Comply or Cry:
CIS Controls v8

Hi everyone. Thank you so much for joining the episode 3 of the Comply or Cry series. We will be covering CIS controls and benchmarks today. My name is Dakota Magelliot. I will be giving myself a little bit more of an introduction in the next slide, but first and foremost just wanted to give an overview of what we will be covering today. So, we will be diving into the CIS benchmarks and then also how they impact as well as assess Microsoft 365 security.

We are going to cover how Microsoft tenants are insecure by default, what that means for new and existing environments, and then also just how to ensure that your tenants meet those modern standards. I am really excited to spend some time with you all today talking about CIS benchmarks and controls, and how it directly connects to the work that you're already doing in Microsoft 365. So, first and foremost a little bit about me. Before joining inforcer, I worked at the Center for Internet Security supporting secure suite members and also helping organizations understand and also implement the CIS controls and benchmarks as well.

So, I also did help develop tools and also mappings that helped teams align CIS requirements to other frameworks as well. So, we'll go into that further and what that means for you today, but CIS has really been at the core of my work overall and over the past few years both from I would say a compliance side and also an engineering side as well. Here at inforcer, my focus is helping MSPs and also IT teams interpret Microsoft 365 configuration.

So, a big part of my role is demoing the platform, educating partners, and making CIS guidance hopefully more approachable and digestible, especially when it comes to translating a large benchmark document into more practical, actionable security posture. So, today's session is going to be designed to give you clarity on how CIS frameworks fit into your existing workflows, and also how inforcer streamlines the process of accessing and assessing and also implementing CIS-aligned configurations in Microsoft 365. So, my goal is to make this feel a little bit easier, and approachable, and applicable to the environments that you manage, specifically towards Microsoft 365 today.

And with that, let's go ahead and jump in. So, this is what we're going to be walking through today. We'll have an overview of CIS. We'll individually go into the CIS controls and the CIS benchmarks. We will focus on why we have CIS as a foundation in the inforcer platform. We will look at compliance framework mapping as a whole, and then also talk about CIS in Microsoft 365 as well. So, what is CIS? Before we get into anything Microsoft 365 related and how we evaluate configurations, let's just go ahead and take a quick step back and level set on what CIS actually is, because this is the foundation of everything that we're going to be talking about today.

So, CIS stands for Center for Internet Security. It is a community-driven nonprofit that was founded in 2000, and it is the organization responsible for developing the CIS benchmarks and the CIS controls. Everything that CIS publishes goes through a really rigorous process. They bring together experts from government, security vendors, academia, and also just industry as a whole to validate what best practices should look like. So, the whole mission is around helping people, businesses, and governments protect themselves against cyber threats in a really practical and also prioritized way.

The tagline is creating confidence in a connected world. And honestly, that does encapsulate the whole point, right? So, CIS is about giving organizations a clean, trusted blueprint for securing systems, whether that is a Windows server, a cloud workload, or in our case today and what we're going to be going over, Microsoft 365. So, on the right side, that is why I created this meme. It had to include it because I think it captures the energy perfectly, right?

You've got companies who do not know CIS yet, companies who are ready to start learning, and then you have companies who actually use CIS guidelines to derive their security decisions. So, today my goal, and also the goal of my team, as me being at the helm of this conversation, is to help move you into the last group with confidence.

So, the foundation with that foundation in place, we can go ahead and talk about the CIS controls and the benchmarks. Starting with the CIS controls, I think is the most important part for this presentation because it does set the scene. It is the overreaching, overarching umbrella of it all. The best way to think about CIS controls is in this umbrella use case analogy. It sits over your entire security program. It looks at technical configuration, as well as procedural activities.

I would say most people encounter CIS first through a benchmark. That typically is what I experienced working at CIS. So, an example of that would be the Microsoft 365 Foundations Benchmark, but the benchmark is actually just one small branch under that big umbrella. So, the controls are the overarching why, the strategic purpose behind the what and the how that you configure, right? So, the controls say, "This is what good security looks like." And then the benchmarks, which we're going to get into shortly, tell you how to implement it on a specific system like Microsoft 365.

So, when you hear CIS Controls, think big picture. When you hear CIS Benchmarks, think, "Okay, this is the granular implementation details." And then when you put them together, you get a full security story, not just technical settings in isolation, right? But, the broader set of practices that make those settings actually meaningful to your entire organization. And this is just a breakdown of the CIS Controls from a top level. So, we have 18 top level controls, and we have the CIS Controls currently version 8.1.

