Features Frameworks Guide Pricing

Frameworks · Global

CIS Critical Security Controls

The CIS Critical Security Controls, published by the Center for Internet Security, are a prioritized set of defensive practices drawn from how real attacks succeed. Version 8.1 groups 153 safeguards under 18 controls, from asset and software inventories through data protection, secure configuration, access, vulnerability management, logging, malware defenses, recovery, training, service providers, application security, incident response and penetration testing. Safeguards are tiered into three cumulative Implementation Groups: IG1 is the essential baseline for every organization, and IG2 and IG3 add safeguards for larger or higher-risk environments. Requirement codes follow the CIS numbering, each description names the first Implementation Group that includes the safeguard, and the titles and descriptions are ProofTrail summaries rather than CIS text.

Version
CIS Controls v8.1
Requirements
171, each mapped to ProofTrail’s controls
Try it in the demo $20 a year per installation

Requirements and controls

  • CIS 1 Knowing and controlling enterprise assets

    • 1.1 Detailed inventory of enterprise assets

      Keep an accurate record of every device and system that can store or process enterprise data, whether on the network, remote or in the cloud, with an owner for each entry, and review it on a regular schedule. Implementation Group: IG1.

      • Inventory of Infrastructure Assets
      • Inventory of Endpoint Assets
      • Asset Inventory Updates
      • Asset Ownership Assignment

    • 1.2 Dealing with unauthorized assets

      Act at least weekly on devices that are not in the inventory, by taking them off the network, refusing their remote connections or isolating them. Implementation Group: IG1.

      • Asset Inventory Updates
      • Inventory of Endpoint Assets
      • Inventory of Infrastructure Assets

    • 1.3 Active asset discovery

      Scan the environment with a discovery tool on a frequent schedule and use the results to keep the asset inventory complete. Implementation Group: IG2.

      • Inventory of Infrastructure Assets
      • Asset Inventory Updates

    • 1.4 Inventory updates from DHCP logs

      Feed DHCP or IP address management logs into the asset inventory so newly connected devices are picked up. Implementation Group: IG2.

      • Asset Inventory Updates
      • Centralized Security Logging

    • 1.5 Passive asset discovery

      Watch network traffic with a passive tool to identify connected assets, and reconcile what it finds with the inventory. Implementation Group: IG3.

      • Asset Inventory Updates
      • Inventory of Infrastructure Assets

  • CIS 2 Knowing and controlling software

    • 2.1 Software inventory

      Record the software installed across the enterprise, with details such as publisher, version, purpose and end-of-support date, and review the list at least twice a year. Implementation Group: IG1.

      • Software Inventory & Authorization
      • Asset Inventory Updates

    • 2.2 Supported software only

      Approve only software that its vendor still maintains with security fixes; anything out of support is removed or kept as a documented exception with compensating measures. Implementation Group: IG1.

      • Software Inventory & Authorization
      • Endpoint Security Validation

    • 2.3 Dealing with unauthorized software

      Look for software that has not been approved, at least monthly, and remove it or record a justified exception. Implementation Group: IG1.

      • Software Inventory & Authorization
      • Rules of Behavior

    • 2.4 Automated software inventory tools

      Use device management or discovery tooling to collect the list of installed software automatically rather than by hand. Implementation Group: IG2.

      • Software Inventory & Authorization
      • Inventory of Endpoint Assets

    • 2.5 Application allowlist

      Enforce technical controls so that only approved applications can be installed or run, and revisit the approved list regularly. Implementation Group: IG2.

      • Software Inventory & Authorization
      • Endpoint Security Policy

    • 2.6 Library allowlist

      Restrict which software libraries may load into running processes so that unapproved libraries are blocked. Implementation Group: IG2.

      • Software Inventory & Authorization

    • 2.7 Script allowlist

      Allow only authorized scripts to run, using controls such as digital signatures or version control. Implementation Group: IG3.

      • Software Inventory & Authorization

  • CIS 3 Protecting data

    • 3.1 Data management process

      Document how data is handled through its life, including sensitivity, ownership, handling rules, retention and disposal, and review it every year. Implementation Group: IG1.

