Product-specific secure configuration recommendations, free as PDF for non-commercial use, for anyone hardening the technologies they cover.

Coverage

More than 100 CIS Benchmarks across 25+ vendor product families, covering cloud provider platforms and services, containers, databases, desktop and server software, mobile devices, network devices and operating systems. source

Free download

The Benchmarks are available through free PDF download for non-commercial use. source

Older versions

Older versions of the CIS Benchmarks can be accessed in CIS WorkBench. source

Link to CIS Controls

The Benchmarks are mapped to the CIS Critical Security Controls; CIS Control 4 recommends secure configurations, and the Benchmarks are the hardening guidelines for specific products. source source

DISA STIG editions

CIS also publishes STIG Benchmarks, for example Microsoft Windows 11 STIG and Red Hat Enterprise Linux 10 STIG, in a separate DISA STIG category. source

Organizations scan their own systems against the Benchmarks, with CIS-CAT Pro Assessor for CIS SecureSuite members or the free CIS-CAT Lite for select technologies.

CIS-CAT Pro Assessor

A configuration assessment tool for CIS SecureSuite members that scans systems and reports their level of compliance with the CIS Benchmarks, with results mapped to the CIS Controls Implementation Groups. source

CIS-CAT Lite

A free assessment tool with unlimited scans that checks systems against select CIS Benchmarks and gives a compliance score. source

Tailoring

Members can customize Benchmarks in CIS WorkBench and assess against the tailored versions. source

Pre-hardened images

CIS Hardened Images are virtual images hardened to the CIS Benchmarks, offered on cloud service provider marketplaces. source

CIS publishes the Benchmarks as recommendations; CIS says they help organizations demonstrate compliance with parts of industry regulations and frameworks.

Use in compliance

CIS states that the Benchmarks help organizations demonstrate compliance with components of various industry regulations and frameworks. source

Licensing

Free PDF downloads are for non-commercial use; tailoring the recommendations requires a CIS SecureSuite membership. source source

1. Standard CIS Benchmarks list and downloads
2. Guidance CIS Benchmarks overview
3. Guidance CIS Benchmarks October 2026 Update
4. Guidance CIS-CAT Pro Assessor

1. CIS Controls

   The CIS Controls are a general set of security practices; the Benchmarks are product-by-product configuration settings that implement the secure-configuration Control.

2. NIST SP 800-53

   NIST SP 800-53 states control requirements such as configuration management; the CIS Benchmarks give the concrete settings for individual products.

3. PCI DSS

   PCI DSS requires secure configurations for card data environments; CIS Benchmarks are one published source of hardening settings, not a payment card standard.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to CIS Benchmarks (RSS)