CIS-CAT Pro vs CIS-CAT Lite: which one does your organization need?
When a customer, contract or regulator asks for evidence of CIS Benchmark conformance, the first decision is which scanner can produce it. CIS-CAT Lite is free and offers unlimited scans, but it evaluates the configuration of select technologies against select CIS Benchmarks. CIS-CAT Pro Assessor automates assessment against CIS Benchmarks and produces reports mapped to the CIS Controls, but it requires CIS SecureSuite membership. The choice therefore turns on three things: whether your in-scope platforms are covered by the Lite set, whether you need Benchmarks tailored in CIS WorkBench, and what your SecureSuite membership would cost at your headcount.
Start by listing every operating system, database, cloud service and application that the request covers, then check each against the Benchmarks that CIS-CAT Lite evaluates. If a platform is missing, or if your secure configuration baseline differs from a published profile and you have tailored it in CIS WorkBench, Lite will not give you the result you need. Pro is the tool that reads tailored Benchmarks. Membership is priced by employee count, with bands published on the CIS End User pricing page, so confirm your current band and fee with CIS before you budget, since CIS notes that pricing is subject to change. Public SLTT government entities and US public academic institutions can join at no cost, so check your eligibility as well.
Whichever tool you pick, your organization owns its configuration and remains responsible for the systems it scans. A CIS-CAT report, Lite or Pro, shows how a system scored against a Benchmark on the day it ran. It is not an audit report, an attestation or a certification, and only an independent assessor can issue a conclusion on conformance. Ask the assessor which scanner output and which report format they will accept before you run anything. A partner such as DeployOpen can prepare the hardened baseline, run the scans and organize the evidence, but the scanning results must be reviewed by your own team and, where required, by the independent assessor.
What CIS-CAT Pro costs, and what it does not include
This table separates the cost components of running CIS-CAT Pro from those of running CIS-CAT Lite, showing who is paid for each item and whether it is one-time or recurring. Read it as a checklist for the written quote: the membership fee is the main recurring license cost, while staff time and any partner fees depend on your environment and scope.
| Cost component | Who is paid | One-time or recurring | What drives it |
|---|---|---|---|
| CIS SecureSuite End User membership | CIS, for the membership that Pro requires | Recurring, billed annually | Employee count tier. Published list: 2,400 USD a year up to 99 employees, rising to 20,000 USD for 100,000 or more (CIS End User pricing, subject to change) |
| CIS-CAT Lite | Nobody, the tool is free | Not applicable | Covers select technologies and select Benchmarks only, so it may need supplementing for wider scope |
| Benchmark PDFs | Nobody, the PDFs are free to download | Not applicable | Good for reading and manual checks, but they do not produce automated scoring |
| Tailoring recommendations and XCCDF, Word, Excel and XML formats | Included with SecureSuite membership | Recurring, as long as membership is active | Lapses in membership remove access to these formats and tailoring, so confirm renewal terms before rollout |
| Internal staff time to run scans and remediate | Your own payroll | Recurring, with each scan cycle | Number of hosts, Benchmark profiles in use, and how many deviations need documented exceptions |
| Implementation partner fees, if used | The partner you engage, under a written scope | Usually one-time for setup, with optional recurring support | Tailoring work, integration with your reporting, and how many environments are covered. Ask for a fixed-scope quote with deliverables listed |
| Membership exemptions | Not charged for eligible SLTT government entities and US public academic institutions | Not applicable | Confirm eligibility directly with CIS before assuming it applies |
| Pricing changes | CIS sets list prices | Recurring risk | Published figures are subject to change, so ask for the current price in writing and the renewal terms |
What CIS-CAT Lite covers and where it stops
CIS-CAT Lite is free and offers unlimited scans, but it evaluates the configuration of select technologies against select CIS Benchmarks and returns a compliance score. That is useful for a first look at a host, a lab image or a single platform, and it needs no SecureSuite membership. The limit is coverage: the technologies and Benchmarks it supports are a subset of the full CIS Benchmark catalog, so a scan that passes tells you only about the items it actually tests. Before you plan around it, confirm the current technology and Benchmark list on the CIS-CAT Pro page, because that list changes and a Benchmark you need may not be on it.