Underneath those top level controls, we have 153 safeguards that live within those top level 1 through 18. After that, CIS Controls have implementation groups. So, this is how you prioritize the implementation of those controls in your organization. I would say that most organizations, and this is what CIS recommended as well when I was there, is to prioritize Implementation Group One first and foremost, and then work your way down from there, and pick and choose and cherry-pick from those decisions.

So, typically what I would see is organizations start with Implementation Group One, focus on those first. If there's any outliers within two and three, also obviously include those. Like for instance, within implementation group three, that is where control 18 or pen testing lives. If you have a pen testing environment and program in place, why not include that in your assessment for CIS controls. But, that's typically what I would see is organizations work their way through implementation group one, then start two, and then cherry pick from three.

So, now that we have talked about the controls as that overarching umbrella, we can shift into the technical side, which is the CIS Benchmark. This is where CIS gets, I would say, extremely prescriptive. So, CIS Benchmarks are consensus-developed secure configuration guidelines. They are recognized by programs like FedRAMP, FISMA, because they represent what the global security community agrees is a safe baseline for specific technology. So, there are over 100 CIS Benchmarks today, and they cover 14 major technology groups, everything from operating systems to server software, cloud providers, and of course, obviously as we're talking about today, Microsoft 365.

So, whereas the controls are telling you the strategy of the what and the why, the benchmarks tell you exactly how to get there. So, if the control for an example says, "Manage access," the benchmark is telling you, "Turn off legacy authentication, require MFA, restrict admin roles." That level of granular detail is where the CIS Benchmarks sit. I would say typically in conversations with newer customers at CIS and also customers here at inforcer if they're just getting their feet wet with CIS, use controls and benchmarks interchangeably.

So, I did really want to make that clear that there's a huge difference between those and conversation levels internally with CIS within the recommendations and also how they're used. You'll also see here CIS refers to two levels in every benchmark. Level one is going to be that essential cyber hygiene, right? Things that improve security with minimal impact to usability. And then we have level two, which is more restrictive and is designed for environments where security is more important than the functionality of the device or the tenant.

And that's really the heart of the benchmarks. They translate broad security principles into very specific, measurable technical activities that you can implement and test throughout your process over time. And this is exactly why our inforcer assessment exists, too. Because these prescriptive settings in Microsoft 365 benchmarks can be time-consuming and complex to vali- validate manually, especially across multiple tenants. So, you can not only automate, validate, and also look at wh- how the tenant is doing in conformance to CIS benchmarks with our assessments, but you can also use our libraries to mass deploy policies to multiple tenants as well.

So, it's a very useful use case for MSPs in particular because you're not only aware and focusing on your internal organization and that's it, you're focused on all of your customers' compliance standards as well, which I think we can all agree is really con- time-consuming on top of even configuring a tenant as a whole with different types of policy settings from scratch. And then on top of that, you have to adhere them to CIS.

So, why did we decide to have CIS as the foundation? I'm sure our product team might have a different explanation for this. In my opinion, and from most of the conversations, honestly, I do think our team as a whole would agree with this. It is my favorite way to kind of explain why CIS matters so much, and that is the topic of standardization.

One, I think it's really awesome because it parallels the concept of inforcer's policy standardization, right? Standardization on its own is good. Having a baseline, having something to measure against, having a shared language around security. But, what makes CIS different is that it isn't just a single entity dictating what the standard should be. It's consensus-based standardization. So, that means every guideline, every control, every benchmark is shaped by a global community of practitioners. So, people from government, industry, cloud providers, academia, security vendors, right?

There It isn't just one company's opinion. It's not just one internal engineer's opinion on how something should be configured. It's what experts are collectively agreeing is the safest, most realistic, and most maintainable approach. So, when organizations choose CIS, they aren't just checking a compliance box, right? They're aligning with a standard that has already been evaluated, debated, and validated by hundreds of people who live and breathe this specific security type every single day. And that's what gives CIS its credibility and why it's trusted across sectors from small businesses all the way up to highly regulated environments.

So, when I'm talking to prospects that are first starting with the inforcer platform, there are two-pronged benefits to using CIS.

It's the customer that doesn't have any compliance requirements, but still needs some sort of standardized approach, and then it's also a customer that has those compliance requirements because CIS maps out to so many different frameworks, it's a great place to start to on-ramp to those because you have a parallel. Think about it from a metaphorical standpoint, especially from an MSP standpoint. You have so many customers with different needs, different industries, different frameworks. If you're already just starting with CIS at the foundation, working your way up, you are covering your bases really well, and over time preventing yourself from repeatable processes in terms of compliance.

