CIS Zoom Workplace Benchmark

This recommendation verifies that only authenticated users can join meetings on the Zoom Workplace communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zoom Workplace communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Windows – verify SSO enforcement via registry:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\General" /v EnforceSignInToJoin 2>nul

# macOS – check managed preference:
defaults read /Library/Managed\ Preferences/us.zoom.config EnforceSignInToJoin 2>/dev/null

# Admin Portal – verify via API (requires OAuth):
# GET https://api.zoom.us/v2/accounts/{accountId}/settings
# Check: schedule_meeting.enforce_login = true

# Windows GPO / MDM:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\General
# EnforceSignInToJoin = 1 (DWORD)

# macOS Configuration Profile:
# <key>EnforceSignInToJoin</key>
# <true/>

# Admin Portal: Settings > Security > Only authenticated users can join

This recommendation verifies that waiting room is enabled and locked on the Zoom Workplace communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zoom Workplace communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check if waiting room is enforced:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v EnableWaitingRoom 2>nul

# macOS:
defaults read /Library/Managed\ Preferences/us.zoom.config EnableWaitingRoom 2>/dev/null

# Windows GPO:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings
# EnableWaitingRoom = 1 (DWORD)

# macOS Profile:
# <key>EnableWaitingRoom</key>
# <true/>

# Admin Portal: Settings > Security > Waiting Room = ON and locked

This recommendation ensures that meeting passcodes are required on the Zoom Workplace communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Zoom Workplace communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check meeting password enforcement:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v SetMeetingPasswordOption 2>nul

# macOS:
defaults read /Library/Managed\ Preferences/us.zoom.config RequirePasswordForAllMeetings 2>/dev/null

# Windows GPO:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings
# SetMeetingPasswordOption = 3 (DWORD) — require for all meetings

# macOS Profile:
# <key>RequirePasswordForAllMeetings</key>
# <true/>

# Admin Portal: Settings > Security > Require passcodes > Lock all

This recommendation verifies that end-to-end encryption is enabled on the Zoom Workplace communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zoom Workplace communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check end-to-end encryption setting:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v EnableE2EE 2>nul

# Verify in client: Settings > Security > End-to-end encryption
# API: GET /v2/accounts/{accountId}/settings → in_meeting.e2e_encryption

# Enable E2EE in Admin Portal:
# Account Management > Account Settings > Meeting > Security
# End-to-end (E2EE) encryption = ON

# Windows GPO:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings
# EnableE2EE = 1 (DWORD)

# macOS Profile:
# <key>EnableE2EE</key>
# <true/>

This recommendation verifies that AES 256-bit encryption is active on the Zoom Workplace communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zoom Workplace communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check AES 256-bit encryption:
# Admin Portal API:
# GET /v2/accounts/{accountId}/settings
# Check: in_meeting.encryption_type = 'enhanced_encryption'

# Verify in Zoom client meeting info (shield icon):
# Should show AES-256-GCM

# Admin Portal:
# Account Management > Account Settings > Meeting > Security
# Encryption type = 'Enhanced Encryption' (minimum AES-256-GCM)

# For E2EE, set to End-to-end encryption

This recommendation ensures that cloud recordings require password protection on the Zoom Workplace communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Zoom Workplace communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check cloud recording settings:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v DisableCloudRecording 2>nul

# API: GET /v2/accounts/{accountId}/settings
# Check: recording.cloud_recording = false (if disabled)

# If cloud recording is needed, enable password protection:
# Admin Portal: Settings > Recording
# Require passcode to access cloud recordings = ON + Lock
# Only authenticated users can view cloud recordings = ON
# Auto delete cloud recordings after X days = ON

# Windows GPO to disable cloud recording entirely:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings
# DisableCloudRecording = 1 (DWORD)

This setting ensures that in-meeting file transfer is restricted on the Zoom Workplace communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Zoom Workplace communication platform is essential for defense in depth.

# Check file transfer in meetings:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v EnableFileTransfer 2>nul

# API: GET /v2/accounts/{accountId}/settings
# Check: in_meeting.file_transfer = true/false

# Disable or restrict file transfer:
# Admin Portal: Settings > Meeting > In Meeting (Basic)
# File transfer = OFF and Lock

# Windows GPO:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings
# EnableFileTransfer = 0 (DWORD)

# macOS Profile:
# <key>EnableFileTransfer</key>
# <false/>

This setting ensures that screen sharing is restricted to host only on the Zoom Workplace communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Zoom Workplace communication platform is essential for defense in depth.