Lite also stops short of the workflow a secure configuration program needs. It scans against the published Benchmark profile as delivered, so it cannot run a Benchmark tailored in CIS WorkBench to reflect your own accepted deviations. It does not group results by Implementation Group or map findings to the CIS Controls, so an engineer receives a list of failed checks with no way to rank them by the Safeguards they serve. It also carries no SecureSuite support, Member Success Managers or enhanced technical help. A team that must answer an auditor's question about a specific Safeguard, or justify a Level 2 deviation, will have to build that reporting and decision record by hand.
Decide on the gap, not the price. If your Benchmarks, host types and reporting needs are all on the Lite list and a compliance score is enough, Lite may cover the task at no licence cost. If you need tailoring, Controls-level reporting or vendor support, the question becomes whether SecureSuite membership is worth paying for, and that depends on your headcount tier, which the membership pricing page sets out. Ask the vendor to confirm in writing which technologies and Benchmark versions your environment requires, then run Lite against a representative system to see which checks it cannot reach.
What moves the cost and the choice between Lite and Pro
Whether CIS-CAT Pro is worth its membership depends on a few decisions the buyer controls: headcount tier, which Benchmarks and technologies must be checked, whether tailoring is needed, and how results must be reported. Work through these drivers before asking for a quote, because each one changes what is paid for and what remains free.
Headcount tier for membership
CIS-CAT Pro requires CIS SecureSuite membership, and the End User membership fee is set by employee count. The fee is an annual, recurring cost, so the tier is the largest single driver of the Pro total. Confirm the employee count the tier uses and whether contractors or subsidiaries are included. Ask CIS whether the current tier table applies, since CIS notes its pricing is subject to change.
Benchmark and technology coverage
CIS-CAT Lite evaluates the configuration of select technologies against select Benchmarks, so the first check is whether every platform in scope is covered. Make a list of operating systems, databases, cloud services and network devices, then compare it with the Benchmarks CIS publishes. Gaps in coverage are the main reason a team moves from Lite to Pro, and they should be documented before any purchase decision.
Need for tailored Benchmarks
Organizations often must disable a recommendation, change a value or adjust a profile to fit a business application. Tailoring recommendations in CIS WorkBench requires SecureSuite membership, and CIS-CAT Pro Assessor is designed to work with those tailored Benchmarks. If the standard profile already matches the environment, Lite may be enough. If exceptions are routine, price tailoring as part of the Pro decision and record each deviation with its reason.
Reporting mapped to Implementation Groups
Pro reports map results to the CIS Controls so teams can prioritize findings by Implementation Group. This matters when an auditor, customer or board asks for progress against the Controls rather than a raw Benchmark score. Lite returns a compliance score per scan. Decide who will consume the reports, whether they need Control and Implementation Group views, and whether that reporting work justifies the membership.
Number of systems and scan volume
Lite offers unlimited scans, so scan count does not change its cost. The effort that does grow with system count is collecting results, reviewing exceptions and feeding findings into remediation. Pro adds the CIS-CAT Pro Dashboard through SecureSuite, which centralizes results. Estimate how many hosts run each technology, how often scans must repeat and who will triage the output. Ask vendors and integrators to price that operational work separately from the software license.
Free membership eligibility
CIS SecureSuite membership is free for US state, local, tribal and territorial government entities and for US public academic institutions. If an organization qualifies, the membership cost driver disappears and Pro becomes a comparison of effort rather than fees. Confirm eligibility with CIS in writing, including which entities of a larger body are covered, before planning the budget around it.
Which option fits which organization
CIS-CAT Lite suits an organization that wants a quick, free view of how selected systems compare with selected CIS Benchmarks. It is free and offers unlimited scans, so it works well for individual engineers checking a build, a team testing hardening changes, or a small business starting its secure configuration work. It evaluates only select technologies against select Benchmarks, so it will not cover your whole estate.
- Coverage limits: Lite evaluates a defined set of technologies and Benchmarks, so confirm your platforms appear on the supported list before you rely on it.
- Score, not governance: You receive a compliance score for each scan, without the Controls-mapped reporting that Pro provides.
