# Auditing Cloud With Cis Benchmarks

> Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.

- Skill: `owasp/auditing-cloud-with-cis-benchmarks` (Agent Skill)
- Install (CLI): `npx skillmds@latest add owasp/auditing-cloud-with-cis-benchmarks`
- Raw SKILL.md: https://api.skillmd.com/api/skills/owasp/auditing-cloud-with-cis-benchmarks/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: Apache-2.0
- Author: OWASP (https://skillmd.com/u/owasp)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/owasp/auditing-cloud-with-cis-benchmarks

---


# Auditing Cloud with CIS Benchmarks — Azure Focused

## When to Use
- When performing initial security audits of an Azure tenant against industry-standard benchmarks.
- When preparing for SOC 2 or ISO 27001 audits that reference CIS controls.
- When establishing a measurable security baseline for new Azure subscriptions.
- When validating the configuration of Identity, Networking, and Storage against best practices.

## Key Concepts

| Term | Definition |
|------|------------|
| CIS Benchmark | Prescriptive security configuration guidelines developed by the Center for Internet Security |
| Level 1 Profile | Practical security controls implementable without significant performance impact |
| Level 2 Profile | Defense-in-depth controls that may restrict functionality |
| Foundations Benchmark | CIS benchmark specifically for cloud providers covering IAM, Logging, and Networking |

## OpenShield Compliance Rules

OpenShield automates many of the CIS Azure Foundations Benchmark checks:
- **Identity**: `AZ-IDN-001` through `AZ-IDN-009`
- **Networking**: `AZ-NET-001` through `AZ-NET-014`
- **Storage**: `AZ-STOR-001` through `AZ-STOR-005`

## Audit Workflow

### Step 1: Run Automated Assessment
Use OpenShield or native Azure tools like Microsoft Defender for Cloud to run a full CIS scan.

### Step 2: Interpret Results
Prioritize Level 1 controls first as they represent fundamental security hygiene.

### Step 3: Remediate High Impact Controls
Address failed controls like unrestricted RDP/SSH access or missing MFA on admin accounts.

## Remediation Reference
- **Use Azure Policy**: Assign the "CIS Microsoft Azure Foundations Benchmark" policy initiative for continuous auditing.
- **Enable Defender**: Use Microsoft Defender for Cloud for real-time compliance tracking.
- **Automate Fixes**: Use OpenShield playbooks to automatically remediate common CIS failures.