CIS Benchmark vs Microsoft Secure Score

Two numbers, two different questions

You're staring at two pieces of information about the same tenant. Microsoft Secure Score says 68%. The renewal questionnaire from the cyber insurance broker asks whether you're aligned to the CIS Microsoft 365 Foundations Benchmark. They sound like they ought to answer the same question. They don't.

Secure Score answers: are you doing the things Microsoft thinks you should be doing inside this tenant, weighted by Microsoft's view of impact? CIS answers: does each of about 70 specific controls match the value the security community has agreed it should be set to, regardless of who runs the platform?

Different questions produce different answers. A tenant can score well on one and fail the other. Knowing which one to point at, and when, is the difference between an admin who's gaming a number and an admin who can defend the configuration to an outside party.

What Microsoft Secure Score is and how it gets calculated

Secure Score lives in the Microsoft 365 Defender portal under Exposure management → Secure score. It scans the tenant configuration, compares each setting to a list of Microsoft-curated recommendations, and returns a number between 0 and 100. Each recommendation is worth a fixed point value. Implementing it adds points. Reverting removes them.

The recommendations are grouped by area: Identity, Devices, Apps, and Data. Each one has a description, a points value, an "implemented" or "not implemented" status, and a link that either deep-links into the right admin blade or surfaces a PowerShell snippet to apply the change.

A few things make Secure Score easy to misread:

• The denominator moves. Your maximum achievable score depends on your license tier. A Business Premium tenant can't reach 100 because the score includes recommendations that require E5, Defender for Endpoint, or Intune Suite. The percentage is always relative to "the recommendations that apply to your licenses."
• Microsoft sets the weights. Some high-impact controls are worth a handful of points. Some lower-impact toggles are worth more. The weighting is opinion, not external standard.
• The list changes. Microsoft adds, removes, and re-weights recommendations on its own schedule. A score you reported in January isn't directly comparable to the same configuration in June.
• It updates on a delay. Most changes show up in 24 to 48 hours. Some take longer. A flipped setting doesn't move the score immediately.

None of that is bad. Secure Score is free, automatic, and reasonably current. It's a fine operational dashboard. It is not, and was never built to be, a compliance attestation.

What the CIS Microsoft 365 Foundations Benchmark actually is

The Center for Internet Security (CIS) is an independent nonprofit. Its Microsoft 365 Foundations Benchmark is a consensus document maintained by working groups of practitioners from across the industry. The current edition runs roughly 200 pages and lists around 70 specific controls, each with a stated rationale, the exact setting to inspect, the value it should be set to, and the audit procedure to verify it.

Controls are organized into Implementation Groups. IG1 is the basic baseline appropriate for most small and mid-sized businesses. IG2 adds controls suitable for organizations with sensitive data and more capacity to operate them. IG3 is for organizations with formal security programs and dedicated staff. Most SMBs target IG1 and pick up specific IG2 controls where the risk warrants it.

There is no score. There is no percentage. Each control is either configured to the benchmark value or it isn't. The output of an assessment is a list: pass, fail, or not applicable, with notes. That binary output is exactly what insurance underwriters, SOC 2 auditors, and vendor risk reviewers want to see.

CIS is the language those external parties have agreed to read. When a renewal questionnaire asks "is your M365 tenant configured to an industry-recognized hardening standard," CIS is the standard they're referencing nine times out of ten. Detailed control-by-control walkthrough is in the CIS M365 benchmark checklist for small business, and the actual implementation walkthrough is in how to implement the CIS M365 benchmark in a small business.

The fundamental difference: direction vs destination

Secure Score gives you a single number that goes up when you implement Microsoft-approved best practices. It tells you whether you're moving the tenant in a healthier direction. CIS gives you a per-control attestation framework that maps to industry, insurance, and audit requirements. It tells you whether you've reached the destination an external party will accept.

Direction and destination aren't the same thing. You can be heading in the right direction (Secure Score climbing month over month) and still be miles short of the destination (multiple CIS controls failing). You can also pass CIS IG1 cleanly and have a Secure Score in the 60s, because Secure Score is also rewarding you for E5-only features your license doesn't include.

Treating Secure Score as compliance-by-proxy is the most common mistake we see. The number feels official. It comes from Microsoft. Of course it must mean something to outsiders. It doesn't, not in the way the team usually assumes.

Side-by-side: what each system covers in practice

Here's how the two stack up across the major control areas. "Strong" means the control is well-covered with appropriate weight. "Partial" means the control is touched but under-weighted, only checked at a surface level, or missing pieces. "Gap" means the control isn't reflected at all.