- No vendor support tier: Lite does not come with Member Success Managers or enhanced technical support.
- Good for pilots: Use it to test a Benchmark profile before you commit to Pro.
Before you standardize on Lite, check on the CIS-CAT Pro page which technologies and Benchmarks Lite currently covers, and confirm whether your audit or contract expects reports from a licensed tool.
CIS-CAT Pro suits organizations that must run assessments across many systems, tailor Benchmarks to their own environment and report results against the CIS Controls. CIS-CAT Pro Assessor requires CIS SecureSuite membership, so the membership fee is part of the cost. Membership is priced by employee count, and CIS publishes a tier for each band, so the same tool can cost very different amounts depending on headcount.
- Tailored Benchmarks: Pro works with Benchmarks tailored in CIS WorkBench, so you can document approved deviations for your own environment.
- Controls-mapped reports: Results map to the CIS Controls, letting you prioritize work by Implementation Group.
- Member Success Managers: Membership includes a named contact and enhanced technical support.
- Membership fee: For End User membership, CIS lists 2,400 US dollars a year for up to 99 employees, rising to 20,000 for 100,000 or more (CIS End User pricing page, subject to change).
Ask CIS for a current membership quote based on your exact employee count, and confirm whether tailoring and additional formats are included at your tier.
The SecureSuite Platform suits members who want to manage posture across both the CIS Controls and the CIS Benchmarks in one place. It is available to SecureSuite Members and combines CIS CSAT Pro with the CIS-CAT Pro Dashboard, so teams can assess posture against the Controls and demonstrate conformance with the Benchmarks without stitching exports together by hand. It is a good fit when a security function reports to leadership or a regulator and needs one view of progress.
- Controls posture: CSAT Pro supports assessment against the CIS Controls, which complements Benchmark results.
- Benchmark conformance: The CIS-CAT Pro Dashboard shows Benchmark results for members.
- Shared reporting: One platform reduces manual reconciliation between control assessments and configuration scans.
- Hosting model: CIS documents a CIS-hosted CSAT option, so confirm where data is stored and who administers the platform before you adopt it.
Confirm with CIS which components are included in your membership tier, and ask how the platform handles data residency for your jurisdiction.
CIS SecureSuite membership is free for US state, local, tribal and territorial (SLTT) government entities and US public academic institutions. Eligible organizations can therefore use the Pro capabilities, including tailored Benchmarks and Controls-mapped reporting, without the employee-based membership fee that other organizations pay. This matters most for public bodies that must show secure configuration to oversight boards or funding agencies and have limited budgets.
- Eligibility check: Confirm that your entity qualifies as an SLTT government body or a US public academic institution under CIS's criteria.
- Ongoing terms: Ask whether the free status depends on annual re-verification or any usage conditions.
- Assessment scope: Free membership does not change what you must assess, only what you pay for the tooling.
- Procurement records: Keep written confirmation of eligibility for audit and procurement files.
Ask CIS to confirm your eligibility in writing before you plan a rollout around free access.
How to move from Lite scans to Pro reporting
This sequence takes a team from free CIS-CAT Lite checks to Pro reporting that maps results to the CIS Controls and Implementation Groups. Each step ends with a written output so the move to a SecureSuite membership is justified by the scope you actually need.
Confirm Benchmark and technology coverage
Start by listing every technology in scope, such as operating systems, databases, cloud services and network devices, and matching each one to a CIS Benchmark. CIS-CAT Lite evaluates the configuration of only select technologies against select Benchmarks, so check that each item is covered before you plan around Pro. Confirm the Benchmark version and the profile you intend to use with the CIS Benchmarks documentation. The output is a coverage table showing each asset class, its Benchmark and version, and any gaps that Lite cannot assess.
Decide whether tailoring is needed
Compare the default Benchmark settings with your own standards, such as approved services, local logging paths or business-specific account rules. If you need to change which recommendations apply, the tailored content is built in CIS WorkBench, and tailoring recommendations requires a SecureSuite membership. Record each proposed change and its reason, and have the system owner and security lead review them. The output is either a decision that default content is sufficient or a written list of tailoring requirements to take into the membership decision.