We all know there is not just one canonical control set that exists in the world today, but it's a really great start to be able to eliminate those processes that can be automated from a compliance standpoint. So, why CIS continued? This is an important point that often gets misunderstood. CIS benchmarks and CIS controls are recommendations. They represent a strong community-validated baseline for security, but they are not mandated requirements. No organization is expected to hit 100% across every controller benchmark item, and honestly, most environments shouldn't.

When I worked with customers at CIS when we were hardening a Windows 10 server, I would say most customers sat at around 70 to 80% on a good day with the level one checks. Our demo environments sat at that amount. When you first onboarded a assessment to a server within CIS, typically I saw numbers from 20 to 30%, and that was even larger enterprises. I think CIS's biggest purpose is giving you a roadmap of what good looks like, but it's intentionally flexible for you to decide from that library of recommendation what looks good for you.

And that's why it's really great, too, because inforcer kind of works the same way. We provide baseline libraries for your organization to make decisions on what's good for those individual use cases and overall strategy. We give you those resources, and that's exactly what CIS is doing, not only from a standardization point, which is also something that we provide from a policy standpoint, right? We give you a way to repeatedly have naming conventions across all tenants, which is kind of the point of what we're talking about in the last slide as well.

And also, the meme on the right, I think the timing is perfect. I didn't plan it this way, and then I realized the second Devil Wears Prada movie is coming out in May. So, great timing. But, this is where the meme on the right becomes real. People typically asked me at CIS, even customers, and at inforcer is we're really focusing on our customers becoming CIS compliant. But, truly, and this is when we can kind of nip this is CIS compliance does not exist.

You will never be CIS compliant. It's not a certificate or an audit standard. It is a maturity target. It's a way to elevate your security posture in a structured and well-understood way. So, the question isn't are we compliant? The better question is how are we aligned to CIS and where does it make sense for us to actually go deeper over time, right? So, that's exactly why inforcer helps clarify. It's not whether setting a setting matches the benchmark, but where does your alignment make sense for your environment, and where improvements will create the biggest security win.

So, this is where you're able to kind of prioritize over time the maturity of a customer, whether they're low maturity, high maturity, whether they have a lot of compliance requirements, etc.

You can make those decisions. Another point, and I kind of have already touched on this a few times, it's a huge benefit of using CIS because it becomes incredibly practical, especially for an MSP. I would talk about this from an individual company perspective of how powerful this is, but for an MSP who is working with hundreds of customers, potentially thousands, and security teams, it acts as an on-ramp mechanism because the benchmarks of the controls sit at a level that's universal enough to apply anywhere, but detailed enough to map cleanly to other frameworks.

It's never going to be apples to apples again. It will be apples to oranges. There will be items that aren't necessarily paralleled and mappable, and that's okay because every framework exists to a unique use case. CIS focuses on cybersecurity, where others have risk management options within them, right? But, what's nice is every benchmark item ties into a CIS control safeguard. A lot of the frameworks focused on, they tell you what is necessary, but they don't tell you how to get there.

There's not prescriptive guidance with configuration on how to get there for a lot of these frameworks. They're coming from the perspective of the CIS control. So, having configuration settings to take home, map out to a framework, and then map them out even further is really an awesome approach and ability to do, and then you just kind of fill in the gaps in between. The CIS website, which we'll go over in a moment, has those mappings available.

I'll kind of explain the dual options that you have on the site in a moment, but again, right, to instead of starting from scratch with each and every framework, if you start with CIS, you have a single standardized foundation that cascades outward. So, if you strengthen your alignment with CIS, you're simultaneously moving closer to alignment with all of these other requirements, and then you just kind of have to fill in the gaps when that's a priority for you.

And then once that's done, especially with an inforcer, if you create an expectation, you never have to do it again, because it already exists. And then you just repeat it outward from there, make any changes if there are any type of regulatory updates from a policy perspective. And this is especially useful in Microsoft 365, where customers often care about multiple frameworks at one time. Using CIS as a starting point means you can confidently say, "If we follow these controls and recommendations, we are building a security posture that supports our broader compliance obligations." And that's why CIS is the on-ramp.

It simplifies the journey, reduces the lift because the heavy mapping work has already been done. And with inforcer, all of this becomes even easier to visualize, operationalize, and even utilize a lot of lies at the end, but it's the truth across your tenants. So, CIS is the on-ramp mechanism, right? It's This is just a fun way to kind of show that. How many frameworks can map out to CIS controls and benchmarks? So, once that foundational work is done, you can then essentially on-ramp to this list.

This is available on CIS's website. It's in the controls navigator. If you just want a point-blank parallel XY Z. If you want a detailed mapping document, CIS also provides that. You just have to go in the top right corner of the website, search the framework that you want a mapping for, and it'll give you those formal mapping documents that not only show you the mappings, but also show you unmapped items as well.

