Create a CIS compliance report for Intune (PDF or CSV for auditors)

What should a CIS compliance report include?

An auditor asking for a CIS compliance report may need several kinds of evidence: the target benchmark, configuration results, device checks and accepted exceptions. Agree those deliverables before sending a score. State the tenant, the assessment date and the Level so the reader can tell which question the evidence answers.

Keep manual checks with the report. A recommendation outside the assessed scope does not become compliant because it is absent from the findings table. Record who checked it, what evidence they used and when the check should be repeated. Keep device evidence distinct from policy configuration results.

Can Intune policy reports prove CIS compliance?

Intune provides policy configuration and deployment reporting. An admin can collect that evidence, compare it with the chosen CIS recommendations and maintain a separate assessment record. Preserve the mapping and the reasons for exceptions so another reviewer can follow the decision later.

Microsoft security baselines do not provide a one-to-one CIS mapping. A deployment status report alone therefore does not answer which CIS recommendations were assessed, which matched or which were outside scope. You need the benchmark comparison and any manual evidence alongside the native policy reports.

• Microsoft security baseline scope
• CIS assessment with Intune

1. How do I run a CIS assessment for an audit?

Select the tenant, open CIS Benchmarks and load the benchmark and Level required for the review. Check the certification label before starting. CIS assessment and exports are available in Pro and MSP. The documented certified Windows 11 scope is Level 1; use the actual label and scope shown for your selection.

Click Start assessment. Review the readiness figures and coverage together. The results distinguish Manual, Not assessed and Not covered recommendations. Include those unresolved checks in your evidence plan. If you record exclusions, keep their owner, reason and expiry date and show the raw result as well as the adjusted rate.

• Plans and features
• Document Intune configuration for an audit

2. Should I export CIS results as PDF, CSV or JSON?

Open Export in the results header and choose PDF report. The PDF includes readiness per Level, recommendation results, Manual, Not assessed and Not covered recommendations, exceptions and remediation indications. Use it as the readable assessment record, with a separate note describing the audit scope and any device evidence attached.

Choose Findings CSV or Findings JSON when the reviewer needs one row per pack setting. Those files include the result, observed tenant policies, assignment evidence and remediation indication. The CSV begins with disclosure rows, then an empty row, then the table. Preserve those disclosures when importing it into a workbook.

Choose Readiness CSV or Readiness JSON for Level figures and recommendation results, including the manual and unassessed work. These serve a different purpose from the settings-level findings export. Send the format that answers the request, and label both clearly if the reviewer needs both views.

3. How do I preserve the assessment date and limits?

Exports are built on your device from the saved assessment without reading the tenant again. Exporting today does not make yesterday's assessment current. Run again if the auditor needs current configuration, then export the new result. Keep earlier files with their assessment dates rather than replacing them silently.

Every CIS export carries the certified scope, remediation limits and the CIS notice. Keep those statements attached when sharing the evidence. The certification belongs to TenuVault within its specified scope. It does not certify the tenant, and a configuration match does not prove assignment to the intended devices or enforcement.

Finish the handoff with a short list of open checks and accepted exceptions. Give each remaining action an owner and a due date. After remediation, rerun the assessment and retain both results if the auditor needs to see how findings were resolved. This makes the report a traceable record rather than an isolated percentage.

• Track configuration drift after an assessment