Lab 3 of 17 · By Michael Stout
In this lab
Read the steps, then try them in your lab environment.
Harden a host against a CIS Benchmark
Chapter 2 names system hardening as reducing the attack surface while keeping required function intact — “usually starting from a CIS benchmark.” This lab gets the actual document, gets the free tool that scores you against it, and has you fix what it finds.
A benchmark turns “harden it” into a checklist
“Harden this server” is not an instruction you can act on directly. A CIS Benchmark is: hundreds of specific, numbered settings for a given OS, each with a rationale, a recommended state, and the exact steps to get there. CIS-CAT Lite reads your system and tells you which of those settings you already meet. That turns a vague goal into a punch list.
Most CIS Benchmarks ship two profiles. Level 1 is safe to apply broadly with minimal functional impact. Level 2 is stricter and can break things — it's meant for high-security environments, not applied blindly.
What you'll need
A personal Windows 10 or 11 PC, or a disposable VM. Do not run CIS-CAT against a production or shared machine on your first pass.
A CIS SecureSuite account (free, sign-up required) to download CIS-CAT Lite from learn.cisecurity.org/cis-cat-lite.
CIS-CAT Lite runs on Java. The installer will prompt you if a compatible runtime isn't already present.
30–45 minutes, most of it reading the report rather than running the scan.
Download the document
- Pick your technology. Go to
cisecurity.org/cis-benchmarksand select your operating system — Windows 11 or Windows 10 is the easiest choice if you're using a personal machine. - Download the benchmark. Click through to the current version and select Download the Benchmark. It's a free PDF; a lightweight sign-up may be required.
- Skim the structure before you scan. Each recommendation follows the same shape: a rationale, the current/recommended state, and step-by-step remediation — usually via Group Policy or the Registry, the same places Chapter 2 points you for hardening.
Get a score, not just a document
- Get CIS-CAT Lite. Register at
learn.cisecurity.org/cis-cat-lite(free) and download it for Windows. - Run it against your test machine. Launch CIS-CAT Lite, select the benchmark matching your OS and the Level 1 profile, and start the assessment. It reads your local configuration — it does not change anything.
- Read the report. CIS-CAT Lite produces a pass/fail count and a compliance score. Open the HTML report and sort by failed items.
- Remediate one finding by hand. Pick a single failed, low-risk item (a password policy setting is a safe first pick — the same
secpol.msc/ Group Policy path Chapter 1's registry lab used), apply the documented fix, and re-run to confirm it now passes.
Some Level 1 recommendations still change behavior — a stricter password policy or disabled service can break something you rely on. Never run your first pass against a production or shared system.
100% compliance on a benchmark you don't understand is worse than 80% you can explain. For each failed item, read the rationale before you fix it.
Sources. Center for Internet Security, CIS Benchmarks, cisecurity.org/cis-benchmarks. CIS-CAT Lite, learn.cisecurity.org/cis-cat-lite. Benchmark versions and CIS-CAT's sign-up flow are current as of September 2026 and are revised regularly — re-check before teaching this lab live.