Select the membership tier from employee count
Use your headcount to find the End User membership fee band on CIS's published pricing page, which sets fees by employee count and is subject to change. Confirm whether your organization qualifies for the free membership available to US state, local, tribal and territorial government entities or US public academic institutions. Ask CIS to confirm the current fee and what it includes before you commit. The output is a documented tier decision, with the fee source, the date you checked it and the named budget owner.
Run baseline scans on representative systems
Once membership is active, install CIS-CAT Pro Assessor on a small set of representative systems, such as one server image, one database host and one endpoint build, and run the Benchmarks you scoped in step one. Run the same Benchmarks with Lite on the same hosts first if you want a comparison of scores. Keep the raw output, the Benchmark version and the scan configuration for each run. The output is a set of baseline reports, plus a list of failed recommendations that you can trace to each host.
Map findings to Implementation Groups
Pro reports map results to the CIS Controls, so group each failed recommendation under its Control and Safeguard, then sort by Implementation Group. IG1 is the essential cyber hygiene baseline, and IG2 and IG3 add Safeguards for organizations with more complexity or regulated, sensitive assets. Assign each finding to an owner and a priority based on the IG that applies to your organization. The output is a prioritized remediation register with Safeguard references, owners and the IG that drives each priority.
Remediate and rescan the affected systems
Fix the findings that your change process approves, using the hardening steps in each Benchmark recommendation and testing them on non-production systems first. After each change window, rescan the same hosts with the same Benchmark and configuration so the results can be compared. Keep the before and after reports together. The output is a rescan report for each remediated system that shows which recommendations now pass and which remain open.
Document deviations in the secure configuration process
For each recommendation you do not implement, record the reason, the compensating control, the approver and the review date in your secure configuration process. This matches what Safeguard 4.1 expects of a documented, maintained configuration process, and it gives assessors evidence that open items are managed rather than ignored. Store the register alongside the Pro reports so the two can be reviewed together. The output is an approved deviation register linked to the Pro reports for the systems in scope, ready for internal audit or external assessment.
Who owns the scan results, the configuration and the evidence
The organization owns its configuration, its scan schedule and every decision to accept a deviation from a CIS Benchmark recommendation. CIS-CAT, whether Lite or Pro, is a tool that reports how a system's settings compare with a chosen Benchmark profile. Its output is an internal assessment that the organization uses to decide what to fix, what to document as an exception and what to rescan. It is not a certification, an attestation or a statement of conformance to any external standard, and it should not be presented to a customer or regulator as one.
An implementation partner such as DeployOpen can prepare systems, help the organization choose and tailor the right Benchmark profile, run scans on a schedule agreed in the written scope, and organize the reports into an evidence set mapped to the relevant Safeguards. The organization's own staff still approve the tailoring, sign off deviations and own the risk those deviations carry. Where a Pro scan depends on tailored content, confirm with the organization's CIS SecureSuite membership who holds the WorkBench access needed to maintain that tailoring.
Only an independent auditor, assessor or certification body can issue a report or certificate that relies on these results. Before the engagement starts, the organization should ask that auditor which scan outputs they will accept, in which format, and how they want deviations justified. A useful check is to confirm that every deviation in the scan report has a named owner, a documented reason and a review date, because an assessor will look for exactly those records when testing the secure configuration process.
Questions buyers ask before choosing CIS-CAT Pro
Is CIS-CAT Lite enough for a customer security questionnaire?
CIS-CAT Lite may be enough for an internal check, but it is not enough for every questionnaire. Lite is free, allows unlimited scans and evaluates the configuration of select technologies against select CIS Benchmarks, producing a compliance score. Pro covers more Benchmarks, works with tailored Benchmarks built in CIS WorkBench, and produces reports that map results to the CIS Controls so you can prioritize by Implementation Group. If a customer asks for mapped reports, coverage of specific Benchmarks or evidence from a tailored profile, check whether Lite's supported technologies and reporting meet that wording before you rely on it. Ask the customer exactly which artifact they expect.
Does CIS-CAT Pro require SecureSuite membership, and what does it cost by headcount?
