CIS Benchmarks are a set of consensus-based security configuration standards published by the Center for Internet Security. Reaching 80%+ CIS compliance on AWS or Azure in 90 days is achievable with a structured approach — we have taken client environments from below 30% to over 80% in exactly that window.
What are CIS Benchmarks?
CIS Benchmarks are detailed, prescriptive configuration guides for securing systems — operating systems, cloud platforms, databases and more. On AWS and Azure they cover identity and access, logging and monitoring, networking, encryption and storage. Because they are consensus-based and vendor-neutral, auditors and frameworks like SOC 2, HIPAA and PCI DSS frequently reference them as the baseline for "reasonable" cloud security.
How to reach 80%+ CIS compliance in 90 days
- Days 1–7: Baseline your posture. Run an automated CIS scan using AWS Security Hub (which has a built-in CIS standard) or a tool like Prowler. You cannot improve what you have not measured — this gives you the real starting percentage and a ranked list of failures.
- Days 8–30: Fix the high-severity findings. Prioritize critical and high-severity items first: root account MFA, over-permissive IAM policies, public S3 buckets, unencrypted volumes, disabled CloudTrail. These carry the most risk and lift your score the fastest.
- Days 30–60: Remediate in domains. Work through the remaining findings by domain — identity, then logging, then networking, then data protection. Grouping the work this way is faster than jumping around and easier to verify.
- Days 60–80: Automate the fixes. Convert manual remediations into infrastructure-as-code (Terraform or CloudFormation) and Service Control Policies. This is what stops the environment from drifting back out of compliance the moment someone launches a new resource.
- Days 80–90: Continuous monitoring + evidence. Turn on continuous CIS monitoring and set up the reporting auditors expect. Now compliance is a live dashboard, not a one-time snapshot.
Why does the first 30 days deliver the biggest jump?
Because a handful of high-severity misconfigurations account for a disproportionate share of failed checks. Enabling MFA, closing public storage, scoping down wildcard IAM policies and turning on CloudTrail across all regions can move a score from the 30s into the 60s on their own. The later work is about closing the long tail and, crucially, keeping the score there.
Real result: We took a client from under 30% to 80%+ CIS benchmark compliance in four months, then handed over continuous monitoring so their posture held instead of decaying after the project ended.
What is a good CIS compliance score?
There is no universal pass mark, but 80%+ is a strong, defensible baseline for most organizations, and the remaining items are usually documented exceptions with compensating controls rather than outright gaps. Chasing 100% is often counterproductive — some CIS recommendations do not fit every architecture, and the effort is better spent on continuous monitoring than on the last few percent.
How do you stop compliance from drifting?
Automation and guardrails. Once fixes are codified as infrastructure-as-code and enforced with Service Control Policies, new resources inherit the compliant baseline by default. Continuous monitoring then alerts you the moment something drifts, so you catch it in hours instead of discovering it at the next audit.
The four domains where CIS failures cluster
Across cloud security assessments, failed CIS checks are not spread evenly, they concentrate in four areas. Fixing these in order is what produces the fast early gains.
Identity and access. This is where the highest-risk findings live and where remediation lifts the score most. Missing MFA on the root and admin accounts, over-permissive IAM policies with wildcards, long-lived access keys, and users with direct policies instead of group membership. Identity is the front door; CIS weights it heavily, and so should you.
Logging and monitoring. CloudTrail not enabled in all regions, no log file validation, CloudWatch alarms missing for critical events, and config recording turned off. These findings are quick to fix, often a few settings, and they are foundational: without logging you cannot detect or investigate anything, so auditors treat gaps here as serious.
Networking. Security groups allowing unrestricted inbound access (0.0.0.0/0) on sensitive ports, default VPCs still in use, no flow logs, and overly open network ACLs. These are common in environments that grew organically and are straightforward to tighten once you can see them.
Data protection. Unencrypted EBS volumes and RDS instances, public S3 buckets, missing encryption in transit, and no key rotation. Encryption-at-rest is often a single setting per resource, and closing public access is high-impact for both compliance and actual security.
CIS compliance and SOC 2, HIPAA and PCI DSS
One reason CIS compliance is worth the effort is leverage: the work you do for CIS satisfies large parts of other frameworks at the same time. SOC 2's security criteria, HIPAA's technical safeguards, and PCI DSS's configuration requirements all overlap heavily with CIS controls, because they are all describing the same fundamentals, least privilege, encryption, logging, access control. Reaching a strong CIS baseline means that when a SOC 2 audit or a HIPAA assessment arrives, most of the technical groundwork is already done and documented. You are not doing four separate compliance projects; you are doing one, with four sets of evidence.
Do you need a tool or a consultant?
For the initial baseline, a tool is enough, AWS Security Hub or Prowler will tell you your score and rank the failures. The value of outside help is in the remediation and, especially, the automation: knowing which findings actually matter for your architecture, fixing them without breaking workloads, and codifying the fixes so they hold. A scan tells you what is wrong; experience tells you the safe order to fix it in and how to make it stick. We run CIS remediation on a fixed-price basis with continuous monitoring handed over at the end, so the score does not quietly decay once the engagement closes.
Frequently asked questions
Is 80% CIS compliance enough for a SOC 2 audit? A strong CIS baseline covers much of SOC 2's technical security criteria, but SOC 2 also assesses policies, processes and monitoring over time. CIS gets the infrastructure right; SOC 2 also wants evidence that you operate it consistently. The two are complementary, not identical.
How much of this can be automated? The detection is fully automated, and most remediation can be codified as infrastructure-as-code so it applies and re-applies automatically. The judgment, which findings are real risks versus documented exceptions for your architecture, is where human expertise still matters.
What if we are on Azure, not AWS? The same approach applies. Azure has its own CIS benchmark and Microsoft Defender for Cloud provides equivalent scanning and scoring. The four domains, identity, logging, networking, data, are the same; only the specific services differ.
Last updated: 1 July 2026 · Written by Momina Farooq, AWS Certified Solutions Architect, Azure AZ-500, Licensed Ethical Hacker.