      • Data Classification Policy
      • Data Retention Policy
      • Media Disposal Policy

    • 3.2 Data inventory

      Know what data the organization holds and where, starting with sensitive data, and refresh that inventory at least yearly. Implementation Group: IG1.

      • Data Classification Labels
      • Personal Data Inventory

    • 3.3 Data access permissions

      Set permissions on file systems, databases and applications so that people can read, change or run only what their role requires. Implementation Group: IG1.

      • Access Control Policy & Procedure
      • Identity Validation
      • Production Database Access Restriction

    • 3.4 Retention limits applied

      Keep data no longer, and no shorter, than the documented retention periods allow. Implementation Group: IG1.

      • Data Retention Policy

    • 3.5 Secure data disposal

      Destroy data with a method matched to its sensitivity once it is no longer needed. Implementation Group: IG1.

      • Media Disposal Policy
      • Data Retention Policy

    • 3.6 Encrypted end-user devices

      Turn on full-disk or platform encryption on laptops, phones and other end-user devices that may hold sensitive data. Implementation Group: IG1.

      • Full Device Encryption
      • Endpoint Encryption

    • 3.7 Data classification scheme

      Define a small set of sensitivity labels, apply them to the data the organization holds, and review the scheme every year. Implementation Group: IG2.

      • Data Classification Policy
      • Data Classification Labels

    • 3.8 Data flow documentation

      Map how data moves between internal systems and service providers, and keep that documentation current. Implementation Group: IG2.

      • Network & Data Flow Diagrams

    • 3.9 Encrypted removable media

      Encrypt any enterprise data copied to USB drives or other removable storage. Implementation Group: IG2.

      • Encryption Policy & Procedure
      • Endpoint Security Policy

    • 3.10 Encryption of sensitive data in transit

      Protect sensitive data travelling over networks with encryption such as TLS or SSH. Implementation Group: IG2.

      • Transmission Confidentiality
      • Encryption Policy & Procedure

    • 3.11 Encryption of sensitive data at rest

      Encrypt sensitive data held on servers, databases and in applications, adding application-level encryption where storage encryption alone is not enough. Implementation Group: IG2.

      • Encryption of Data at Rest
      • Encryption Policy & Procedure

    • 3.12 Separation by data sensitivity

      Keep systems that store or process sensitive data apart from those handling less sensitive data. Implementation Group: IG2.

      • Limit Network Connections
      • External System Connections
      • Data Classification Labels

    • 3.13 Data loss prevention tooling

      Use an automated tool to find sensitive data across the estate and to detect or stop it leaving through unapproved channels. Implementation Group: IG3.

    • 3.14 Logging of sensitive data access

      Record who accesses sensitive data, including when it is changed or deleted. Implementation Group: IG3.

      • Centralized Security Logging

  • CIS 4 Hardened configuration of assets and software

    • 4.1 Secure configuration process

      Keep documented hardening standards for end-user devices, servers, other connected equipment and software, and review them every year. Implementation Group: IG1.

      • Secure Configuration Baselines
      • Endpoint Security Policy

    • 4.2 Secure configuration of network equipment

      Keep documented hardening standards for routers, switches, firewalls and other network devices, reviewed every year. Implementation Group: IG1.

      • Secure Configuration Baselines
      • Network Security Policy & Procedure

    • 4.3 Automatic session lock

      Lock unattended sessions automatically, after no more than 15 minutes on computers and 2 minutes on mobile devices. Implementation Group: IG1.

      • Session Lock
      • Cloud Console Session Timeout

    • 4.4 Server firewalls

      Protect each server with a host firewall or a filtering device in front of it that denies traffic except for explicitly allowed services. Implementation Group: IG1.

      • External System Connections
      • Limit Network Connections

    • 4.5 End-user device firewalls

      Run a host firewall or port filter on every end-user device that blocks traffic except for explicitly allowed services and ports. Implementation Group: IG1.

      • Host-Based Firewalls
      • Endpoint Security Policy

    • 4.6 Secure administration of assets and software

      Manage systems through secure means such as version-controlled infrastructure as code and encrypted administrative protocols, avoiding cleartext ones. Implementation Group: IG1.

