CIS Visual Studio Code GPO Benchmark v1.0.0 - 09-25-2025 Terms of Use Please see the below link for our current terms of use: https://www.cisecurity.org/cis-securesuite/cis-securesuite-membership-terms-of-use/ For information on referencing and/or citing CIS Benchmarks in 3rd party documentation (including using portions of Benchmark Recommendations) please contact CIS Legal (legalnotices@cisecurity.org) and request guidance on copyright usage. NOTE: It is NEVER acceptable to host a CIS Benchmark in ANY format (PDF, etc.) on a 3rd party (non-CIS owned) site. Page 1 Table of Contents Terms of Use ................................................................................................................. 1 Table of Contents .......................................................................................................... 2 Overview ........................................................................................................................ 4 Important Usage Information ................................................................................................ 4 Key Stakeholders ................................................................................................................................... 4 Apply the Correct Version of a Benchmark ........................................................................................ 5 Exceptions .............................................................................................................................................. 5 Remediation ........................................................................................................................................... 6 Summary ................................................................................................................................................. 6 Target Technology Details .................................................................................................... 7 Intended Audience................................................................................................................. 7 Consensus Guidance ............................................................................................................ 8 Typographical Conventions .................................................................................................. 9 Recommendation Definitions ..................................................................................... 10 Title ........................................................................................................................................10 Assessment Status...............................................................................................................10 Automated ............................................................................................................................................ 10 Manual ................................................................................................................................................... 10 Profile ....................................................................................................................................10 Description ............................................................................................................................10 Rationale Statement .............................................................................................................10 Impact Statement ..................................................................................................................11 Audit Procedure ....................................................................................................................11 Remediation Procedure........................................................................................................11 Default Value .........................................................................................................................11 References ............................................................................................................................11 CIS Critical Security Controls® (CIS Controls®) ..................................................................11 Additional Information..........................................................................................................11 Profile Definitions .................................................................................................................12 Acknowledgements ..............................................................................................................13 Recommendations ...................................................................................................... 14 1 Visual Studio Code ............................................................................................................14 1.1 Chat ................................................................................................................................................. 15 1.1.1 (L2) Ensure 'ChatMCP' is set to 'Disabled' (Automated) ................................................. 16 1.1.2 (L1) Ensure 'ChatToolsAutoApprove' is set to 'Disabled' (Automated) ........................... 18 1.2 Extensions ...................................................................................................................................... 20 Page 2 1.2.1 (L2) Ensure 'AllowedExtensions' is configured (Manual)................................................. 21 1.3 Telemetry ........................................................................................................................................ 23 1.3.1 (L2) Ensure 'EnableFeedback' is set to 'Disabled' (Automated) ...................................... 24 1.3.2 (L1) Ensure 'TelemetryLevel' is set to 'Enabled: off' (Automated) ................................... 