{"id":78260,"date":"2023-03-27T11:30:00","date_gmt":"2023-03-27T15:30:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=78260"},"modified":"2023-08-30T09:33:45","modified_gmt":"2023-08-30T13:33:45","slug":"cis-compliance","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/cis-compliance","title":{"rendered":"CIS Benchmarks for Compliance"},"content":{"rendered":"\n

IT admins have some of the toughest, most thankless jobs.<\/p>\n\n\n\n

While their day-to-day tasks may not be glamorous and flashy, the impact of their role can\u2019t be understated \u2014 especially when it comes to security and compliance.<\/p>\n\n\n\n

Modern organizations have a legal obligation to keep their employee and customer data safe. And the Center for Internet Security (CIS)<\/a> helps companies minimize their risk and maximize their protection, sharing the most up-to-date guidelines for cybersecurity.<\/p>\n\n\n\n

But the over 100 CIS Benchmarks tend to overwhelm IT leaders struggling with reduced budgets and resources. What they may not know is that implementing CIS Benchmarks doesn\u2019t have to be painful<\/a>.<\/p>\n\n\n\n

Below, we\u2019ll cover what CIS compliance is, why it\u2019s important (even if you don\u2019t work with the government), and how to use CIS Benchmarks to achieve it.<\/p>\n\n\n\n

What Is CIS Compliance?<\/h2>\n\n\n\n

A company achieves CIS compliance when they\u2019ve followed CIS security guidelines. To be CIS-compliant, organizations must implement a wide variety of recommendations outlined in the form of CIS Benchmarks. CIS compliance implies that organizations have taken the necessary steps to safeguard their data and systems from unauthorized access \u2014 from internal and external actors.<\/p>\n\n\n\n

Most governments require proof of CIS compliance for their vendors. And some require other forms of compliance as well, such as NIST<\/a>, PCI DSS<\/a>, and HIPAA<\/a>. Implementing CIS Benchmarks leaves companies with a strong, broad risk management strategy that helps companies adopt other security frameworks, too.<\/p>\n\n\n\n

What Are CIS Benchmarks?<\/h2>\n\n\n\n

CIS Benchmarks are a set of best practices published by the Center for Internet Security, curated by cybersecurity experts from around the world. These Benchmarks are designed specifically to mitigate known and emerging security risks within organizations\u2019 digital systems, applications, and networks and serve as an international standard for companies that collect, store, and analyze sensitive data.<\/p>\n\n\n\n

CIS Benchmarks apply to over 25 of the most commonly used vendor products, defining optimal settings and access management policies to combat malware, phishing, and ransomware attacks. CIS Benchmark recommendations and audit checklists are free and available for anyone to download online.<\/p>\n\n\n\n

Benchmark Structure<\/h3>\n\n\n\n

To make CIS Benchmarks easier to follow, they all have an analogous structure. First comes a high-level description of the Benchmark, any definitions IT and security teams need to know, and an explanation of the Benchmark’s impact on cybersecurity. Then comes a prioritized checklist of recommended policies and configurations for organizations to implement and audit.<\/p>\n\n\n\n

Scored and Unscored Recommendations<\/h3>\n\n\n\n

Each recommendation in a CIS Benchmark is considered \u201cscored\u201d or \u201cunscored.\u201d Scored recommendations are mandatory to attain CIS compliance. If scored recommendations aren\u2019t put into practice, they decrease the company\u2019s overall Benchmark score. However, unlike scored recommendations, unscored recommendations do not affect an organization\u2019s total Benchmark score. A list of scored and unscored recommendations is available in the appendix of each CIS Benchmark.<\/p>\n\n\n\n

CIS Hardened Images<\/h3>\n\n\n\n

Beyond written recommendations, the CIS offers Hardened Images or virtual machines preconfigured with operating system configurations. Hardened Images serve as a template, meaning they can be copied and then adjusted to achieve varying levels of compliance. Companies take advantage of CIS Hardened Images because they are continuously updated by CIS, quick to deploy, and easy to manage.<\/p>\n\n\n\n

CIS Benchmark Profiles<\/h2>\n\n\n\n

CIS uses several levels to distinguish between the resources and recommendations for each benchmark. Companies are encouraged to aim for the profile that best suits their compliance and security requirements.<\/p>\n\n\n\n