      • Secure Configuration Baselines
      • Transmission Confidentiality
      • Secure System Modification

    • 4.7 Default account management

      Disable built-in and vendor default accounts, or change their credentials before the system goes into use. Implementation Group: IG1.

      • Secure Configuration Baselines
      • Production Database Access Restriction

    • 4.8 Unneeded services removed

      Strip out services and modules the business does not use, or turn them off. Implementation Group: IG2.

      • Secure Configuration Baselines

    • 4.9 Trusted DNS resolvers

      Point enterprise devices at DNS servers the organization controls or at a reputable provider. Implementation Group: IG2.

      • Email & Web Threat Protection
      • Endpoint Security Policy

    • 4.10 Lockout of portable devices after failed unlocks

      Lock or wipe laptops and mobile devices after a set number of failed unlock attempts. Implementation Group: IG2.

      • Endpoint Security Policy

    • 4.11 Remote wipe of portable devices

      Make sure laptops and mobile devices can be wiped remotely if they are lost, stolen or a person leaves. Implementation Group: IG2.

      • Endpoint Security Policy
      • Inventory of Endpoint Assets

    • 4.12 Separate work space on mobile devices

      Keep enterprise apps and data on mobile devices in a managed area kept apart from personal use. Implementation Group: IG3.

      • Endpoint Security Policy

  • CIS 5 User and service accounts

    • 5.1 Account inventory

      Keep a list of every user and administrator account with its owner, role and start and end dates, and confirm regularly that each active account is still authorized. Implementation Group: IG1.

      • Identity Validation
      • User Access Reviews
      • Production System Access Review

    • 5.2 Unique passwords

      Use a different password for every account and system, at least 8 characters long where MFA is in place and at least 14 where it is not. Implementation Group: IG1.

      • Password Management Guidelines
      • Multi-Factor Authentication

    • 5.3 Dormant accounts disabled

      Switch off accounts once they have gone unused for 45 days, wherever the platform allows it. Implementation Group: IG1.

      • Production Database Access Restriction
      • User Access Reviews

    • 5.4 Dedicated administrator accounts

      Hold administrator rights only in accounts reserved for administration, so email, browsing and other routine work happen in a normal account without them. Implementation Group: IG1.

      • Dedicated Administrator Accounts
      • User Privilege Reviews

    • 5.5 Service account inventory

      List service accounts with their owner and purpose, and confirm regularly that each one is still needed. Implementation Group: IG2.

      • Identity Validation
      • User Access Reviews
      • User Privilege Reviews

    • 5.6 Central account management

      Create, change and remove accounts from one directory or identity platform instead of separately in each system. Implementation Group: IG2.

      • Access Control Policy & Procedure
      • Identity Validation

  • CIS 6 Granting and revoking access

    • 6.1 Access request and approval

      Follow a defined, ideally automated, process to grant access when someone joins, needs new rights or changes role. Implementation Group: IG1.

      • Access Control Policy & Procedure
      • Identity Validation

    • 6.2 Access removal

      Follow a defined, ideally automated, process to remove access promptly when someone leaves, changes role or no longer needs it, disabling accounts where audit history must be kept. Implementation Group: IG1.

      • Termination of Employment
      • Access Control Policy & Procedure
      • User Privilege Reviews

    • 6.3 MFA on internet-facing applications

      Require multi-factor authentication on every application reachable from the internet, including third-party services. Implementation Group: IG1.

      • Multi-Factor Authentication

    • 6.4 MFA for remote network access

      Require multi-factor authentication for any remote connection into the enterprise network. Implementation Group: IG1.

      • Multi-Factor Authentication

    • 6.5 MFA for administrators

      Put multi-factor authentication on all administrator logins, including those to systems a provider operates for the organization. Implementation Group: IG1.

      • Multi-Factor Authentication
      • Production Database Access Restriction

    • 6.6 Inventory of identity systems

      List the systems that sign users in and decide what they can do, and review that list at least yearly. Implementation Group: IG2.

      • Identity Validation

    • 6.7 Central access control

      Connect systems to single sign-on or the central directory so access decisions are made in one place. Implementation Group: IG2.