26 1.4 Update ............................................................................................................................................. 28 1.4.1 (L1) Ensure 'UpdateMode' is set to 'Enabled: Enable Automatic Update Checks. Code will check for updates automatically and periodically.' (Automated) ......................................... 29 Appendix: Summary Table ......................................................................................... 31 Appendix: Change History ......................................................................................... 32 Page 3 Overview All CIS Benchmarks™ (Benchmarks) focus on technical configuration settings used to maintain and/or increase the security of the addressed technology, and they should be used in conjunction with other essential cyber hygiene tasks like: • Monitoring the base operating system and applications for vulnerabilities and quickly updating with the latest security patches. • End-point protection (Antivirus software, Endpoint Detection and Response (EDR), etc.). • Logging and monitoring user and system activity. In the end, the Benchmarks are designed to be a key component of a comprehensive cybersecurity program. Important Usage Information All Benchmarks are available free for non-commercial use from the CIS Website. They can be used to manually assess and remediate systems and applications. In lieu of manual assessment and remediation, there are several tools available to assist with assessment: • CIS Configuration Assessment Tool (CIS-CAT® Pro Assessor) • CIS Benchmarks™ Certified 3rd Party Tooling These tools make the hardening process much more scalable for large numbers of systems and applications. NOTE: Some tooling focuses only on the Benchmark Recommendations that can be fully automated (skipping ones marked Manual). It is important that ALL Recommendations (Automated and Manual) be addressed since all are important for properly securing systems and are typically in scope for audits. Key Stakeholders Cybersecurity is a collaborative effort, and cross functional cooperation is imperative within an organization to discuss, test, and deploy Benchmarks in an effective and efficient way. The Benchmarks are developed to be best practice configuration guidelines applicable to a wide range of use cases. In some organizations, exceptions to specific Recommendations will be needed, and this team should work to prioritize the problematic Recommendations based on several factors like risk, time, cost, and labor. These exceptions should be properly categorized and documented for auditing purposes. Page 4 Apply the Correct Version of a Benchmark Benchmarks are developed and tested for a specific set of products and versions and applying an incorrect Benchmark to a system can cause the resulting pass/fail score to be incorrect. This is due to the assessment of settings that do not apply to the target systems. To assure the correct Benchmark is being assessed: • Deploy the Benchmark applicable to the way settings are managed in the environment: An example of this is the Microsoft Windows family of Benchmarks, which have separate Benchmarks for Group Policy, Intune, and Stand-alone systems based upon how system management is deployed. Applying the wrong Benchmark in this case will give invalid results. • Use the most recent version of a Benchmark: This is true for all Benchmarks, but especially true for cloud technologies. Cloud technologies change frequently and using an older version of a Benchmark may have invalid methods for auditing and remediation. Exceptions The guidance items in the Benchmarks are called recommendations and not requirements, and exceptions to some of them are expected and acceptable. The Benchmarks strive to be a secure baseline, or starting point, for a specific technology, with known issues identified during Benchmark development are documented in the Impact section of each Recommendation. In addition, organizational, system specific requirements, or local site policy may require changes as well, or an exception to a Recommendation or group of Recommendations (e.g. A Benchmark could Recommend that a Web server not be installed on the system, but if a system's primary purpose is to function as a Webserver, there should be a documented exception to this Recommendation for that specific server). In the end, exceptions to some Benchmark Recommendations are common and acceptable, and should be handled as follows: • The reasons for the exception should be reviewed cross-functionally and be well documented for audit purposes. • A plan should be developed for mitigating, or eliminating, the exception in the future, if applicable. • If the organization decides to accept the risk of this exception (not work toward mitigation or elimination), this should be documented for audit purposes. It is the responsibility of the organization to determine their overall security policy, and which settings are applicable to their unique needs based on the overall risk profile for the organization. Page 5 Remediation CIS has developed Build Kits for many technologies to assist in the automation of hardening systems. Build Kits are designed to correspond to Benchmark's “Remediation” section, which provides the manual remediation steps necessary to make that Recommendation compliant to the Benchmark. When remediating systems (changing configuration settings on deployed systems as per the Benchmark's Recommendations), please approach this with caution and test thoroughly. The following is a reasonable remediation approach to follow: • CIS Build Kits, or internally developed remediation methods should never be applied to production systems without proper testing. • Proper testing consists of the following: o Understand the configuration (including installed applications) of the targeted systems. Various parts of the organization may need different configurations (e.g., software developers vs standard office