Windows Server ships configured for broad compatibility, not for a minimal attack surface. Out of the box it leaves settings permissive, services running, and protocols enabled that a security team would rather lock down. The CIS Benchmark for Windows closes the gap between that default installation and a configuration security teams, auditors, and regulators will trust. This guide explains what the CIS Benchmark for Windows is and how its structure and levels work. It covers the control categories, how to choose the right version for your environment, and how to apply and verify it. The aim is to make a dense standards document usable.
What Is the CIS Benchmark for Windows?
The CIS Benchmark for Windows is a set of security configuration recommendations. The Center for Internet Security develops and maintains it through a global consensus process. Security professionals, system administrators, and industry experts contribute to and review each benchmark, which is what gives it authority beyond any single vendor’s opinion.
Unlike a vendor’s own security baseline, CIS Benchmarks are independent and vendor-neutral. They are widely recognized by regulatory frameworks including NIST, PCI DSS, HIPAA, and ISO 27001. Each benchmark specifies the exact settings that should be applied to a Windows system to shrink its attack surface. Those settings are organized by category. Each is assigned to either Level 1 or Level 2, based on the impact and complexity of applying it. That structure is what lets a team work through a benchmark methodically rather than drowning in a flat list of hundreds of settings.
CIS Benchmark Windows Levels: L1, L2 and STIG
Understanding the level distinction is the single most important concept for any team starting a CIS benchmark Windows implementation. The level tells you how aggressive a recommendation is, and choosing the wrong one is how hardening projects earn their reputation for breaking things.
Level 1: Essential Security Controls
Level 1 is the minimum baseline: controls that belong on every Windows system regardless of its role, sensitivity, or environment. These settings are chosen to have minimal impact on functionality and usability, so they can be applied broadly without a long compatibility-testing cycle. They address the most commonly exploited default configurations and establish the floor every organization should reach before doing anything more.
A default Windows installation falls well short of full Level 1 alignment, which is the gap a hardening project exists to close. The exact shortfall varies by version and role, and the point is that you measure it rather than guess. Level 1 is the starting point, not the finish line.
Level 2: Enhanced Security for Sensitive Environments
Level 2 builds on Level 1 with additional controls for environments handling sensitive data, regulated information, or high-value targets. Some Level 2 controls can affect performance or require changes to user workflows, which is why they are not applied universally. They suit servers holding PCI-scoped data, healthcare records, or government information, and organizations operating under HIPAA, SOX, CMMC, or similar frameworks. The usual practice is Level 2 on sensitive systems and Level 1 everywhere else.
STIG Overlay
CIS also publishes STIG-aligned versions of its Windows benchmarks for organizations subject to Defense Information Systems Agency requirements. The STIG overlay is the most stringent tier. It incorporates all Level 1 and Level 2 controls plus additional requirements specific to US federal and defense environments. These overlays are available for Windows Server 2016, 2019, and 2022. If you are not operating under DISA requirements, you do not need the overlay, but it is the reference point for the strictest tier.
Which CIS Benchmark Windows Version Applies to Your Environment?
Control numbers and specific settings differ between Windows versions, so applying the wrong benchmark produces confident, incorrect results. Match your environment to the right document before you start.
Windows Server 2022
The CIS benchmark Windows Server 2022 document comes in both standard and Stand-alone editions. The Stand-alone edition applies to servers not joined to an Active Directory domain. The standard edition assumes domain membership and Group Policy availability. Windows Server 2025 benchmarks are also available as of 2025. Organizations running Server 2022 should use the latest version of that benchmark, currently in the 5.x series. The domain-versus-standalone distinction matters because a large share of the benchmark is delivered through Group Policy that a standalone server does not have.
Windows Server 2019
Windows Server 2019 remains widely deployed and has a mature benchmark in the 5.x series. The same standard-versus-Stand-alone split applies. STIG-aligned versions of the CIS benchmark Windows Server 2019 document are also available, which makes 2019 workable for organizations with federal or defense compliance requirements. If you run 2019, use the 2019 benchmark rather than extrapolating from a newer one.
Windows Server 2016
The Windows Server 2016 CIS Benchmark remains available and actively maintained. Organizations that have not yet migrated should apply the 2016-specific benchmark rather than adapting a newer version. The control numbers and specific settings differ enough that extrapolation introduces errors. A benchmark that does not match the OS is worse than no benchmark, because it produces false confidence.
Windows 10 and Windows 11 Desktop
CIS publishes desktop benchmarks too. The Windows 10 CIS benchmark and the Windows 11 Enterprise benchmark apply to organization-managed endpoints. Many organizations manage desktop hardening through Intune or Group Policy. CIS publishes separate Intune-specific benchmarks for that use case, which fit the modern managed-endpoint workflow better than the traditional GPO approach.
What the CIS Benchmark Windows Server Standard Covers
If you have never opened a CIS document, the scope can be intimidating. It helps to know the major control categories in advance, because they map to the areas of Windows an attacker actually targets.
