A team reading a CIS benchmark asks how Level 1 and Level 2 profile recommendations differ. Which description is correct?
Select an answer to reveal the explanation.
Short Explanation
Think of Level 1 as locking your doors and windows, which everybody should do with no fuss. Level 2 is adding bars and an alarm: stronger, but it can get in the way of daily life. The traps sort the levels by device type, location or audit method, and that's not what they mean.
Full Explanation
CIS benchmarks group recommendations into profiles. Level 1 items are intended to be practical and prudent: they provide a clear security benefit and should not significantly hinder the intended use of the technology, so they form a reasonable baseline for most organizations. Level 2 items are intended for environments where security is paramount; they act as defense in depth and may reduce functionality or affect performance, so they require more planning and testing before adoption. Level 2 typically includes the Level 1 recommendations plus additional ones. Profiles are not defined by where a device sits in the network; a benchmark's levels apply to the platform it covers, whether at the edge or inside. Whether a recommendation can be checked by a tool is a separate attribute, labeled automated or manual, and either label can appear at either level. Levels are also not split by device type; each benchmark covers one technology, and both levels exist within it. Exam caveat: some benchmarks define additional profiles, but the Level 1 versus Level 2 distinction is about security benefit versus operational impact. Operational check: choose the profile per device role, test Level 2 items in a lab before production, and record which profile each device is assessed against.