So, it's not just going to tell you the work that CIS can do for you, it's also going to show you the work that they can't do and the gaps that you will need to fill in into your organization to become compliant to that standard from that perspective. And then you can use those mappings for all the other benchmarks that exist, but obviously today's conversation is focused on 365. This slide is just illustrating the focus on Microsoft 365 within the benchmark scope.

So, CIS focuses on Microsoft 365 from the CIS Foundations Benchmark version 6. We have version 5 and version 6 existing in our platform today, which I will show you in a moment a little screenshot of what that looks like. That covers basically anything from standard all the way up to E5 for specific tooling within 365. The only outlier is the Microsoft Intune benchmark for Windows 11 and also Windows 10. We don't really talk about that because most organizations should be at Windows 11 at this point in time, hopefully.

But, we do have those checks specific existing in our assessment engine as well because CIS segments them out for good reason because of how detailed and granular Microsoft Intune is, CIS decided, and I 100% agree, to have it be its own benchmark. And this is where everything we talked about today really comes together, right? CIS gives us the framework, the strategy, and the technical guidance, but in the real world, especially in Microsoft 365, it can be very overwhelming to actually operationalize that, right?

You might have dozens or even hundreds or thousands of benchmark items, each with different priorities, different categories, and different levels of impact, and that even multiplies exponentially when you're working with different customers with different needs. So, most teams look at that pile of recommendations and think, "How am I supposed to filter this? How do I know what matters most to my tenant, my customer's tenant? And where do I even begin in this process? And that's exactly the gap that inforcer is filling because within the platform, CIS isn't just a PDF or a checklist, it becomes a dynamic automated lens for understanding your actual security posture.

So, we map Microsoft 365 configuration data directly against CIS guidance. We highlight and let you know what's passing and what's failing, and then also what's most important to focus on first. So, instead of manually combing through benchmark items, inforcer prioritizes them. So, it surfaces misconfigurations, it turns the entire CIS standard into something that you can actually act on immediately. And that's why the meme that I made on the right is so perfect. Had to put a SpongeBob meme and meme into my presentation somewhere, but all the filtering, all the organization, all the contextualizing that people wish existed inside of Microsoft 365, inforcer can do that.

So, it's your automation layer for CIS alignment. And then from here, we'll go ahead and look at exactly how the platform does that and how it simplifies the process across multiple tenants. So, these are just a few screenshots of what and where CIS exists in the platform. I will say the idea is you're able to look at outcome checks in our assessment section. They don't focus on how the policies configured, the naming conventions of the policy, it's just looking at the outcome.

Is the tenant doing what it needs to do in conformance to the expectation that I set? And we've set these checks within Rego policy outcome checks, compliant if statements, and if you pass, great. If you don't, fail. We're going to let you know the violation, and we're going to allow you to prioritize it from there. And then the idea is you take the assessments that have been done, and then you move on to our align section where we actually give you checks specific to CIS that you can actually implement with your customers.

So, not only are we showing you what's wrong and what needs to be fixed and adjusted, but we also give you the resources to push those policies to your customers today. Which is super helpful. It allows you to standardize because all of the policies will be named one thing and it conforms to CIS, and you can do it in a really repeatable way. So, it's really nice because those already exist in the platform today. So, essentially you could onboard a tenant today, assess it, and push policies without having to do any type of policy creation yourself.

So, in summary, had to use my favorite meme of all time, which is the second one, not the first one. I actually in my first job out of college, I had this printed at my desk, not with the MSP editions, but I just loved the idea. So, an MSP prioritizing CIS and 365 compliance without inforcer, they're saying it's fine, it's really not fine. Their whole desk and space is up in flames. But, a MSP prioritizing M365 compliance with inforcer keeps the flame within them, keeps the fire within them, and are surrounded by puppies, and they're extremely joyful, and they're saying it's fine, and it really is fine.

So, overall, this is what we kind of wanted to touch on and go over today. I think this episode was extremely important because it's kind of like the foundational framework that again cascades outward to all of the other episodes because it's how you can kind of utilize it within inforcer today. You can use CIS as a foundation to branch out to the other frameworks that we're going to be covering in conjunction to this episode during this series.

I will be covering the NIST episode as well, so I do hope that you either join the live webinar or you watch the YouTube once that is published as well. This is typically the time I would ask for questions, but this is being posted to YouTube, so you can't ask me any questions live, but I do hope this was beneficial. If you are interested in inforcer, getting a demo, talking to our team a little bit more if you're not a current customer, we highly recommend that you reach out to us on our website.

And with that, I hope you have a great day. Thank you so much for watching. And I hope you enjoy the rest of the series.