> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/compliance/cis-m365-foundation-benchmark.md). # CIS M365 Foundation Benchmark The Center for Internet Security (CIS) publishes vendor- and platform-specific "Benchmarks" — consensus-driven configuration baselines built by a community of security practitioners. The **CIS Microsoft 365 Foundations Benchmark** is the one that matters most for Augmentt partners: it's a prescriptive set of recommended tenant-level security settings across Entra ID, Exchange Online, SharePoint/OneDrive, Teams, and Microsoft Purview, organized into numbered sections and controls (for example, "§1.1.1" or "§5.1.3.1"). {% hint style="info" %} CIS groups its recommendations into **Implementation Groups (IG1/IG2/IG3)** by rigor, and marks individual controls **L1** (baseline, broadly applicable) or **L2** (stricter, for higher-risk environments) so you can right-size how aggressively you apply them for a given client. {% endhint %} ## Why it matters for MSPs The CIS M365 Benchmark is one of the most commonly requested baselines in the MSP security space — it's specific enough to be actionable (unlike a broad framework such as NIST CSF), and it maps closely onto the actual M365 admin center settings your technicians are already touching. It's a natural baseline to standardize a client fleet against, and a common reference point in cyber-insurance questionnaires and vCISO engagements. ## How Augmentt maps to the CIS Benchmark Augmentt's security posture checks were built with the CIS M365 Benchmark controls in mind from early on, and that mapping has deepened over time. Historically, individual posture checks and reports referenced specific CIS control numbers directly — for example, MFA and legacy-authentication checks map to the identity-and-access controls in CIS section 1, Defender/Safe Attachments checks map to section 2, sharing and DLP checks map to section 3, and audit-log checks map to section 5. As of the 2026.7.1 release, this mapping is formalized inside **Compliance Audit**: assessing a tenant against the CIS Microsoft 365 v7.0.0 assessment shows you, per posture check, the exact CIS control it satisfies, and a matching out-of-box Posture Template lets you bulk-apply the configurable fixes rather than setting them one at a time. Conceptually, Augmentt helps with the CIS Benchmark in three ways: * **Audit** — Compliance Audit scores a tenant against the CIS controls and shows you where it stands, control by control, with evidence you can hand to a client or auditor. * **Remediate** — for controls Augmentt can configure (MFA enforcement, conditional access policies, sharing restrictions, mailbox auditing, and more), one-click Configure actions apply the CIS-recommended setting directly, without a trip to the Entra, Exchange, or SharePoint admin centers. * **Monitor** — Alerts and drift monitoring flag when a previously-compliant setting has drifted out of line with the baseline, so a one-time audit doesn't silently go stale. {% hint style="warning" %} Augmentt has supported multiple versions of the CIS M365 Benchmark over time (v2.0.0 historically, and CIS Microsoft 365 v7.0.0 as of the 2026.7.1 release). If you're citing a specific control number to a client, confirm which Benchmark version the in-product assessment is currently running against — control numbering has shifted between CIS Benchmark versions. {% endhint %} {% hint style="warning" %} For the full, current list of CIS controls covered, exact section/control numbers, and how to run or customize an assessment or template against a tenant, see [Posture Templates](/modules/secure/security-posture/posture-templates.md) and [Compliance Audit](/modules/secure/security-posture/compliance-audit.md) — this page is deliberately conceptual and was drafted without direct access to the current codebase or in-product control list this cycle. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/compliance/cis-m365-foundation-benchmark.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.