# CIS Benchmark

**What is a CIS Benchmark?**

A CIS Benchmark is a collection of reviewed security settings for an operating system or software, published by the Center for Internet Security. It is an international reference for hardened systems.

There are benchmarks for Linux, Windows, databases, web servers and cloud services, each with hundreds of rules on passwords, services, logging and file permissions.

Setting that many options by hand, identically on every server, is error-prone, so CIS hardening is usually automated and drift is checked regularly.

In ISO 27001 audits or under NIS2 a CIS Benchmark often serves as evidence of a documented security level. Justified exceptions should be documented.

## Related terms
- [Hardening](https://vetosec.at/en/it-security/haertung/)
- [Patch management and updates](https://vetosec.at/en/it-security/patch-management/)
- [IT audit](https://vetosec.at/en/it-security/it-audit/)
- [ISO/IEC 27001](https://vetosec.at/en/it-security/iso-27001/)

## Source
https://vetosec.at/en/it-security/cis-benchmark/ (vetosec, schutz)