      • Access Control Policy & Procedure
      • Identity Validation

    • 6.8 Role-based access

      Define the access each role needs, grant rights by role, and review the role definitions on a set schedule. Implementation Group: IG3.

      • Identity Validation
      • User Privilege Reviews
      • User Access Reviews

  • CIS 7 Ongoing vulnerability handling

    • 7.1 Vulnerability management process

      Document how vulnerabilities in enterprise assets are found and handled, and review the process every year. Implementation Group: IG1.

      • Vulnerability Management Policy & Procedure

    • 7.2 Remediation process

      Set a risk-based approach and timelines for fixing vulnerabilities, and review it regularly. Implementation Group: IG1.

      • Vulnerability Management Policy & Procedure
      • Centralized Flaw Remediation

    • 7.3 Automated operating system patching

      Roll out operating system updates with an automated patching tool on a frequent, fixed cycle. Implementation Group: IG1.

      • Timely Security Updates
      • Endpoint Security Validation

    • 7.4 Automated application patching

      Roll out application updates with an automated patching tool on a frequent, fixed cycle. Implementation Group: IG1.

      • Timely Security Updates

    • 7.5 Internal vulnerability scans

      Scan internal systems for vulnerabilities on a set schedule with an automated tool, using authenticated scans where possible. Implementation Group: IG2.

      • Vulnerability Remediation Process

    • 7.6 External vulnerability scans

      Scan internet-facing systems for vulnerabilities on a frequent schedule with an automated tool. Implementation Group: IG2.

      • Vulnerability Remediation Process

    • 7.7 Fixing detected vulnerabilities

      Resolve vulnerabilities found by scans through the remediation process and tooling, on a regular cycle. Implementation Group: IG2.

      • Vulnerability Remediation Process
      • Centralized Flaw Remediation

  • CIS 8 Audit logging

    • 8.1 Audit log management process

      Document which events are logged, how logs are collected and reviewed and how long they are kept, and review the process every year. Implementation Group: IG1.

      • Centralized Security Logging

    • 8.2 Audit logs collected

      Make sure the logging defined in the log management process is actually switched on everywhere it applies. Implementation Group: IG1.

      • Centralized Security Logging

    • 8.3 Enough log storage

      Give log destinations enough capacity to hold logs for the required retention period. Implementation Group: IG1.

      • Centralized Security Logging
      • Capacity & Performance Management

    • 8.4 Time synchronization

      Keep system clocks aligned with approved time sources so log timestamps can be correlated. Implementation Group: IG2.

      • Clock Synchronization

    • 8.5 Detailed audit logs

      Capture rich event detail, such as source, user, time and addresses, on systems that hold sensitive data. Implementation Group: IG2.

      • Centralized Security Logging

    • 8.6 DNS query logs

      Record the domain lookups made by enterprise systems, where the platform allows. Implementation Group: IG2.

    • 8.7 URL request logs

      Record which web addresses enterprise systems request, where the platform allows. Implementation Group: IG2.

    • 8.8 Command-line logs

      Capture the commands typed into shells, scripting consoles and remote administration sessions. Implementation Group: IG2.

    • 8.9 Central log collection

      Bring audit logs together in a central location wherever possible. Implementation Group: IG2.

      • Centralized Security Logging

    • 8.10 Audit log retention

      Keep audit logs for at least 90 days. Implementation Group: IG2.

      • Centralized Security Logging

    • 8.11 Audit log review

      Have a person or tool examine audit logs frequently for activity that looks abnormal or hostile. Implementation Group: IG2.

      • Anomalous Behavior Detection
      • Unauthorized Activity Monitoring
      • Centralized Security Logging

    • 8.12 Service provider logs

      Collect logs from service providers where offered, such as sign-in, data change and user management events. Implementation Group: IG3.

      • Centralized Security Logging

  • CIS 9 Email and browser defenses

    • 9.1 Supported browsers and email clients

      Allow only browsers and email clients that are still supported by their vendor and kept on the latest version. Implementation Group: IG1.