# Check screen sharing restrictions:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v ShareScreen 2>nul

# API: GET /v2/accounts/{accountId}/settings
# Check: in_meeting.screen_sharing_host_only

# Restrict screen sharing to host only:
# Admin Portal: Settings > Meeting > In Meeting (Basic)
# Screen sharing = Host Only and Lock

# Windows GPO:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings
# ShareScreen = 2 (DWORD) — Host only by default

This setting ensures that annotation is restricted on the Zoom Workplace communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Zoom Workplace communication platform is essential for defense in depth.

# Check annotation and whiteboard settings:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v EnableAnnotation 2>nul
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v EnableWhiteboard 2>nul

# Disable annotation for participants:
# Admin Portal: Settings > Meeting > In Meeting (Basic)
# Annotation = OFF or 'Only the user who is sharing can annotate'

# Windows GPO:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings
# EnableAnnotation = 0 (DWORD)

This recommendation verifies that removed participants cannot re-join on the Zoom Workplace communication platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Zoom Workplace communication platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check removed participant re-join policy:
# API: GET /v2/accounts/{accountId}/settings
# Check: in_meeting.allow_removed_users_to_rejoin

# Admin Portal: Settings > Meeting > In Meeting (Basic)

# Prevent removed participants from re-joining:
# Admin Portal: Settings > Security
# Allow removed participants to rejoin = OFF and Lock

This setting ensures that external chat is restricted on the Zoom Workplace communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Zoom Workplace communication platform is essential for defense in depth.

# Check external chat restrictions:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Chat" /v EnableExternalChat 2>nul

# API: GET /v2/accounts/{accountId}/settings
# Check: in_meeting.chat_allow_external

# Restrict external chat in Admin Portal:
# Account Management > IM Management > IM Settings
# Allow users to chat with external contacts = OFF

# Windows GPO:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Chat
# EnableExternalChat = 0 (DWORD)

This setting ensures that in-meeting chat is restricted on the Zoom Workplace communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Zoom Workplace communication platform is essential for defense in depth.

# Check in-meeting chat settings:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\Meetings" /v MeetingChat 2>nul

# API: GET /v2/accounts/{accountId}/settings
# Check: in_meeting.chat

# Configure in-meeting chat restrictions:
# Admin Portal: Settings > Meeting > In Meeting (Basic)
# Meeting chat = 'Host and co-hosts only' or 'No one'

# Or restrict auto-saving:
# Auto saving chats = OFF and Lock

This recommendation ensures that SSO is configured and enforced on the Zoom Workplace communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Zoom Workplace communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check SSO configuration:
# Admin Portal: Advanced > Single Sign-On
# Verify SAML configuration exists

# API: GET /v2/accounts/{accountId}/settings
# Check: authentication.sso

# Configure SSO:
# Admin Portal: Advanced > Single Sign-On
# Vanity URL: https://company.zoom.us
# SAML Entity ID, Sign-in URL, Certificate from IdP

# Enforce SSO-only login:
# Admin Portal: Advanced > Security
# Allow users to sign in with SSO = ON
# Allow users to sign in with work email = OFF

This recommendation ensures that two-factor authentication is enforced on the Zoom Workplace communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Zoom Workplace communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check 2FA enforcement:
# Admin Portal: Advanced > Security
# Verify Two-factor authentication section

# API: GET /v2/accounts/{accountId}/settings
# Check: security.enforce_2fa

# Enable 2FA:
# Admin Portal: Advanced > Security
# Two-factor authentication = ON
# Apply to: All users in your account
# Require for: Sign in with Zoom + SSO

This recommendation verifies that auto-updates are enabled on the Zoom Workplace communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Zoom Workplace communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check auto-update policy:
# Windows:
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\General" /v EnableAutoUpdate 2>nul
reg query "HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\General" /v SetUpdatingChannel 2>nul

# Check installed version:
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "Zoom" 2>nul | findstr DisplayVersion

# Windows GPO – enforce auto-updates:
# HKLM\SOFTWARE\Policies\Zoom\Zoom Meetings\General
# EnableAutoUpdate = 1 (DWORD)
# SetUpdatingChannel = 1 (DWORD) — Slow channel
# AlwaysCheckLatestVersion = 1 (DWORD)

# macOS Profile:
# <key>EnableAutoUpdate</key>
# <true/>
# <key>SetUpdatingChannel</key>
# <integer>1</integer>

This recommendation ensures that minimum client version is enforced on the Zoom Workplace communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Zoom Workplace communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check minimum client version enforcement:
# Admin Portal: Account Management > Account Settings
# Verify 'Minimum Version Required'

# API: GET /v2/accounts/{accountId}/settings
# Check: in_meeting.require_minimum_client_version

# Enforce minimum client version:
# Admin Portal: Account Management > Account Settings
# Require minimum Zoom client version = ON
# Minimum version: 6.0.0 or later

# Block outdated clients from joining meetings:
# Settings > Security > Block outdated Zoom clients