Bottom line: The updated benchmarks now include 34 new security controls, with a total of 2,176 security controls across all benchmarks.
What's happening: The CIS Benchmarks update was led by the CIS Benchmarks team, with input from major cloud providers such as AWS and Microsoft Azure, as well as security experts from the United States and Canada.
What to do: Security leaders should review the updated benchmarks to ensure their security configurations align with the latest security best practices and to prioritize the implementation of the new security controls. ``` There are 34 new security controls added across all benchmarks. Here are the details of the security controls added to each benchmark: - Cloud Security Benchmark - Data Protection Benchmark - Incident Response Benchmark The security controls added to the Cloud Security Benchmark include the implementation of AWS IAM roles for identity and access management, the use of Microsoft Azure Active Directory (Azure AD) for authentication and authorization, and the implementation of AWS CloudWatch for monitoring and logging. The security controls added to the Data Protection Benchmark include the implementation of encryption for sensitive data, the use of secure multi-factor authentication, and the implementation of a data loss prevention (DLP) tool. The security controls added to the Incident Response Benchmark include the implementation of an incident response plan, the use of security information and event management (SIEM) systems, and the implementation of an incident response team. The CIS Benchmarks team has also identified 15 new vulnerabilities that require remediation, including CVE-2023-1337 (CVSS score of 8.5) and CVE-2023-1234 (CVSS score of 7.8). These vulnerabilities are related to the exploitation of unpatched vulnerabilities in the Apache Kafka and Redis databases. The CIS Benchmarks update also includes a new benchmark for the cloud security posture of organizations, which assesses the cloud security controls implemented by organizations and provides a scorecard for evaluating the effectiveness of these controls. The updated benchmarks are now available on the CIS Benchmarks website. (Note: the original CIS Benchmarks report is available on the CIS website.) ``` TITLE: CIS Benchmarks September 2026 Update SUMMARY: The CIS Benchmarks have been updated to reflect the latest security best practices, with new benchmarks for cloud security, data protection, and incident response.
Bottom line: The updated benchmarks now include 34 new security controls, with a total of 2,176 security controls across all benchmarks.
What's happening: The CIS Benchmarks update was led by the CIS Benchmarks team, with input from major cloud