      • Software Inventory & Authorization
      • Endpoint Security Validation

    • 9.2 DNS filtering

      Send name lookups from staff devices, in the office or remote, through a filtering service that refuses known malicious domains. Implementation Group: IG1.

      • Email & Web Threat Protection

    • 9.3 Web address filtering

      Filter web traffic so that enterprise devices cannot reach malicious or unapproved sites, based on category, reputation or block lists. Implementation Group: IG2.

      • Email & Web Threat Protection

    • 9.4 Browser and email extension control

      Remove or disable browser and email client add-ons that are unauthorized or not needed. Implementation Group: IG2.

      • Software Inventory & Authorization
      • Email & Web Threat Protection

    • 9.5 DMARC

      Publish a DMARC policy backed by SPF and DKIM so that mail spoofing the organization's domains is less likely to be delivered. Implementation Group: IG2.

      • Email & Web Threat Protection

    • 9.6 Blocked attachment types

      Stop file types the business does not need from reaching users through the email gateway. Implementation Group: IG2.

      • Email & Web Threat Protection

    • 9.7 Malware protection for email servers

      Check inbound mail for malicious content at the server, for example by opening attachments in a sandbox first. Implementation Group: IG3.

      • Email & Web Threat Protection

  • CIS 10 Protection against malware

    • 10.1 Anti-malware software

      Every enterprise device runs anti-malware protection that is kept installed and working. Implementation Group: IG1.

      • Malware Protection

    • 10.2 Automatic signature updates

      Let anti-malware tools update their detection signatures automatically. Implementation Group: IG1.

      • Malware Protection

    • 10.3 Autorun disabled for removable media

      Turn off autorun and autoplay so that inserting removable media cannot start software on its own. Implementation Group: IG1.

      • Secure Configuration Baselines
      • Endpoint Security Policy

    • 10.4 Removable media scanning

      Make the anti-malware tool check USB drives and other removable media as soon as they are plugged in. Implementation Group: IG2.

      • Malware Protection
      • Endpoint Security Policy

    • 10.5 Anti-exploitation features

      Turn on the exploit protections built into operating systems and applications, such as execution prevention and system integrity protection. Implementation Group: IG2.

      • Endpoint Security Policy
      • Secure Configuration Baselines

    • 10.6 Central anti-malware management

      Administer anti-malware protection for all devices from one central place. Implementation Group: IG2.

      • Malware Protection

    • 10.7 Behavior-based anti-malware

      Use anti-malware software that detects malicious behavior as well as known signatures. Implementation Group: IG2.

      • Malware Protection

  • CIS 11 Backup and recovery

    • 11.1 Data recovery process

      Document what is backed up, recovery priorities and how backup data is protected, and review it every year. Implementation Group: IG1.

      • Data Backup Policy
      • Disaster Recovery Policy

    • 11.2 Automated backups

      Schedule automatic backups of in-scope systems, running more often for more sensitive data. Implementation Group: IG1.

      • Data Backups

    • 11.3 Protected backup data

      Secure backup copies as strongly as the live data they hold, for example by encrypting them or storing them separately. Implementation Group: IG1.

      • Data Backups
      • Data Backup Policy
      • Encryption of Data at Rest

    • 11.4 Isolated backup copy

      Keep a copy of backup data isolated from production, for example offline, in a separate cloud account or behind tightly restricted access. Implementation Group: IG1.

      • Data Backup Policy
      • Data Backups

    • 11.5 Data recovery testing

      Restore a sample of backups on a regular schedule to prove they work. Implementation Group: IG2.

      • Backup Restoration Testing

  • CIS 12 Network equipment and architecture

    • 12.1 Current network equipment software

      Run routers, switches, firewalls and other network equipment on the latest stable release that still receives vendor support. Implementation Group: IG1.

      • Timely Security Updates

    • 12.2 Secure network architecture

      Design the network around segmentation, least privilege and availability, and review the design every year. Implementation Group: IG2.

      • Network Security Policy & Procedure
      • Network & Data Flow Diagrams
      • Limit Network Connections

    • 12.3 Secure network administration

      Administer network equipment securely, for example with version-controlled configuration and encrypted management protocols. Implementation Group: IG2.

