Home
Frameworks
CIS Benchmarks

CIS Benchmarks

The CIS baseline, checked on every scan.

The CIS Foundations Benchmarks are where most cloud teams start. ACSE lists every recommendation of the CIS AWS Foundations Benchmark 3.0.0 and evaluates 51 of the 62 automatically. On Google Cloud and Azure, it maps its checks to the benchmarks’ identity, storage, network and virtual machine recommendations.

Talk to us See how it works

Know your baseline every day

Each scan re-evaluates the recommendations, so drift shows up the day it happens, not at the next review.

See exactly what is manual

Recommendations no API can answer, such as current contact details, are listed as manual rather than left out.

Fix with a pull request

A failed recommendation becomes a finding with a fix your team reviews in code, or a runbook a person follows.

Coverage

Recommendations with a check behind them

Controls without a check are listed as manual, beside the score, so nothing quietly drops out of view.

CIS AWS Foundations 3.0.0: 51 of 62 recommendations, every recommendation listed
CIS Google Cloud benchmark: 18 of 38 tracked recommendations
CIS Microsoft Azure benchmark: 12 of 22 tracked recommendations

CIS AWS Foundations 3.0.0

Five sections, checked automatically

Examples of the recommendations ACSE evaluates, in ACSE’s own words.

Identity and access

Root user MFA and no root access key (1.4, 1.5), console MFA (1.10), key rotation (1.14) and no full administrator policies (1.16).

Storage

S3 Block Public Access (2.1.4), HTTPS-only bucket policies (2.1.1), EBS default encryption (2.2.1) and RDS instances kept private (2.3.3).

Logging

CloudTrail in every region (3.1) with log validation (3.2), AWS Config (3.3), KMS key rotation (3.6) and VPC flow logs (3.7).

Monitoring

CloudWatch alarms for root use, IAM policy changes, console sign-in failures and network changes (4.1 to 4.15), and Security Hub (4.16).

Networking

No administration ports open to the internet (5.1 to 5.3), a restrictive default security group (5.4) and IMDSv2 only (5.6).

Manual by nature

Contact details (1.1), security questions (1.3) and S3 data classification (2.1.3) need a person. ACSE lists them so you can attest them.

Google Cloud and Azure

The benchmarks’ core sections first

On Google Cloud, ACSE tracks the benchmark’s IAM, networking, virtual machine and storage recommendations. On Azure, it tracks selected identity, storage account, networking and virtual machine recommendations.

Each tracked recommendation shows the checks that evaluate it. The rest of each benchmark is outside what ACSE tracks today, and the framework page says so.

Benchmark versions

A new benchmark, on your schedule

When CIS publishes a new version, ACSE ships it as a signed framework pack with a changelog. You preview your score under it, on your own evidence, before anyone adopts it.

Adopting takes two people. Until then, you stay on the version you have, and every report names it.

Questions

What people ask us

Is ACSE endorsed by CIS?

No. ACSE maps its checks to the CIS Benchmarks and describes each recommendation in its own words. A mapping is configuration that supports your evidence, not an endorsement.

Why are some AWS recommendations manual?

Some recommendations, such as keeping contact details current or classifying data in S3, cannot be answered from configuration. ACSE lists them as manual, outside the score, so your team can attest them with an owner and an expiry.

Which CIS versions does ACSE support for Google Cloud and Azure?

Each framework pack names its version in the portal and in every report. Your team adopts a version deliberately and stays pinned to it.

Keep reading

Clouds

Talk to us

See ACSE on your cloud.

Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.

Talk to us Explore the platform