The Center for Internet Security (CIS) released version 2.0.0 of the CIS Talos Linux Benchmark on September 24, 2026. It supersedes v1.0.0, published in July 2024.
Security and compliance teams use it both to harden Talos Linux clusters and to prove that hardening during an audit.
What is new in v2.0.0
v2.0.0 targets Talos Linux v1.13. Its recommendations remain correct on v1.14, which includes a large set of features the benchmark does not cover. A follow-up edition adding sections for newer Talos Linux releases is planned.
• Machine configuration format. Examples throughout have been rewritten against the current format. Disk encryption is now shown with VolumeConfig documents and KubeSpan with KubeSpanConfig.
• Audit commands. Many recommendations have revised audit procedures that match current talosctl usage.
• Secure Boot. The Secure Boot section has grown, and it now covers Trusted Boot, meaning Secure Boot paired with TPM disk encryption. Under the default PCR 7 binding, a disk unlocks only while Secure Boot remains on with the same keys.
• Kernel log shipping. KmsgLogConfig switches kernel log shipping on without restarting the node.
• Maintenance mode and the firewall. When machines are managed by Omni, SideroLink adds a layer of protection for the Talos API, which otherwise accepts configuration from any source while a machine is in maintenance mode.
• Framework mappings. Every recommendation now references NIST SP 800-53 Rev. 5. Most also map to NIST CSF 2.0, and the CIS Controls mappings have been refreshed.
What the benchmark covers
The benchmark is split into six sections:
- Initial Setup: Installing with Secure Boot, encrypting the STATE and EPHEMERAL partitions with TPM or KMS keys (or with the Encrypt Disks option in Talos Omni), and keeping Talos Linux up to date
- Time Synchronization: Configuring at least two NTP servers
- Kubernetes: Keeping workloads off control plane nodes, and enforcing the restricted Pod Security Standard, where the default is baseline
- Access Control: RBAC for the Talos API
- Network Configuration: Kernel network parameters including source routing, ICMP redirects, martian packet logging, SYN cookies and reverse path filtering; ingress firewall policies for control plane and worker nodes; KubeSpan for encrypting node-to-node traffic
- Logging and Auditing: Sending kernel and service logs to a remote log server
How to use it
Recommendations are split across two profiles.
Level 1 covers settings that are practical to run and carry a clear security benefit, including disk encryption, NTP, Pod Security Standards and remote logging.
Level 2 builds on Level 1 with defense in depth for environments where security is the priority, including Secure Boot and ingress firewall policies.
Most recommendations carry the Automated label, meaning the check resolves to a pass or fail on its own, usually through a talosctl command. talosctl get securitystate, for instance, reports whether a node booted under Secure Boot.
Four are Manual, which means they can't be fully checked automatically. Those are software updates, the two firewall policies and KubeSpan.
Every recommendation includes a description, rationale, audit procedure and remediation. Most also state the default value, and some flag the operational impact.
Credits
Authors: Andrew Rynhard, Steve Francis, Andrey Smirnov and Justin Garrison. Contributor: Amarachi Iheanacho. CIS editor: Phil White.
Get the benchmark
Download version 2.0.0 from CIS WorkBench, available at no cost for non-commercial use. A WorkBench account is required.
Teams that need compliance evidence beyond the benchmark can talk to us about Talos Enterprise Linux, which adds FIPS 140-3 compliant builds, SBOMs and commercial support to the same Talos Linux codebase.
Steve Francis