      • Network Security Policy & Procedure
      • Secure Configuration Baselines
      • Secure System Modification

    • 12.4 Network architecture diagrams

      Keep diagrams and other documentation of the network current, reviewing them every year. Implementation Group: IG2.

      • Network & Data Flow Diagrams

    • 12.5 Central network authentication and auditing

      Authenticate, authorize and audit network access through a central service. Implementation Group: IG2.

      • Access Control Policy & Procedure
      • Centralized Security Logging

    • 12.6 Secure network protocols

      Use secure protocols to manage the network and to connect to it, such as enterprise-grade wireless authentication. Implementation Group: IG2.

      • Transmission Confidentiality
      • Network Security Policy & Procedure

    • 12.7 VPN for remote devices

      Make remote devices connect through the enterprise VPN, authenticated centrally, before they reach enterprise resources. Implementation Group: IG2.

      • Network Security Policy & Procedure
      • Multi-Factor Authentication

    • 12.8 Dedicated administration workstations

      Use workstations or virtual environments set aside for administration, isolated from the main network and without internet access. Implementation Group: IG3.

      • Dedicated Administrator Accounts
      • Network Security Policy & Procedure

  • CIS 13 Watching and defending the network

    • 13.1 Central security alerting

      Correlate security events from across the estate in one place and raise alerts from it, for example through a SIEM. Implementation Group: IG2.

      • Centralized Security Logging
      • Anomalous Behavior Detection
      • Automated Incident Reporting

    • 13.2 Host-based intrusion detection

      Add intrusion detection on individual hosts wherever it suits the system and the platform allows it. Implementation Group: IG2.

      • Anomalous Behavior Detection

    • 13.3 Network intrusion detection

      Watch network traffic for signs of intrusion, using a cloud provider's detection service where the workload runs in the cloud. Implementation Group: IG2.

      • Anomalous Behavior Detection

    • 13.4 Filtering between network segments

      Inspect and restrict traffic crossing from one network segment to another where that adds protection. Implementation Group: IG2.

      • External System Connections
      • Limit Network Connections

    • 13.5 Access control for remote devices

      Decide what remotely connecting devices may reach based on their security state, such as current anti-malware and configuration compliance. Implementation Group: IG2.

      • Endpoint Security Policy
      • Endpoint Security Validation

    • 13.6 Network flow logs

      Capture flow records of network traffic so they can be analysed and alerted on. Implementation Group: IG2.

      • External System Connections
      • Centralized Security Logging

    • 13.7 Host-based intrusion prevention

      Block attacks on individual hosts, for example with an endpoint detection and response agent, wherever that is suitable. Implementation Group: IG3.

      • Malware Protection
      • Anomalous Behavior Detection

    • 13.8 Network intrusion prevention

      Stop hostile network traffic automatically, with an in-line prevention system or a cloud provider service that does the same. Implementation Group: IG3.

    • 13.9 Port-level network access control

      Admit only authenticated devices at the network port, for example with 802.1X. Implementation Group: IG3.

    • 13.10 Application-layer filtering

      Inspect traffic by application protocol, for example with a web application firewall or filtering proxy, and block what is not allowed. Implementation Group: IG3.

    • 13.11 Tuned alert thresholds

      Adjust security alert thresholds regularly so alerts stay meaningful. Implementation Group: IG3.

      • Anomalous Behavior Detection
      • Centralized Security Logging

  • CIS 14 Staff security awareness and skills

    • 14.1 Security awareness program

      Run an awareness program that teaches staff to work securely, with training at hire and at least yearly, and refresh its content regularly. Implementation Group: IG1.

      • Security & Privacy Awareness
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • 14.2 Recognizing social engineering

      Teach staff to spot manipulation attempts such as phishing, impersonation calls and tailgating. Implementation Group: IG1.

      • Security & Privacy Awareness
      • Periodic Security & Privacy Training

    • 14.3 Good authentication habits

      Teach staff how to use MFA, choose strong passwords and look after their credentials. Implementation Group: IG1.

