CM.2.002 — Establish and Enforce Security Configuration Settings

What CM.2.002 means in plain English

It is not enough to list your configurations—you have to actually apply secure settings and enforce them. The CIS Benchmarks (free downloads from cisecurity.org) give you a specific, prescriptive list of settings for Windows 10/11, Windows Server, and Microsoft 365. Apply these settings via Group Policy and document which benchmarks you used. For a machine shop, the most critical settings are: auto-lock screen after inactivity, require password complexity, disable USB autorun, enable Windows Defender, and require BitLocker on laptops.

The assessment question

“Have security configuration settings been applied to all systems based on an industry-recognized security benchmark (e.g., CIS Benchmarks or DISA STIGs), with documentation of which benchmark was used and evidence of the settings being enforced?”

How to implement CM.2.002

1. Download the free CIS Benchmark for Windows 10 or Windows 11 from cisecurity.org/cis-benchmarks. Also download the CIS Microsoft 365 Foundations Benchmark if you use M365. These are detailed PDFs listing every recommended security setting.
2. Work through the "Level 1" recommendations (the minimum baseline). Use Group Policy to apply settings: Computer Configuration > Windows Settings > Security Settings. Key settings to prioritize: password minimum length 14 characters, account lockout after 5 attempts, screen lock after 15 minutes, Windows Defender enabled and updated, Windows Firewall enabled for all profiles, USB autorun disabled.
3. For Microsoft 365, use the Microsoft Secure Score dashboard (security.microsoft.com) as your benchmark enforcement tool. It shows your current score, what you have not configured, and provides one-click remediation for many settings.
4. Document which benchmark you used, the date applied, and who applied it. Create a "Configuration Benchmark Compliance Checklist" by copying the CIS Level 1 items relevant to your systems and marking each as Compliant / Non-Compliant / Compensating Control.
5. Run the free CIS-CAT Lite tool (available at cisecurity.org/cybersecurity-tools/cis-cat-lite) against your workstations to generate an automated compliance report against the CIS Benchmark. This is excellent assessment evidence.

Evidence your assessor will ask for

• Identification of the security benchmark used (e.g., CIS Windows 11 Benchmark Level 1, version and date)
• Configuration benchmark compliance checklist showing each control item as compliant or non-compliant with justification
• Group Policy settings export or screenshot demonstrating key settings are enforced
• CIS-CAT Lite report or Microsoft Secure Score screenshot showing benchmark compliance percentage
• Documentation of any deviations from the benchmark with compensating controls described

More Configuration Management controls