Yes. CIS-CAT Pro requires CIS SecureSuite membership, and the membership fee is set by employee count. CIS's End User pricing lists 2,400 US dollars a year for up to 99 employees, 5,500 for 100 to 499, 7,900 for 500 to 999, 10,900 for 1,000 to 4,999, 12,800 for 5,000 to 24,999, 15,200 for 25,000 to 99,999 and 20,000 for 100,000 or more. CIS states these fees are subject to change, so confirm the current figure on the CIS SecureSuite End User pricing page before budgeting. Membership is free for US state, local, tribal and territorial government entities and US public academic institutions. Tailoring Benchmarks also requires membership.
Can a partner run CIS-CAT Pro on our behalf?
A partner can help prepare and operate the scans, but the licensing and the decisions stay with your organization. Pro is tied to SecureSuite membership, so confirm with CIS how membership and use rights apply when an outside party operates the tool for you. DeployOpen plans, implements and hardens self-hosted open-source platforms inside your own infrastructure, and it prepares systems and evidence for assessments. It does not issue reports or certificates, and it is not a CIS partner or reseller. Ask any provider to state in its written scope who holds the membership, where scan data is stored and who reviews the results.
Does a CIS-CAT scan result count as CIS Controls certification?
No. A CIS-CAT scan measures a system's configuration against a CIS Benchmark and reports a result. It does not certify your organization against the CIS Controls. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. If you need independent assurance of CIS Controls implementation, CIS Controls Accreditation, run with CREST, accredits SecureSuite member organizations that provide implementation, auditing or assessment services, and CIS lists an application fee of 1,500 US dollars for CREST members and 2,500 for non-members. Accreditation applies to the provider, not to a scan result. Confirm the current fee with CIS.
How much staff effort does running CIS-CAT Pro take?
The effort depends on the number of systems in scope, how much Benchmark tailoring you need and how many findings must be remediated. The scanning itself is largely automated, but the work that takes time is deciding which Benchmark profile applies to each system, testing changes before rollout, recording approved deviations and tracking fixes. CIS-CAT Pro runs on Java 21 after a backend modernization, so confirm that your scanning hosts meet that requirement. Ask your team to estimate effort per system class, not for the tool as a whole, and treat any single estimate you receive as illustrative until it is tied to your environment.
What should we ask for in a quote for CIS-CAT Pro work?
Ask for a written scope that separates the software and membership costs from the labor costs. The membership line should show your employee-count tier and the CIS price in effect at signing, since CIS says fees are subject to change. The labor lines should list the systems in scope, the Benchmarks and profiles to be applied, whether tailoring is included, the report format and who receives it, and whether remediation or only scanning is covered. Also ask who holds the SecureSuite membership, how long scan data is retained, and what happens to the configuration when the engagement ends. Fixed-scope work agreed in writing is the usual basis for a quote.
How DeployOpen prepares systems for CIS-CAT scanning
We start with a written scope, because a CIS-CAT scan only tells you something useful once the right Benchmark, profile and systems are fixed. Before any scan runs, we agree in writing which self-hosted open-source platforms are in scope, which Benchmark versions and Level profiles apply, and whether the client has a tailored Benchmark built in CIS WorkBench. Scope, deliverables and timelines are agreed before work begins, and a quote follows from that written scope. We do not sell or resell CIS SecureSuite memberships. If CIS-CAT Pro is needed, the client holds its own membership, and we will confirm that membership status with the client before planning any Pro-only work.
Next we prepare the systems inside the client's own cloud accounts, data centers or air-gapped networks. We align the chosen Benchmark profiles with the client's secure configuration process so that each deviation is either remediated or recorded with a reason, owner and review date. We also check that scan accounts, network paths and credentials are in place, and that the scanning host runs a supported Java version for the CIS-CAT release the client uses. Confirm the required Java version for your release on the CIS-CAT Pro page before you schedule the work.
After the scans run, we organize the output for the client and its independent assessor. That means keeping the raw reports, the Benchmark version and profile used, the tailoring file, the scan date and the remediation or exception record for each failed check, so an assessor can trace a score back to a configuration. We do not issue reports, attestations or certificates. Those come from the client's auditor or certification body, and the client owns its controls and the decisions about which findings to accept. Ask any implementation partner to show you this evidence package in a sample before you commit to a scope.
