CIS Benchmark for Windows 11: how to harden without breaking users

What is the CIS Benchmark for Windows 11?

The CIS Benchmark for Windows 11 is a free, consensus-built configuration guide from the Center for Internet Security (CIS) that lists specific Windows settings, the recommended value for each and how to audit it. CIS publishes several Windows 11 editions of the guide. The Windows 11 Enterprise Benchmark reached v5.1.0 in the September 2026 update. CIS also maintains a Windows 11 Stand-alone Benchmark (v5.0.0) for machines that are not centrally managed, and an Intune for Windows 11 Benchmark (v5.0.0) for cloud-managed devices.

Version 5.1.0 of the Enterprise Benchmark removed all Microsoft Defender Antivirus recommendations because Defender now has its own CIS Benchmark. If your baseline was built from an older version, those settings now live in a separate document.

How do the Benchmarks relate to the CIS Controls?

The CIS Controls describe what a security program should do. The Benchmarks describe how to configure a specific product to do it. They meet in Control 4, Secure Configuration of Enterprise Assets and Software.

Safeguard 4.1 is part of Implementation Group 1, so it applies to the smallest firms. It requires a documented secure configuration process for enterprise assets and software, reviewed annually or when significant changes occur. CIS's guidance for 4.1 says that documentation should include "any enterprise-approved deviations from industry-standard baselines such as CIS benchmarks."

That phrase is the key to hardening without breaking users. CIS expects some settings to be turned off for business reasons, and it expects each of those decisions to be written down. Our overview of the 56 IG1 safeguards shows where Control 4 fits in the starting set.

Why does a hardened Windows baseline matter to a regulated firm?

Most rules require reasonable safeguards without naming the settings, and a documented baseline is how a firm shows what its safeguards are. California Civil Code section 1798.81.5 requires businesses that hold Californians' personal information to maintain reasonable security procedures and practices. When the California Attorney General released the 2016 California Data Breach Report, the office recommended adopting the CIS Critical Security Controls as the start of a comprehensive information security program and said that not doing so would be indicative of a failure to provide reasonable security.

Federal safeguards rules work the same way. Regulation S-P for SEC-registered advisers and broker-dealers, the FTC Safeguards Rule for tax preparers and other non-bank financial firms, and the HIPAA Security Rule all require safeguards without prescribing Windows settings. A Benchmark-based baseline with recorded exceptions turns "our laptops are locked down" into evidence an examiner or auditor can read.

What is the difference between CIS Level 1 and Level 2?

CIS Level 1 is the baseline most firms can deploy on every device, and Level 2 is for systems where the firm accepts more friction in exchange for more protection. The CIS Benchmarks FAQ describes the Level 1 profile as "a base recommendation that can be implemented fairly promptly" and the Level 2 profile as "defense in depth," intended "for environments where security is paramount."

For a professional services firm of 10 to 200 people, a sensible pattern is Level 1 across the fleet and Level 2 applied selectively: on administrator workstations, on machines that hold the most sensitive client data, or setting by setting where testing shows no impact.

Which CIS Benchmark settings are most likely to break applications?

The settings most likely to break something are the ones that change how people sign in, share files, print and run older software. Plan testing around these areas:

• Legacy authentication and older network protocols that line-of-business applications, scanners or storage devices still depend on.
• Removal of local administrator rights, which surfaces every application that quietly needed them.
• Office macro and add-in restrictions, which can affect templates and plug-ins staff use every day.
• Screen lock, session timeout and remote desktop limits, which users notice immediately.
• Restrictions on removable media and on remote support tools that vendors use.
• Firewall and remote access rules that a VPN client or practice management application relies on.

CIS's own advice is to apply Benchmark guidance "in a test environment first to determine potential impact." The rest of a good rollout follows from that sentence.

How do you roll out the CIS Benchmark without disrupting the office?

Roll it out in stages, and write a documented exception for anything you decide not to apply. A practical sequence:

• Inventory first. You cannot baseline devices you do not know about, which is why Controls 1 and 2 come before Control 4.
• Pick the Benchmark that matches how devices are managed: Intune for Windows 11 for cloud-managed fleets, Enterprise for domain-joined machines managed with Group Policy. CIS Build Kits package recommendations as Group Policy objects.
• Measure before changing anything. Run an assessment to see how far current devices are from Level 1.
• Pilot with IT and a few willing users from each role, through at least one full business cycle, including a month-end close or a filing deadline if you have one.
• Expand in rings: one team, then one office, then everyone.
• Record every deviation with the setting, the reason, any compensating control, the approver and a review date. Safeguard 4.1 asks for exactly this.
• Re-baseline when CIS releases a new version or Windows ships a major feature update, and at least once a year.

What should your firm do this quarter?

• Identify which Windows 11 Benchmark fits your management model and download the current version.
• Run a baseline assessment and record where your fleet stands against Level 1 today.
• Choose a pilot group that covers every role and every line-of-business application.
• Start an exceptions register before the first change ships.
• Update your secure configuration documentation, and any written security policy your regulator expects, to reference the baseline and its version.
• Put the annual review on the calendar.

How can s90 help?

s90 builds and maintains Windows 11 baselines from the CIS Benchmarks for professional services firms, pilots them with your staff, and keeps the exception register and evidence current. If you want to know how far your devices are from Level 1 today, we can start with an assessment.