The pattern: Secure Score is great at "is the feature on?" CIS is specific about "is the feature configured to the right value?" Same controls, different bar.

The honest tradeoffs of each approach

Both systems are useful. Both have real downsides. Pretending otherwise produces bad operational decisions.

What Secure Score is good at

• It's free. Included with every M365 SKU. No add-on cost, no separate tooling.
• It updates automatically. No manual assessment cycle, no spreadsheet to maintain.
• It surfaces a prioritized to-do list. The "improvement actions" view ranks recommendations by points-per-effort, which is a reasonable default for an admin who has 30 minutes a week.
• The gamification works. Watching a number climb keeps internal teams engaged in a way that "completed control 1.1.6" doesn't. Scores motivate.
• It's a useful drift detector. Running 78%, suddenly drops to 65%? Something material changed in the configuration. That signal alone justifies checking the dashboard monthly.

Where Secure Score falls short

• It doesn't map cleanly to insurance questionnaires. Underwriters ask about specific controls, not aggregate scores.
• It doesn't prove anything to an external auditor. A SOC 2 auditor needs evidence each control is configured to a defined value. "We're at 78%" isn't evidence.
• It can incentivize box-ticking. Admins implement recommendations for points without thinking about whether the control fits the business. Worse, easy points get picked first, leaving high-impact-low-points controls unimplemented.
• The score depends on licensing. Two tenants with identical risk postures can have wildly different scores because one bought E5 and one bought Business Premium.
• The recommendations move. A score reported last quarter doesn't mean the same thing this quarter.

What CIS is good at

• It maps to insurance, audit, and vendor-risk requirements. Underwriters and auditors recognize CIS by name. Mapping to NIST CSF, SOC 2, and ISO 27001 already exists.
• It's prescriptive. Each control has a defined value. There's no ambiguity about whether a setting "counts."
• It's externally validated. Consensus document, independent maintenance, public review process.
• It's defensible. When an incident happens and the question is "what was the control standard you were operating to," CIS is a credible answer.

Where CIS falls short

• Assessment is manual or paid. You can run through it by hand, hire someone, or use tooling like CIS-CAT Pro or Microsoft 365 DSC. None of those is free and zero-effort.
• It doesn't update automatically. Microsoft adds features quarterly. The benchmark gets updated on its own cycle, which lags. New M365 features sometimes aren't reflected for a year.
• It requires interpretation. Some controls don't translate cleanly to a smaller business with no Intune licensing or no on-premises hybrid setup. Treating "not applicable" responsibly takes judgement.
• It's not gamified. No score, no progress bar, nothing that pulls casual attention. The value is structural and the audience is mostly external.

Neither system is wrong. They're built for different consumers. Once that lands, the question of "which one should I use?" answers itself: both, in different roles.

The "we have a 78% Secure Score" trap

A number we hear a lot from SMB IT leads on the renewal call: "We're at 78% Secure Score, we're in good shape." Sometimes the broker nods politely and moves on. Increasingly, the broker asks a follow-up. "Great, can you confirm audit logs are retained for at least a year? Are user consent grants restricted to admin-approved apps? Are global admin accounts separated from daily user accounts?"

That's where the trap closes. Those follow-up questions are the 22% the Secure Score didn't cover, and they're often the controls cyber insurance specifically requires. A high Secure Score with weak audit retention, weak OAuth governance, and no admin separation is a tenant that will lose underwriting coverage even though the dashboard looks healthy.

The math gets worse on the day of an incident. If a breach gets investigated and the audit logs only go back 90 days, the forensics team can't reconstruct the attacker's earlier movements. The carrier's incident response retainer notes that gap. The post-incident report references it. The next renewal lands harder than the last.

High Secure Score plus failed CIS attestation is a real and common state. It's the natural endpoint of optimizing for the easy-to-see number instead of the hard-to-see standard. It's also reversible in a few weeks of focused work. Full breakdown of what to do first is in the M365 security checklist for 2026.

The recommended approach for SMBs: use both, in different roles

Operational dashboard plus annual attestation is the workable model for an SMB without a dedicated security team. Each tool gets a defined role. Neither one is asked to do the other one's job.

Use Secure Score for

• Drift detection. Check it monthly. A sudden drop means an admin or third party changed something material. Investigate.
• Team motivation and visibility. A score everyone can see makes security feel concrete instead of abstract.
• Prioritizing the next control to implement. The "improvement actions" list is a reasonable default queue.
• Spotting Microsoft-introduced new features. When Microsoft ships a new recommendation, the score notices before the benchmark does.

