diff --git a/policies/CIS.5.1.1.rego b/policies/CIS.5.1.1.rego
new file mode 100644
index 0000000000..ac08402f4e
--- /dev/null
+++ b/policies/CIS.5.1.1.rego
@@ -0,0 +1,20 @@
+package cis_5_1_1
+
+import data.lib.kubernetes
+
+violation[msg] {
+    kubernetes.clusterrolebindings[clusterrolebinding]
+    is_clusterrole_admin(clusterrolebinding)
+    msg = kubernetes.format(sprintf("ClusterRoleBinding %v - Binding to cluster-admin role is not allowed", [clusterrolebinding.metadata.name]))
+}
+
+violation[msg] {
+    kubernetes.rolebindings[rolebinding]
+    is_clusterrole_admin(rolebinding)
+    msg = kubernetes.format(sprintf("RoleBinding %v - Binding to cluster-admin role is not allowed", [rolebinding.metadata.name]))
+}
+
+is_clusterrole_admin(rolebinding) {
+    rolebinding.roleRef.name == "cluster-admin"
+    startswith(rolebinding.metadata.name, "system:") == false
+}
diff --git a/policies/CIS.5.1.1_test.rego b/policies/CIS.5.1.1_test.rego
new file mode 100644
index 0000000000..bda66cd622
--- /dev/null
+++ b/policies/CIS.5.1.1_test.rego
@@ -0,0 +1,47 @@
+package cis_5_1_1
+
+import data.lib.test
+
+test_violation {
+    test.violations(violation) with input as policy_input("ClusterRoleBinding", "example:view:binding", "cluster-admin")
+}
+
+test_violation_2 {
+    test.violations(violation) with input as policy_input("RoleBinding", "example:view:binding", "cluster-admin")
+}
+
+test_no_violation {
+    test.no_violations(violation) with input as policy_input("ClusterRoleBinding", "system:cluster-admin", "cluster-admin")
+}
+
+test_no_violation_2 {
+    test.no_violations(violation) with input as policy_input("RoleBinding", "system:cluster-admin", "cluster-admin")
+}
+
+test_no_violation_3 {
+    test.no_violations(violation) with input as policy_input("ClusterRoleBinding", "stackdriver:fluentd-gcp", "stackdriver:fluentd-gcp")
+}
+
+test_no_violation_4 {
+    test.no_violations(violation) with input as policy_input("RoleBinding", "stackdriver:fluentd-gcp", "stackdriver:fluentd-gcp")
+}
+
+policy_input(rolebindingkind, name, ref) = {
+    "apiVersion": "rbac.authorization.k8s.io/v1",
+    "kind": rolebindingkind,
+    "metadata": {
+        "name": name
+    },
+    "roleRef": {
+        "apiGroup": "rbac.authorization.k8s.io",
+        "kind": "ClusterRole",
+        "name": ref
+    },
+    "subjects": [
+        {
+            "apiGroup": "rbac.authorization.k8s.io",
+            "kind": "Group",
+            "name": "system:masters"
+        }
+    ]
+}
diff --git a/policies/lib/kubernetes.rego b/policies/lib/kubernetes.rego
index 8ab3525030..73bed7d674 100644
--- a/policies/lib/kubernetes.rego
+++ b/policies/lib/kubernetes.rego
@@ -153,6 +153,19 @@ clusterroles[clusterrole] {
     clusterrole = object
 }
 
+is_clusterrole_binding {
+    kind = "ClusterRoleBinding"
+}
+
+is_clusterrole_binding {
+    kind = "ClusterRoleBindings"
+}
+
+clusterrolebindings[clusterrolebinding] {
+    is_clusterrole_binding
+    clusterrolebinding = object
+}
+
 pod_containers(pod) = all_containers {
 	keys = {"containers", "initContainers"}
 	all_containers = [c | keys[k]; c = pod.spec[k][_]]