      • Security & Privacy Awareness
      • Periodic Security & Privacy Training
      • Password Management Guidelines

    • 14.4 Handling data safely

      Teach staff how to store, share, archive and destroy sensitive data correctly, including keeping desks and screens clear. Implementation Group: IG1.

      • Security & Privacy Awareness
      • Periodic Security & Privacy Training
      • Clear Desk & Clear Screen

    • 14.5 Avoiding accidental data exposure

      Teach staff the common ways data is exposed by mistake, such as misdirected email, lost devices or sharing with the wrong audience. Implementation Group: IG1.

      • Security & Privacy Awareness
      • Periodic Security & Privacy Training

    • 14.6 Recognizing and reporting incidents

      Teach staff the signs of a possible incident and how to report one. Implementation Group: IG1.

      • Security & Privacy Awareness
      • Periodic Security & Privacy Training
      • Automated Incident Reporting

    • 14.7 Spotting missing security updates

      Teach staff to check that their devices and software are up to date and to report any that are not. Implementation Group: IG1.

      • Security & Privacy Awareness
      • Periodic Security & Privacy Training

    • 14.8 Risks of insecure networks

      Teach staff the dangers of connecting to, or sending enterprise data over, untrusted networks, particularly when working remotely. Implementation Group: IG1.

      • Security & Privacy Awareness
      • Periodic Security & Privacy Training

    • 14.9 Role-specific security training

      Give people in specialist roles, such as IT administrators and developers, training on the security skills their work needs. Implementation Group: IG2.

      • Periodic Security & Privacy Training
      • Security & Privacy Awareness

  • CIS 15 Third-party service providers

    • 15.1 Service provider inventory

      Keep a list of service providers with their classification and an internal contact for each, and review it regularly. Implementation Group: IG1.

      • Third-Party Criticality Assessments

    • 15.2 Service provider management policy

      Have a policy that covers how service providers are classified, recorded, assessed, monitored and retired, reviewed every year. Implementation Group: IG2.

      • Vendor Management Policy & Procedure

    • 15.3 Service provider classification

      Rank providers by factors such as the sensitivity and volume of data they handle, availability needs, applicable regulation and inherent risk. Implementation Group: IG2.

      • Third-Party Criticality Assessments

    • 15.4 Security terms in provider contracts

      Include security obligations in provider contracts, such as a minimum security program, incident notification and data disposal. Implementation Group: IG2.

      • Vendor Management Policy & Procedure
      • Subservice Organization Evaluation

    • 15.5 Service provider assessment

      Assess providers as the policy requires, using assurance reports, questionnaires or other evidence, before onboarding and periodically after. Implementation Group: IG3.

      • Third-Party Criticality Assessments
      • Subservice Organization Evaluation

    • 15.6 Ongoing provider monitoring

      Keep watching providers between assessments, for example through reassessments and changes to their service or security posture. Implementation Group: IG3.

      • Management Review of Third-Party Risks
      • Subservice Organization Evaluation

    • 15.7 Secure provider offboarding

      When a provider relationship ends, shut down the accounts it used, cut off data transfers and get confirmation that enterprise data it held is destroyed. Implementation Group: IG3.

      • Vendor Management Policy & Procedure

  • CIS 16 Secure application development

    • 16.1 Secure development process

      Run a documented secure development lifecycle covering design, coding standards, testing and third-party code, and review it every year. Implementation Group: IG2.

      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes

    • 16.2 Handling reported software vulnerabilities

      Give outsiders a way to report vulnerabilities in the organization's software, then track and fix each report within set timelines. Implementation Group: IG2.

      • Incident Reporting Assistance
      • Centralized Flaw Remediation
      • Vulnerability Management Policy & Procedure

    • 16.3 Root cause analysis of vulnerabilities

      Look for the underlying cause of security flaws in code so whole classes of flaw can be fixed, not just single instances. Implementation Group: IG2.

      • Vulnerability Management Policy & Procedure

    • 16.4 Inventory of third-party components

      Keep a list of the third-party libraries and components used in development, with an assessment of the risk each one brings. Implementation Group: IG2.