Account Policies
This category covers password and lockout policy: minimum password length, which is 14 characters at Level 1, complexity requirements, maximum password age, the lockout threshold after failed attempts, and lockout duration. These apply through Group Policy under Computer Configuration. They are among the first controls any hardening program should address, because weak account policy undermines everything downstream.
Local Policies
Local Policies is one of the most detailed sections of the benchmark, and one where organizations most often sit at default. It covers user rights assignments: which accounts can log on locally, log on as a service, or act as part of the operating system. It also covers security options such as network access settings, interactive logon messages, NTLM restrictions, and User Account Control configuration. The density here is high, and it is where much of the real hardening value lives.
Windows Firewall
The benchmark specifies firewall settings for the Domain, Private, and Public profiles. All three should be enabled, with outbound connections allowed and inbound connections blocked by default unless a rule explicitly permits them. Logging settings for dropped packets and successful connections are specified as well. A firewall that blocks silently gives you no record when something probes it.
Audit Policy
CIS specifies the Windows audit policy settings needed to capture security-relevant events. The categories span account logon, account management, logon and logoff, object access, policy change, privilege use, process tracking, and system events. For each, the benchmark specifies both success and failure auditing, because knowing what succeeded matters as much as knowing what failed during an investigation.
Security Options and Advanced Settings
Several important areas round out the benchmark. SMB signing is required for both client and server, which blocks a class of relay attacks. NTLMv1 restriction, anonymous access restrictions, autorun and autoplay settings, remote desktop configuration, and Windows Defender settings all appear here. These are the settings attackers probe early, so the benchmark treats them as core rather than optional.
How to Apply the CIS Benchmark for Windows Server
Applying a benchmark is a repeatable workflow. The steps below are what actually happens during a CIS implementation.
Download the Benchmark Document
The benchmark PDF is free from the CIS website at cisecurity.org/cis-benchmarks. Each one is a detailed document. For every control it specifies the exact setting, the rationale, the remediation via Registry, Group Policy, or PowerShell, and the audit procedure. Download the version that matches your exact OS, because as noted above, the wrong version produces wrong results.
Apply Settings via Group Policy
For domain-joined servers, Group Policy is the standard delivery mechanism for most CIS Benchmark settings. CIS provides Group Policy Object templates through its CIS-CAT Pro tool and CIS SecureSuite membership. For standalone servers with no domain, Local Security Policy or PowerShell scripts handle the equivalent configuration. Delivering through GPO is what makes the settings consistent across many servers rather than drifting apart machine by machine.
Use the Microsoft Security Compliance Toolkit as a Starting Point
Microsoft’s Security Compliance Toolkit includes Policy Analyzer and baseline GPOs for each Windows Server version. These are a useful starting point, but they are less stringent than CIS Level 2. Treat them as a floor and augment them with the full CIS Benchmark settings rather than stopping at the Microsoft baseline.
Test Before Production Deployment
Test CIS Benchmark settings in a lab or staging environment before applying them to production. Some settings, particularly around authentication protocols and service restrictions, can break compatibility with legacy applications. Catching that in staging costs a config change. Catching it in production costs an outage.
CIS Benchmark for Windows and Regulatory Compliance
CIS compliance is a security asset and a business one, because it produces the documented, defensible standard that auditors and regulators accept.
- PCI DSS Requirement 2.2 requires configuring system components to security configuration standards published by reputable organizations. CIS Benchmarks satisfy this for in-scope Windows systems directly.
- HIPAA does not specify technical controls at this granularity, but it references NIST frameworks, and NIST maps to CIS. Documented CIS compliance is accepted as evidence of reasonable safeguard implementation.
- NIST SP 800-171 and CMMC both require configuration management and hardening of systems handling Controlled Unclassified Information. CIS Level 2 or STIG-level compliance satisfies those configuration-management requirements.
- ISO 27001 Annex A control A.8.9 requires that configurations of hardware, software, services, and networks be established, documented, and monitored. CIS Benchmark documentation satisfies this control directly.
How to Verify CIS Benchmark Compliance on Windows, and Where Panopsys Fits
Applying a benchmark and verifying it held are two different things, and the gap between them is where compliance quietly fails. Many organizations apply CIS settings during the initial build and never confirm those settings survived later patches, software installs, and administrative changes. A benchmark pass is a snapshot, and Windows configurations drift. A server that was compliant at deployment may not be six months later, and nobody knows unless someone re-checks.
A clear note on where Panopsys sits, so there is no confusion. The Panopsys Hardening module audits the Linux side of a server estate: Linux, Apache, Nginx, MySQL, and PostgreSQL. The free plan includes one hardening audit. It checks them against established hardening baselines, using an agentless, readable script you run yourself with nothing to install. It does not currently audit Windows Server, so for the Windows benchmarks described in this guide, a CIS-CAT-style tool is the right choice. Most estates are mixed, and in that case the two are complementary: Panopsys covers configuration auditing for the Linux, web, and database layer while a CIS assessment tool covers Windows. On vulnerabilities rather than configuration, CVE Watch is platform-agnostic. It tracks CVEs for the technologies you tell it you run, Windows software included, and flags which already have a public exploit. The software-vulnerability side of your Windows risk is covered.
