CIS Benchmarks Overview

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A benchmark is a list of questions, not a script

CIS publishes benchmarks this page does not reproduce. The checklist generators for Windows Server 2022, Windows Server 2025, Windows 11, Windows 10, and Ubuntu Linux turn those ideas into questions you answer on a host you administer. A generated line is a question. It is not a command you paste, and it is not the benchmark text.

The hardening guide is the order: console first, management prefix, no world-allow. The configuration review guide is for files such as Docker and Terraform. This page is how you walk a host checklist without pretending the generator is the publisher.

Level and profile are choices. A laptop and a server do not get the same answers. An item that would remove your only admin path is an item you defer and write down.

Evidence is the setting you observed. A tick without the setting is the same failure as on the policy guide.

One lab host, ten questions, two changes

Pick the generator that matches the lab OS. Answer ten questions by looking, not by pasting. Choose two items that do not lock you out. Change those two, with the previous value saved. Leave the other eight as observed, deferred, or not applicable.

If an item says the world may connect, that item is refused, the same as on the hardening guide. Documentation prefixes stay in the lab.

Write the profile you think you are following and why. Do not claim a CIS certification or a scored benchmark result from this exercise. A publisher's assessment is a different process.

The next ten questions are a later window. A weekend of unattended changes is how consoles get locked.

A change you can finish

The canary host gets the same two changes after the lab. The rest of the benchmark waits.

Rollback is the previous two values.

Match the generator to the OS you run.
Answer ten items by observation.
Change two that you can undo.
Refuse any world-allow.
Save the previous values.
Do not paste the benchmark.
Do not claim a CIS score.

Mistakes that outlive the command

CIS benchmarks fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Pasting benchmark text into a shell.
Applying every item in one window.
A laptop profile on a server, or the reverse, without reading.
Locking out the only admin path.
Claiming a certified score.
Ticks with no observed value.
A world-allow left in because it was generated.
Skipping the console test.

Decisions to write down before the window

One decision for CIS benchmarks: The generator matches the OS. Ten items were observed. Two changes have previous values. No benchmark text was pasted. No score is claimed. Console access still works. World-allows are absent. The hardening guide owns the firewall order. The next ten items are scheduled. And one host is the canary.

The hour you stop

Write the hostname or the system name, the owner, and the clock time before you change anything for CIS benchmarks. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.

A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.

Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.

Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next system waits until someone else can repeat the proof from the notes. CIS benchmarks is done for this window when the proof is written, not when the tool printed a file.

This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.

Benchmark checks before the next ten items

Confirm this before you call the change done: The OS and the generator match. Ten observations are written. Two changes are the only changes. Previous values are saved. Console login works. No world-allow exists. Nothing was pasted from a benchmark PDF. The ticket does not say CIS certified. Deferred items say why. A second person saw the two changes. The canary is one host. The next window is dated. The hostname in the prompt matches the hostname in the ticket for CIS benchmarks. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for CIS benchmarks happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.

Companion: System: Server Hardening & Audit Guide.