workers). o Read the Impact section of the given Recommendation to help determine if there might be an issue with the targeted systems. o Test the configuration changes with representative lab system(s). If issues arise during testing, they can be resolved prior to deploying to any production systems. o When testing is complete, initially deploy to a small sub-set of production systems and monitor closely for issues. If there are issues, they can be resolved prior to deploying more broadly. o When the initial deployment above is completes successfully, iteratively deploy to additional systems and monitor closely for issues. Repeat this process until the full deployment is complete. Summary Using the Benchmarks Certified tools, working as a team with key stakeholders, being selective with exceptions, and being careful with remediation deployment, it is possible to harden large numbers of deployed systems in a cost effective, efficient, and safe manner. NOTE: As previously stated, the PDF versions of the CIS Benchmarks™ are available for free, non-commercial use on the CIS Website. All other formats of the CIS Benchmarks™ (MS Word, Excel, and Build Kits) are available for CIS SecureSuite® members. CIS-CAT® Pro is also available to CIS SecureSuite® members. Page 6 Target Technology Details This document provides prescriptive guidance for establishing a secure configuration posture for Visual Studio Code. This guide was tested against VS Code version 1.104 on a Windows Server 2025 operating system. To obtain the latest version of this guide, please visit http://benchmarks.cisecurity.org. If you have questions, comments, or have identified ways to improve this guide, please write us at feedback@cisecurity.org. Intended Audience This benchmark is intended for system and application administrators, security specialists, auditors, help desk, and platform deployment personnel who plan to develop, deploy, assess, or secure solutions that incorporate Visual Studio Code via Group Policy Objects (GPOs). Page 7 Consensus Guidance This CIS Benchmark™ was created using a consensus review process comprised of a global community of subject matter experts. The process combines real world experience with data-based information to create technology specific guidance to assist users to secure their environments. Consensus participants provide perspective from a diverse set of backgrounds including consulting, software development, audit and compliance, security research, operations, government, and legal. Each CIS Benchmark undergoes two phases of consensus review. The first phase occurs during initial Benchmark development. During this phase, subject matter experts convene to discuss, create, and test working drafts of the Benchmark. This discussion occurs until consensus has been reached on Benchmark recommendations. The second phase begins after the Benchmark has been published. During this phase, all feedback provided by the Internet community is reviewed by the consensus team for incorporation in the Benchmark. If you are interested in participating in the consensus process, please visit https://workbench.cisecurity.org/. Page 8 Typographical Conventions The following typographical conventions are used throughout this guide: Convention Meaning Used for blocks of code, command, and Stylized Monospace font script examples. Text should be interpreted exactly as presented. Used for inline code, commands, UI/Menu Monospace font selections or examples. Text should be interpreted exactly as presented. Text set in angle brackets denote a variable requiring substitution for a real value. Used to reference other relevant settings, CIS Benchmarks and/or Benchmark Italic font Communities. Also, used to denote the title of a book, article, or other publication. Additional information or caveats things like Notes, Warnings, or Cautions (usually just Bold font the word itself and the rest of the text normal). Page 9 Recommendation Definitions The following defines the various components included in a CIS recommendation as applicable. If any of the components are not applicable it will be noted, or the component will not be included in the recommendation. Title Concise description for the recommendation's intended configuration. Assessment Status An assessment status is included for every recommendation. The assessment status indicates whether the given recommendation can be automated or requires manual steps to implement. Both statuses are equally important and are determined and supported as defined below: Automated Represents recommendations for which assessment of a technical control can be fully automated and validated to a pass/fail state. Recommendations will include the necessary information to implement automation. Manual Represents recommendations for which assessment of a technical control cannot be fully automated and requires all or some manual steps to validate that the configured state is set as expected. The expected state can vary depending on the environment. Profile A collection of recommendations for securing a technology or a supporting platform. Most benchmarks include at least a Level 1 and Level 2 Profile. Level 2 extends Level 1 recommendations and is not a standalone profile. The Profile Definitions section in the benchmark provides the definitions as they pertain to the recommendations included for the technology. Description Detailed information pertaining to the setting with which the recommendation is concerned. In some cases, the description will include the recommended value. Rationale Statement Detailed reasoning for the recommendation to provide the user a clear and concise understanding on the importance of the recommendation. Page 10 Impact Statement Any security, functionality, or operational consequences that can result from following the recommendation. Audit Procedure Systematic instructions for determining if the target system complies with the recommendation. Remediation