CIS Security Audit
85% of attacks exploit configuration errors that CIS Controls block. We'll audit Windows, Linux, AWS, Azure against CIS Benchmarks. You get a report with deviations and a prioritized hardening plan.
Describe your scope — your account manager will reply within 24 hours.
- Free quote
What is a CIS security audit?
A CIS security audit measures how well your systems comply with CIS Benchmarks — the globally recognized hardening guidelines published by the Center for Internet Security for operating systems, cloud platforms, databases, and network devices. nFlo uses CIS-CAT Pro and OpenSCAP alongside manual checks to identify deviations, map them to MITRE ATT&CK techniques, and deliver a prioritized hardening guide aimed at the configuration errors attackers rely on.
Contact your account manager
Discuss CIS Security Audit with your dedicated account manager.
Default configuration = open doors for attackers
Automated scanning + hardening guide
Automated Scanning
Scan systems against CIS Benchmarks
Gap Analysis
Identify deviations and risks
Hardening Plan
Prioritized remediation actions
Ransomware Attack Through RDP with Default Password
Configuration hardening is the least glamorous part of cybersecurity and one of the most effective: intrusions rarely begin with an exotic exploit, they begin with a setting left at its default and never reviewed.
Manufacturing company lost €200,000 to a ransomware attack. Attackers got in through RDP with default local administrator password. System wasn’t hardened according to CIS Benchmark - RDP publicly accessible, no MFA, local accounts with simple passwords.
Without CIS hardening:
- Default configurations = open doors (RDP, SMB, SSH exposed)
- Excessive privileges for local accounts
- No monitoring of critical events
- 85% of attacks exploit configuration errors that CIS would block
CIS Benchmarks - Proven Hardening Recipes
CIS (Center for Internet Security) publishes benchmarks - detailed hardening guidelines for every system. Used by governments, military, Fortune 500. We’ll check if your systems are compliant.
How CIS Benchmarks differ from CIS Controls and how to implement both standards is explained in our guide CIS Controls and CIS Benchmarks — What They Are and How to Implement.
What you get:
- System scanning against CIS Benchmarks (automated + manual checks)
- Compliance report: % compliance for each system and control
- Deviation list with severity (Critical, High, Medium, Low)
- MITRE ATT&CK mapping: which attack techniques you block
- Hardening guide: specific commands/settings to fix
- Automation scripts for hardening where possible
Who Is It For?
This service is for you if:
- You must meet compliance requirements (PCI DSS, NIST, ISO 27001)
- Cyber insurer requires CIS Controls
- You want to harden systems but don’t know where to start
- You’ve experienced an incident due to configuration error
- You’re deploying new systems and want to configure them properly from the start
CIS Controls v8 - 18 Controls
CIS Controls are prioritized defensive security actions. Versions 8 and 8.1 define 18 controls:
- Inventory of Assets
- Inventory of Software
- Data Protection
- Secure Configuration
- Account Management
- Access Control Management
- Continuous Vulnerability Management
- Audit Log Management
- Email and Web Browser Protections
- Malware Defenses
- Data Recovery
- Network Infrastructure Management
- Network Monitoring and Defense
- Security Awareness Training
- Service Provider Management
- Application Software Security
- Incident Response Management
- Penetration Testing
Each control consists of safeguards – 153 in total. Implementation Groups (IGs) do not split the controls by number: they are cumulative sets of safeguards drawn from across the whole list of 18 controls, and each group includes the previous one.
Implementation Group 1 (IG1) - Small businesses
56 safeguards of essential cyber hygiene – the minimum for every organization, including those with a small IT team.
Implementation Group 2 (IG2) - Medium businesses
The IG1 safeguards plus 74 more, 130 in total – for organizations with their own IT staff that process data requiring protection.
Implementation Group 3 (IG3) - Large enterprises
All 153 safeguards: IG2 plus 23 more – for organizations with a specialized security team that process highly sensitive or regulated data.
CIS Benchmarks - Systems
We audit according to official CIS Benchmarks for:
Operating Systems
- Windows - Server 2016/2019/2022, Windows 10/11
- Linux - RHEL, Ubuntu, Debian, CentOS, Amazon Linux
- Unix - Solaris, AIX
Cloud Platforms
- AWS - Foundations Benchmark
- Azure - Foundations Benchmark
- Google Cloud - Foundations Benchmark
Applications
- Databases - MS SQL, Oracle, PostgreSQL, MySQL, MongoDB
- Web servers - Apache, Nginx, IIS
- Containers - Docker, Kubernetes
Network Devices
- Cisco - IOS, ASA
Tools We Use
- CIS-CAT Pro - official CIS tool
- OpenSCAP - open-source compliance scanner
- AWS Security Hub - CIS Benchmark for AWS
- Azure Security Center - CIS Benchmark for Azure
- InSpec - infrastructure testing (Chef)
- Nessus - configuration audit
Related Glossary Terms
Learn more about key concepts related to this service:
How we work
Our proven service delivery process.
Scope Definition
Define systems and benchmarks for audit
Automated Scan
CIS-CAT, OpenSCAP, cloud-native tools scanning
Analysis
Deviation analysis, MITRE ATT&CK mapping
Hardening Guide
Report with prioritized actions
Benefits for your business
What you gain by choosing this service.
Fewer Open Doors
CIS Controls target the most common attack paths
Compliance
CIS required by PCI DSS, NIST, cyber insurance
Lower Premiums
Insurers offer discounts for CIS compliance
Quick Wins
Hardening can be done in weeks, not months
Related Articles
Expand your knowledge with our resources.
PHP2Shell and Node2Shell: virtual patching before you deploy the fixes
Within two days CISA added two PHP flaws known as PHP2Shell and a Google Brotli decoder flaw called Node2Shell to its KEV catalog. We explain who is affected, which versions fix them and how virtual patching protects applications before the fixes reach every server.
Read more →Continuous cloud compliance: how do CSPM, PCI DSS and automated remediation replace the once-a-year audit?
The audit confirmed the cloud environment was compliant in March, and in April someone opened a database port for a test and forgot to close it. We show how to turn an annual check into continuous configuration measurement that produces audit evidence on its own.
Read more →Third-party vendor access to critical systems: how do you control it under DORA?
The integrator of your core system, the firm that maintains your databases, the infrastructure service provider — each of them logs into systems your institution is accountable for, not theirs. We show how to turn DORA and Delegated Regulation 2024/1774 into concrete decisions about the account, the session and the evidence for audit.
Read more →Frequently Asked Questions
Common questions about CIS Security Audit.
How long does a CIS Benchmarks audit take and what systems does it cover?
The audit takes 5-10 business days. It covers operating systems (Windows Server, Linux RHEL/Ubuntu), cloud platforms (AWS, Azure, GCP), databases (MS SQL, PostgreSQL, Oracle), containers (Docker, Kubernetes) and network devices (Cisco).
Will I get specific fix instructions after the audit, not just a list of problems?
Yes. The hardening guide contains specific commands and settings to fix for each system, MITRE ATT&CK mapping (which attack techniques you block) and ready-made scripts automating hardening where possible.
Are CIS Benchmarks required by regulations?
CIS Controls and Benchmarks are required or recommended by PCI DSS, NIST, ISO 27001 and many cyber insurers. CIS compliance also provides discounts on cyber insurance premiums.
What tools do you use for scanning?
We use CIS-CAT Pro (official CIS tool), OpenSCAP, AWS Security Hub, Azure Security Center, InSpec and Nessus. Automated scanning is supplemented with manual checks for areas that tools miss.