CIS-CAT Pro Assessor

Spec sheet

What it does

CIS-CAT Pro Assessor scans local and remote systems against CIS Benchmark configuration recommendations and reports compliance.Read 15 Oct 2026 · cisecurity.org

Purpose

CIS-CAT Pro Assessor scans systems and reports their compliance with CIS Benchmarks.Read 2 Oct 2026 · cisecurity.org

API

CIS publishes a SecureSuite Member API with token-authenticated endpoints to list bundles and download the latest or a specified assessor ZIP.Read 15 Oct 2026 · ssapi.docs.cisecurity.org

Support

CIS SecureSuite membership includes technical product support, and the product page says dedicated Member Success Managers and enhanced technical support are available.Read 2 Oct 2026 · cisecurity.org

Headquarters

East Greenbush, New York, United StatesRead 28 Sep 2026 · cisecurity.org

Founded

2000Read 28 Sep 2026 · cisecurity.org

Maker

The Center for Internet Security, Inc. describes itself as a 501(c)(3) nonprofit organization.Read 2 Oct 2026 · cisecurity.org

Alternative assessment

CIS-CAT Lite is a free assessment tool with unlimited scans against select technologies.Read 2 Oct 2026 · cisecurity.org

API example

The API documentation shows GET endpoints for listing available CIS-CAT bundles and downloading versions by operating system, Java and GUI options.Read 15 Oct 2026 · ssapi.docs.cisecurity.org

Benchmark coverage

The assessor uses automated content based on more than 100 globally recognized CIS Benchmarks.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Benchmark customization

Users can tailor CIS Benchmarks in CIS WorkBench, export them as automated content, and assess against them.Read 2 Oct 2026 · cisecurity.org

Change: October 2026

Version 4.67.0 was released on October 5, 2026 with new benchmark coverage and a Kubernetes probe security hardening change.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

CIS Controls mapping

Reports map assessment findings to the CIS Critical Security Controls and their Implementation Groups.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Command line

The product provides a command-line interface alongside the graphical interface.Read 15 Oct 2026 · github.com

Company founding

CIS was founded in 2000.Read 15 Oct 2026 · linkedin.com

Company headquarters

CIS lists its headquarters in East Greenbush, New York.Read 15 Oct 2026 · linkedin.com

Company legal name

Crunchbase lists the legal name as Center for Internet Security, Inc.Read 15 Oct 2026 · crunchbase.com

Company size

LinkedIn lists CIS in the 501–1,000 employee range.Read 15 Oct 2026 · linkedin.com

Company type

CIS is described as a U.S. 501(c)(3) nonprofit organization.Read 15 Oct 2026 · crunchbase.com

Configuration comparison

The tool automatically compares target settings with the recommended settings in the selected CIS Benchmark.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Custom benchmarks

Members can customize CIS Benchmarks in CIS WorkBench and export the resulting content for automated assessments.Read 15 Oct 2026 · cisecurity.org

Dashboard integration

The assessor integrates with CIS-CAT Pro Dashboard and the CIS SecureSuite Platform for historical compliance views and dynamic reporting.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

G2 review volume

G2 lists 28 reviews for Center for Internet Security products, including CIS benchmark products and CIS-CAT-related feedback.Read 15 Oct 2026 · g2.com

GUI availability

The graphical interface is available on Windows and Mac, and it must run from a local drive.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Independent review

NutterTools describes CIS-CAT Pro as a desktop assessment application for measuring systems against CIS Benchmarks and producing compliance evidence.Read 15 Oct 2026 · best-tools-for.nuttertools.dev

Intended audience

End User membership is for organizations securing their internal systems and does not permit client or commercial use of membership resources.Read 2 Oct 2026 · cisecurity.org

License access

Full Pro functionality and content require a CIS SecureSuite license, while an invalid or absent license limits the installation to CIS-CAT Lite behavior.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

License model

The assessor is distributed as a proprietary member download; the official pages describe embedded third-party open-source and commercial components but do not publish the assessor source under an open-source license.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Limit: paid coverage

The NutterTools review says the full benchmark library and advanced capabilities require a paid subscription.Read 15 Oct 2026 · best-tools-for.nuttertools.dev

Limit: perceived overlap

A Reddit discussion says organizations may find overlap with Tenable policy-compliance scans and questioned whether the membership cost was justified.Read 15 Oct 2026 · reddit.com

Limit: remediation

An independent NutterTools review says the product primarily assesses configurations and remediation must be done manually or with other automation.Read 15 Oct 2026 · best-tools-for.nuttertools.dev

Local and remote scans

Assessments can target systems running locally, on-premises or in cloud environments, either locally or remotely.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Membership access

CIS-CAT Pro Assessor is available only to CIS SecureSuite Members.Read 2 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Microsoft 365

The Assessor supports assessments of Microsoft 365 Commercial Cloud tenants against the CIS Microsoft 365 Foundations Benchmark; other Microsoft 365 cloud environments are not supported for this assessment.Read 2 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Operating system bundles

Download bundles are provided for Windows and Linux; the Linux bundle without embedded Java also supports macOS.Read 2 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Operating systems

The documented target OS families are Microsoft Windows, Linux distributions and macOS.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Praise: reliability

Another Reddit user said the product worked fine and reliably.Read 15 Oct 2026 · reddit.com

Praise: usability

A Reddit user reported that the tool was easy to use and produced strong benchmark reports with step-by-step compliance instructions.Read 15 Oct 2026 · reddit.com

Remediation guidance

Conformance reports include written remediation guidance for supported Benchmark recommendations.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Remote assessments

The Assessor can assess remote or local targets hosted in the cloud or on premises.Read 2 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Remote protocols

Remote assessments use WinRM for Windows endpoints and SSH for Unix/Linux and Cisco network devices.Read 15 Oct 2026 · github.com

Report formats

Pro can export TXT, CSV, HTML, XML and JSON assessment results.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Requirements

The v4 guide lists a multi-core processor, at least 2 GB RAM, 5 GB free disk space, and administrator privileges for local assessments.Read 2 Oct 2026 · ciscat-assessor.docs.cisecurity.org

SBOM

Each SecureSuite release includes JSON and XML software bills of materials updated with every release.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

SCAP support

Supported assessment technologies include XCCDF, OVAL, SCE and ECL.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Security guidance

CIS recommends keeping the Assessor host updated and benchmarked, validating downloaded ZIP checksums, and restricting access to authorized users with least privilege.Read 2 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Security testing

CIS says eligible products including CIS-CAT Pro Assessor receive annual penetration testing, with medium-or-higher findings mitigated.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Self-hosting

The assessor is maintained at a location controlled by each member organization and can run on local, virtual, cloud or in-network machines.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

SOC 2

CIS states that its product-engineering practices are SOC 2 certified.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

System requirements

The installation guide lists a multicore processor, at least 2 GB RAM, 5 GB free disk space and administrator privileges for local assessments.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Technology

The product uses Java 21 and can ship with Amazon Corretto Java in its bundled distributions.Read 15 Oct 2026 · ciscat-assessor.docs.cisecurity.org

Plans and prices

Every CIS-CAT Pro Assessor plan and price →

Where Specifiction places it

• Database Vulnerability Scanners#1 of 279.4
• Security Configuration Management Software#2 of 299.4
• Infrastructure Testing Tools#2 of 289.3