Procedure Systematic instructions for applying recommendations to the target system to bring it into compliance according to the recommendation. Default Value Default value for the given setting in this recommendation, if known. If not known, either not configured or not defined will be applied. References Additional documentation relative to the recommendation. CIS Critical Security Controls® (CIS Controls®) The mapping between a recommendation and the CIS Controls is organized by CIS Controls version, Safeguard, and Implementation Group (IG). The Benchmark in its entirety addresses the CIS Controls safeguards of (v7) “5.1 - Establish Secure Configurations” and (v8) '4.1 - Establish and Maintain a Secure Configuration Process” so individual recommendations will not be mapped to these safeguards. Additional Information Supplementary information that does not correspond to any other field but may be useful to the user. Page 11 Profile Definitions The following configuration profiles are defined by this Benchmark: • Level 1 Items in this profile intend to: o be the starting baseline for most organizations; o be practical and prudent; o provide a clear security benefit; and o not inhibit the utility of the technology beyond acceptable means. • Level 2 This profile extends the "Level 1" profile. Items in this profile exhibit one or more of the following characteristics: o are intended for environments or use cases where security is more critical than manageability and usability; o may negatively inhibit the utility or performance of the technology; and o limit the ability of remote management/access. Page 12 Acknowledgements This Benchmark exemplifies the great things a community of users, vendors, and subject matter experts can accomplish through consensus collaboration. The CIS community thanks the entire consensus team with special recognition to the following individuals who contributed greatly to the creation of this guide: Author Kyle Bavis Editor Matthew Woods Jennifer Jarose Page 13 Recommendations 1 Visual Studio Code Page 14 1.1 Chat This section contains recommendations for chat (AI) settings. Page 15 1.1.1 (L2) Ensure 'ChatMCP' is set to 'Disabled' (Automated) Profile Applicability: • Level 2 Description: This policy setting controls integration with Model Context Protocol (MCP) servers. The recommended state for this setting is: Disabled. Rationale: Integration with third-party MCP servers may result in unintended disclosure of information to the party running the server. Impact: Users will not be able to use MCP server integrations. Audit: Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location with a REG_DWORD value of 0. HKLM\SOFTWARE\Policies\Microsoft\VSCode:ChatMCP Remediation: To establish the recommended configuration via GP, set the following UI path to Disabled: Computer Configuration\Policies\Administrative Templates\Visual Studio Code\Chat\ChatMCP Note: This Group Policy path may not exist by default. It is provided by the Group Policy template VScode.admx, which is available in the VS Code installation directory under the policies folder. Default Value: Enabled References: 1. https://code.visualstudio.com/docs/setup/enterprise#_centrally-manage-vs-code- settings Page 16 CIS Controls: Controls Version Control IG 1 IG 2 IG 3 0.0 Explicitly Not Mapped v8 Explicitly Not Mapped 0.0 Explicitly Not Mapped v7 Explicitly Not Mapped Page 17 1.1.2 (L1) Ensure 'ChatToolsAutoApprove' is set to 'Disabled' (Automated) Profile Applicability: • Level 1 Description: This policy setting controls auto-approval for agent mode chat tools. The recommended state for this setting is: Disabled. Rationale: Automatic activation of agent mode tools may result in inadvertent disclosure of sensitive data to third-party servers backing the chat tool or unexpected modification to project files. Impact: Users will need to manually approve agent mode before it can be used. Audit: Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location with a REG_DWORD value of 0. HKLM\SOFTWARE\Policies\Microsoft\VSCode:ChatToolsAutoApprove Remediation: To establish the recommended configuration via GP, set the following UI path to Disabled: Computer Configuration\Policies\Administrative Templates\Visual Studio Code\Chat\ChatToolsAutoApprove Note: This Group Policy path may not exist by default. It is provided by the Group Policy template VScode.admx, which is available in the VS Code installation directory under the policies folder. References: 1. https://code.visualstudio.com/docs/setup/enterprise#_centrally-manage-vs-code- settings Page 18 CIS Controls: Controls Version Control IG 1 IG 2 IG 3 0.0 Explicitly Not Mapped v8 Explicitly Not Mapped 0.0 Explicitly Not Mapped v7 Explicitly Not Mapped Page 19 1.2 Extensions This section contains recommendations for extension settings. Page 20 1.2.1 (L2) Ensure 'AllowedExtensions' is configured (Manual) Profile Applicability: • Level 2 Description: This policy setting configures a list of extension selectors that determine which extensions are allowed or blocked. The recommended state for this setting is: Enabled with a list of allowed extensions. Rationale: Allowing users to install any extension may result in unintended information disclosure to third parties, or the installation of malware. Impact: IT administrators will need to maintain the list of allow-listed extensions. Depending on individual end-user needs, it may not be practical to allow specific extensions. Allowing by publisher may be more practical. Audit: Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location with a REG_SZ value containing a JSON string. HKLM\SOFTWARE\Policies\Microsoft\VSCode:AllowedExtensions Remediation: To establish the recommended configuration via GP, set the following UI path to Enabled along with a JSON string defining the approved extensions: Computer Configuration\Policies\Administrative Templates\Visual Studio Code\Extensions\AllowedExtensions