# CIS Level 1 vs Level 2 for Intune | TenuVault Compare CIS Level 1 vs Level 2 for Intune. Choose a profile, assess readiness per Level and review coverage, pilot impact and exceptions before rollout. Canonical: https://www.tenuvault.com/guides/cis-level-1-vs-level-2 Practical guide # CIS Level 1 vs Level 2 for Intune: which should I use? For CIS Level 1 vs Level 2 in Intune, start with Level 1 unless your security requirements justify tighter restrictions. Choose Level 2 after testing its impact against the requirements of the specific benchmark. Begin with a documented Level 1 assessment, known gaps and a pilot plan. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## How do I choose CIS Level 1 vs Level 2? An admin needs a baseline that survives normal work: signing in, using business applications and supporting remote devices. Agree the target with security and service owners before changing policy. Record which devices are in scope, what requirement drives the choice and who can accept an exception. CIS describes Level 1 as a base profile intended to preserve usability. Level 2 adds defense in depth for environments where security takes priority and needs particular care during implementation. Test either profile first. A Level 1 label does not remove the need to check application compatibility. - [CIS profile definitions](https://www.cisecurity.org/cis-benchmarks/cis-benchmarks-faq) ## Can Intune security baselines meet CIS requirements? Intune Settings Catalog lets you configure settings in a policy and assign that policy to a group. You can work through the selected CIS profile, record the expected values and test the resulting policies with a pilot group. Keep the benchmark and profile attached to your change record. Microsoft security baselines offer another starting point for Windows configuration. They are not a declaration of CIS compliance: Microsoft says there is no one-to-one mapping. Neither choosing a Microsoft baseline nor naming a policy Level 2 establishes that you meet the corresponding CIS recommendations. - [Microsoft security baseline scope](https://learn.microsoft.com/en-us/intune/device-security/security-baselines/overview) ## 1\. How do I load a CIS benchmark Level in TenuVault? Select your tenant and open CIS Benchmarks. Under Load benchmark, inspect the available packs and their Levels. Choose the Level you intend to assess. Loading a pack does not change tenant configuration. CIS assessment, remediation and reports require Pro or MSP, as listed on the pricing page. Keep availability and certification separate. The documented certified Windows 11 scope is Level 1. Do not assume Windows 11 Level 2 is delivered or certified because another benchmark offers both Levels. Read the CIS Certified or Not certified label beside the selected Level before describing its scope to anyone. - [Plans and features](https://www.tenuvault.com/pricing) - [How CIS Benchmarks fit with Intune](https://www.tenuvault.com/guides/cis-benchmarks-with-intune) ## 2\. How do I read CIS readiness and coverage? Click Start assessment. The read-only comparison checks Settings Catalog configuration against the loaded pack. Review readiness per Level and the coverage statement together. A high pass rate is less useful without knowing which recommendations were checked and which need separate evidence. Read Manual, Not assessed and Not covered recommendations before deciding the work is small. Review alternative values against the profile you selected. Where you accept a deviation, Exclude from score records an owner, reason and expiry date. Keep the raw rate alongside the rate with exclusions so the exception remains visible. ## 3\. When should I expand beyond the pilot? For Level 1, agree which gaps must close before a wider assignment and which exceptions need approval. If Level 2 is required, review its additional restrictions separately with the teams whose work they affect. Keep a test checklist for business applications, remote support and recovery access. Use configuration readiness as one input to that decision. It does not establish that the right devices received or enforced a setting. Confirm assignment and device results separately, document manual checks and set a review date. Reassess after the approved changes so the decision rests on current configuration. - [Choose Windows settings for a maintained baseline](https://www.tenuvault.com/guides/best-intune-settings-windows) - [Back up Intune policies before changing a baseline](https://www.tenuvault.com/intune-backup) ## Read the technical guides - [CIS Benchmarks workflow and limits](https://docs.tenuvault.com/baselines/cis-benchmarks/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Is Level 2 always the better starting point? A: No. Choose it when the required security posture and tested operational impact justify it. Start with Level 1 when you need a broadly usable base, then review additional restrictions deliberately. ### Q: Does a readiness score certify my tenant? A: No. TenuVault compares recorded configuration with a benchmark pack. Certification belongs to the product within its stated scope, and the result does not replace device checks or manual assessment. ### Q: Can I assess Windows 11 Level 2 with TenuVault? A: Do not assume it is available. Check the delivered benchmark picker and its Level labels. The documented certified Windows 11 scope is Level 1; availability and certification must be checked separately. ## Related guides - [deploy OpenIntuneBaseline](https://www.tenuvault.com/openintunebaseline) - [CIS macOS Intune assessment](https://www.tenuvault.com/guides/cis-macos-intune-assessment) - [How to clean up unused and unassigned Intune policies](https://www.tenuvault.com/guides/clean-up-intune-policies) - [How to compare Intune configuration with security frameworks](https://www.tenuvault.com/guides/compare-intune-with-security-frameworks) ## Try it on your tenant Download TenuVault, select your tenant and open CIS Benchmarks. Check the current plans, then run a read-only assessment on an eligible tenant before planning any changes. Keep the result as your starting point. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing)