CIS Benchmarks provide secure configuration guidelines developed through community consensus to enhance system, software, and network security, featuring two levels of profiles for varying security and usability impacts, along with specific implementation instructions for integrating these benchmarks into MDM tools like Fleet and Primo.

What are CIS Benchmarks?

CIS Benchmarks are consensus-based secure configuration guides used to harden systems, software, and networks—an industry-recognized baseline to reduce attack surface. 

How are they produces?

They are community-developed through an open consensus process (CIS WorkBench) with government, industry, and academia. There are 100+ benchmarks across 25+ vendor families

How to add CIS Benchmarks

If you want to download fleetDM CIS Benchmarks policies on your MDM instance, you can run this script to generate the CIS policies queries YAML file.

#!/bin/bash#shellcheck disable=SC2207# convert.cis.policy.queries.yml @2024 Fleet Device Management# CIS queries as written here:#    https://github.com/fleetdm/fleet/blob/main/ee/cis/macos-14/cis-policy-queries.yml# must be converted to be uploaded via Fleet GitOps.## This script takes as input the YAML from the file linked above & creates a new YAML array compatible with the "Separate file" format documented here:#    https://fleetdm.com/docs/configuration/yaml-files#separate-file# get CIS queries raw file from Fleet repocisfile='https://raw.githubusercontent.com/fleetdm/fleet/refs/heads/main/ee/cis/macos-14/cis-policy-queries.yml'cispath='/private/tmp/cis.yml'# cisspfl='/private/tmp/cis.gitops.yml'/usr/bin/curl -X GET -LSs "$cisfile" -o "$cispath"# create CIS benchmark arrayIFS=$'\n'cisarry=($(/opt/homebrew/bin/yq '.spec.name' "$cispath" | /usr/bin/grep -v '\-\-\-'))for i in "${cisarry[@]}"do    cisname="$(/opt/homebrew/bin/yq ".[] | select(.name == \"$i\") | (del(.platforms)) | (del(.purpose)) | (del(.tags)) | (del(.contributors))" "$cispath" | /opt/homebrew/bin/yq eval '.name')"    cispfrm="$(/opt/homebrew/bin/yq ".[] | select(.name == \"$i\") | (del(.platforms)) | (del(.purpose)) | (del(.tags)) | (del(.contributors))" "$cispath" | /opt/homebrew/bin/yq eval '.platform')"    cisdscr="$(/opt/homebrew/bin/yq ".[] | select(.name == \"$i\") | (del(.platforms)) | (del(.purpose)) | (del(.tags)) | (del(.contributors))" "$cispath" | /opt/homebrew/bin/yq eval --unwrapScalar=true '.description')"    cisrslt="$(/opt/homebrew/bin/yq ".[] | select(.name == \"$i\") | (del(.platforms)) | (del(.purpose)) | (del(.tags)) | (del(.contributors))" "$cispath" | /opt/homebrew/bin/yq eval --unwrapScalar=true '.resolution')"    cisqrry="$(/opt/homebrew/bin/yq ".[] | select(.name == \"$i\") | (del(.platforms)) | (del(.purpose)) | (del(.tags)) | (del(.contributors))" "$cispath" | /opt/homebrew/bin/yq eval --unwrapScalar=true '.query')"     printf "name: %s\nplatform: %s\ndescription: |\n%s\nresolution: |\n%s\nquery: |\n%s\n" "$cisname" "$cispfrm" "$cisdscr" "$cisrslt" "$cisqrry" | /usr/bin/sed 's/^/    /g;s/^[[:space:]]*name:/- name:/;s/^[[:space:]]*platform:/  platform:/;s/^[[:space:]]*description:/  description:/;s/^[[:space:]]*resolution:/  resolution:/;s/^[[:space:]]*query:/  query:/'# set -x# trap read debugdone

Then you can run this command to upload these policies to your FleetDM instance

fleetctl apply --policies-team "Workstations" -f cis-policy-queries.yml

Where MDM tools fit (Fleet/Factorial IT)

Fleet exposes policy queries to assess CIS compliance on macOS 13+ and Windows 10+ (Enterprise).

Policies do not remediate—you still need MDM profiles and/or scripts to enforce settings (e.g., enable FileVault and prevent disabling), and you can use automations to drive remediation workflows. Some checks require MDM enrollment and specific agent permissions. 

You can find our remediations profiles and scripts below.

Password policy & Automatic ScreenLock

Short lock timeouts and strong password helps prevent attacks like shoulder-surfing, insider misuse and opportunistic access on unattended laptops.

This policy is templated with Factorial IT and works for iOS, macOS and Windows devices.

1. On Factorial IT, go to MDM > Profiles
2. Select all devices
3. Click on the card : Password & Screen lock
4. Click on “Turn on setting”
5. Navigate to Mac, Windows and iOS tabs to configure each one
6. Finaly, confirm

 

 

Built-in Firewall

Default-deny inbound traffic reduces the chance that a dormant service becomes a network entry point, especially on public Wi-Fi.

This policy is templated with Factorial IT and works for both macOS and Windows devices.

1. On Factorial IT, go to MDM > Profiles
2. Select all devices
3. Click on the card : Firewall
4. Click on “turn on setting”
5. Finally, confirm