Note: This Group Policy path may not exist by default. It is provided by the Group Policy template VScode.admx, which is available in the VS Code installation directory under the policies folder. Default Value: Null; a user may install any extension. References: 1. https://code.visualstudio.com/docs/setup/enterprise#_configure-allowed- extensions Page 21 CIS Controls: Controls Version Control IG 1 IG 2 IG 3 0.0 Explicitly Not Mapped v8 Explicitly Not Mapped 0.0 Explicitly Not Mapped v7 Explicitly Not Mapped Page 22 1.3 Telemetry This section contains recommendations for telemetry settings. Page 23 1.3.1 (L2) Ensure 'EnableFeedback' is set to 'Disabled' (Automated) Profile Applicability: • Level 2 Description: This policy setting controls feedback mechanisms, such as the issue reporter and surveys. The recommended state for this setting is: Disabled. Rationale: The VS Code issue reporter can be configured to submit context such as basic system configuration and application settings. This may inadvertently disclose information that some organizations consider confidential. Impact: Users will not be able to use in-application feedback tools. Audit: Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location with a REG_DWORD value of 0. HKLM\SOFTWARE\Policies\Microsoft\VSCode:EnableFeedback Remediation: To establish the recommended configuration via GP, set the following UI path to Disabled: Computer Configuration\Policies\Administrative Templates\Visual Studio Code\Telemetry\EnableFeedback Note: This Group Policy path may not exist by default. It is provided by the Group Policy template VScode.admx, which is available in the VS Code installation directory under the policies folder. Default Value: Enabled Page 24 References: 1. https://code.visualstudio.com/docs/setup/enterprise#_centrally-manage-vs-code- settings CIS Controls: Controls Version Control IG 1 IG 2 IG 3 0.0 Explicitly Not Mapped v8 Explicitly Not Mapped 0.0 Explicitly Not Mapped v7 Explicitly Not Mapped Page 25 1.3.2 (L1) Ensure 'TelemetryLevel' is set to 'Enabled: off' (Automated) Profile Applicability: • Level 1 Description: This policy setting controls telemetry for VS Code and extensions. The recommended state for this setting is: Enabled: off. Rationale: Enabling this feature sends data to Microsoft and potentially third-party extension developers, which could lead to sensitive data being exposed. Impact: Data will not be shared with Microsoft or extension developers. Audit: Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location with a REG_SZ value of off. HKLM\SOFTWARE\Policies\Microsoft\VSCode:TelemetryLevel Remediation: To establish the recommended configuration via GP, set the following UI path to Enabled: off: Computer Configuration\Policies\Administrative Templates\Visual Studio Code\Telemetry\TelemetryLevel Note: This Group Policy path may not exist by default. It is provided by the Group Policy template VScode.admx, which is available in the VS Code installation directory under the policies folder. Default Value: all (Crash reports, usage data, and error telemetry will be collected) References: 1. https://code.visualstudio.com/docs/setup/enterprise#_configure-telemetry-level Page 26 CIS Controls: Controls Version Control IG 1 IG 2 IG 3 0.0 Explicitly Not Mapped v8 Explicitly Not Mapped 0.0 Explicitly Not Mapped v7 Explicitly Not Mapped Page 27 1.4 Update This section contains recommendations for update settings. Page 28 1.4.1 (L1) Ensure 'UpdateMode' is set to 'Enabled: Enable Automatic Update Checks. Code will check for updates automatically and periodically.' (Automated) Profile Applicability: • Level 1 Description: This policy setting controls whether VS Code automatically updates when a new version is released. The recommended state for this setting is: Enabled: Enable Automatic Update Checks. Code will check for updates automatically and periodically. Rationale: Software needs to be patched regularly to address vulnerabilities. Impact: None; this is the default behavior. Audit: Navigate to the UI Path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location with a REG_SZ value of default. HKLM\SOFTWARE\Policies\Microsoft\VSCode:UpdateMode Remediation: To establish the recommended configuration via GP, set the following UI path to Enabled: Enable Automatic Update Checks. Code will check for updates automatically and periodically.: Computer Configuration\Policies\Administrative Templates\Visual Studio Code\Update\UpdateMode Note: This Group Policy path may not exist by default. It is provided by the Group Policy template VScode.admx, which is available in the VS Code installation directory under the policies folder. Default Value: Default Page 29 References: 1. https://code.visualstudio.com/docs/setup/enterprise#_configure-automatic- updates CIS Controls: Controls Control IG 1 IG 2 IG 3 Version 7.3 Perform Automated Operating System Patch Management v8 ● ● ● Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis. 3.4 Deploy Automated Operating System Patch Management Tools v7 Deploy automated software update tools in order to ensure that the operating ● ● ● systems are running the most recent security updates provided by the software vendor. Page 30 Appendix: Summary Table CIS Benchmark Recommendation Set Correctly Yes No 1 Visual Studio Code 1.1 Chat 1.1.1 (L2) Ensure 'ChatMCP' is set to 'Disabled' (Automated)   1.1.2 (L1) Ensure 'ChatToolsAutoApprove' is set to 'Disabled'   (Automated) 1.2 Extensions 1.2.1 (L2) Ensure 'AllowedExtensions' is configured (Manual)   1.3 Telemetry 1.3.1 (L2) Ensure 'EnableFeedback' is set to 'Disabled'   (Automated) 1.3.2 (L1) Ensure 'TelemetryLevel' is set to 'Enabled: off'   (Automated) 1.4 Update 1.4.1 (L1) Ensure 'UpdateMode' is set to 'Enabled: Enable   Automatic Update Checks. Code will check for updates automatically and periodically.' (Automated) Page 31 Appendix: Change History Date: 09/25/2025 Version: 1.0.0 Initial Public Release Page 32