Use CIS for

• Annual attestation. Once a year, walk the IG1 controls, document pass / fail / not-applicable for each, file the result.
• Insurance questionnaire evidence. Map carrier questions to CIS control IDs and reference the assessment.
• Vendor risk responses. When a customer or partner asks how M365 is hardened, the answer is a CIS-aligned baseline plus the most recent assessment.
• SOC 2 readiness. CIS controls map cleanly to common SOC 2 control objectives in the security trust criterion.

Cadence: Secure Score is monthly, CIS is annual with quarterly spot-checks. The two together produce both the "are we drifting?" signal and the "can we defend the configuration?" answer.

A small PowerShell helper: export Secure Score history

The Secure Score blade in the portal shows a 90-day rolling chart, which isn't long enough for trend analysis or quarterly reporting. The Microsoft Graph beta endpoint exposes the underlying control profile and history. This snippet pulls the last 12 months and writes a CSV you can chart, share with leadership, or compare against the dates of major changes.

Connect-MgGraph -Scopes "SecurityEvents.Read.All"

# Pull the last 365 days of secure score snapshots
$scores = Get-MgBetaSecuritySecureScore -Top 365 |
  Sort-Object CreatedDateTime |
  Select-Object @{N='Date';E={$_.CreatedDateTime.ToString("yyyy-MM-dd")}},
                @{N='Score';E={$_.CurrentScore}},
                @{N='MaxScore';E={$_.MaxScore}},
                @{N='Percent';E={[math]::Round(($_.CurrentScore/$_.MaxScore)*100,1)}},
                @{N='LicensedUserCount';E={$_.LicensedUserCount}},
                @{N='ActiveUserCount';E={$_.ActiveUserCount}}

$scores | Export-Csv "secure-score-history-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# Quick summary in the console
$scores | Select-Object -First 1
$scores | Select-Object -Last 1
$delta = ($scores[-1].Percent) - ($scores[0].Percent)
Write-Host "12-month change: $delta percentage points"

Run it quarterly. A score that's flat or declining despite ongoing project work usually means new admin recommendations are being added faster than your team is implementing them. That's a useful signal too. For broader monthly tenant maintenance, the cadence ties into the M365 security checklist.

What happens when the audit doesn't go well

Failing a CIS-aligned audit usually isn't catastrophic on day one. It's a list of findings, a remediation deadline, and a follow-up review. The cost shows up over time: insurance premiums climb, customer questionnaires take longer to clear, sales cycles stall on security review.

The realistic timeline of what a failed CIS audit costs an SMB, from immediate findings through renewal-cycle effects, is in what happens when a CIS M365 audit fails. Worth reading once before you book the assessment, not after.

Common questions

If we hit 90% Secure Score, are we CIS-compliant?

No, and the gap is structural rather than something you can close by adding a few more recommendations. Secure Score doesn't directly check audit log retention beyond the default, doesn't fully enforce OAuth admin-approval workflows, doesn't require named admin separation, and doesn't validate exact policy values for anti-phishing and external sharing the way the benchmark does. A 90% Secure Score tenant can still fail four to six CIS controls. Run an actual CIS assessment once a year. Don't infer one from the dashboard.

Which one do cyber insurance carriers actually look at?

CIS, almost always, and increasingly by name. The questions on a renewal questionnaire ("is MFA enforced for all users without exception?", "how long are audit logs retained?", "are global admin accounts separated from daily-driver accounts?") are CIS-shaped questions. Some carriers ask for a Secure Score number as a sanity check, but the underwriting decision is made on the specific-control answers, not the aggregate score.

How long does a first CIS assessment take?

For a tenant under 100 seats with no prior baseline work, plan on three to five working days of focused effort to walk all of IG1: a half-day per control area, plus documentation. Tooling like CIS-CAT Pro or Microsoft 365 DSC can cut the inspection time but doesn't eliminate the judgement calls (which controls are not applicable, which exceptions are documented, what compensating control covers what). Subsequent annual assessments usually run a day or two if the baseline is being maintained.

Should we still bother with Secure Score if we're committed to CIS?

Yes. Secure Score is a useful drift detector and a free monthly health check. It catches changes between annual CIS assessments. It also surfaces new Microsoft recommendations as they ship, which the benchmark won't reflect until the next CIS update cycle. The two tools work better together than either does alone. The mistake is using one in place of the other, not using both.

We're a 25-person business. Is CIS overkill for us?

CIS Implementation Group 1 was designed for organizations of exactly your size. The control list isn't enterprise-grade complexity, it's the basic hygiene any business handling customer data is expected to demonstrate. If anything, smaller businesses benefit more from CIS because the controls double as a written security program, which insurance carriers and customers ask about regardless of headcount.