Is the CIS AWS Foundations Benchmark mandatory?

No, it's voluntary. There's no legal requirement to follow it, but it's widely treated as the baseline "did you do the basics right" check, and other frameworks and auditors often expect it as a starting point.

Which CIS version should I actually target?

v5.0.0, since that's the version AWS Security Hub currently supports for automated scoring, and AWS itself recommends it as the current baseline, even though CIS has published newer editions independently.

NEW: The State of AWS Security 2026 - Free WhitepaperFree AWS Security Whitepaper

Toc ConsultingCloud. Secure. Scale.

Free Assessment

Standard

CIS AWS Foundations

CIS Amazon Web Services Foundations Benchmark

Center for Internet Security (CIS), a nonprofit

Why It Exists

AWS's default account settings alone don't guarantee a secure configuration. CIS brings together security practitioners to agree on a prescriptive, vendor-neutral baseline, specific IAM, logging, networking, and monitoring settings, that represent a reasonable security floor for any AWS account.

Who It's For

Any organization running workloads on AWS. It's a configuration hardening baseline, not an industry-specific regulation, so it applies broadly regardless of sector.

Current Status

CIS has published newer versions, but AWS Security Hub's automated compliance checks currently support up to v5.0.0, which AWS recommends as the current baseline for automated scoring.

CIS Amazon Web Services Benchmarks

Frequently Asked Questions

PCI DSS

Other Frameworks

PCI DSS SOC 2 ISO/IEC 27001

KloudSec, built by the team behind Toc Consulting

See CIS AWS Foundations checked automatically, continuously

What you just read is a manual, one-time check. KloudSec runs this and 400+ more automated checks across 90+ AWS services, continuously, agentless, live in about 5 minutes.

Try KloudSec free