      • Vulnerability Remediation Process

    • 16.5 Current, trusted third-party components

      Use third-party components from trusted sources, keep them up to date and check them for vulnerabilities before adoption. Implementation Group: IG2.

      • Vulnerability Remediation Process
      • Centralized Flaw Remediation

    • 16.6 Severity ratings for application flaws

      Rate application vulnerabilities with a consistent scheme that sets fix priorities and a minimum acceptable security level. Implementation Group: IG2.

      • Vulnerability Management Policy & Procedure
      • Vulnerability Remediation Process

    • 16.7 Hardened templates for application infrastructure

      Build application servers, databases, web servers and containers from recognized hardening templates. Implementation Group: IG2.

      • Secure Configuration Baselines

    • 16.8 Separate production and non-production

      Keep production systems apart from development and test environments. Implementation Group: IG2.

      • Test Data Protection

    • 16.9 Secure coding training for developers

      Train developers in application security and secure coding, at least yearly and suited to their role. Implementation Group: IG2.

      • Periodic Security & Privacy Training
      • Security & Privacy Awareness

    • 16.10 Secure design principles

      Build applications on secure design principles such as least privilege, validating all input and a minimal attack surface. Implementation Group: IG2.

      • Change Management Policy & Procedure
      • Input Range Validation
      • Mandatory Field Validation

    • 16.11 Proven security components

      Use well-reviewed libraries or platform services for identity, cryptography and logging instead of writing custom versions. Implementation Group: IG2.

      • Change Management Policy & Procedure
      • Encryption Policy & Procedure

    • 16.12 Code-level security checks

      Run static and dynamic analysis in the development pipeline to confirm code meets secure coding standards. Implementation Group: IG3.

      • Vulnerability Remediation Process
      • Approval of Changes

    • 16.13 Application penetration testing

      Have critical applications penetration tested, with authenticated testing that can uncover business logic flaws. Implementation Group: IG3.

      • Penetration Testing

    • 16.14 Threat modeling

      Examine designs for the ways an attacker could abuse them, and fix those weaknesses before building starts. Implementation Group: IG3.

      • Change Management Policy & Procedure

  • CIS 17 Handling security incidents

    • 17.1 Incident handling lead

      Make a named individual accountable for coordinating incident handling, with a deputy who can step in. Implementation Group: IG1.

      • Assigned Security & Privacy Responsibilities
      • Incident Management Policy & Procedure

    • 17.2 Incident contact list

      Keep up-to-date contact details for everyone who must hear about an incident, such as staff, providers, insurers, law enforcement and authorities. Implementation Group: IG1.

      • Incident Management Policy & Procedure
      • Cybersecurity Responsibilities

    • 17.3 Staff incident reporting process

      Tell staff how, to whom, how quickly and with what details they should report a suspected incident, and keep that guidance available to everyone. Implementation Group: IG1.

      • Automated Incident Reporting
      • Incident Management Policy & Procedure

    • 17.4 Incident response process

      Document how incidents are handled, including roles, compliance obligations and communication plans, and review it every year. Implementation Group: IG2.

      • Incident Management Policy & Procedure
      • Incident Tracking

    • 17.5 Incident response roles

      Assign incident response responsibilities across functions such as legal, IT, security, communications and management. Implementation Group: IG2.

      • Incident Management Policy & Procedure
      • Assigned Security & Privacy Responsibilities

    • 17.6 Communication channels during incidents

      Agree beforehand how responders will talk and report during an incident, with a backup channel if the usual one is down or compromised. Implementation Group: IG2.

      • Incident Management Policy & Procedure

    • 17.7 Incident response exercises

      Rehearse incident response regularly with realistic scenarios and the people who would take part. Implementation Group: IG2.

      • Incident Response Exercises

    • 17.8 Post-incident reviews

      After an incident closes, hold a review that records what was learned and assigns actions to stop a repeat. Implementation Group: IG2.

      • Incident Tracking
      • Incident Management Policy & Procedure

    • 17.9 Incident thresholds

      Define what turns a security event into an incident, with examples, and review the definitions every year. Implementation Group: IG3.

      • Incident Management Policy & Procedure

  • CIS 18 Testing defenses through penetration tests

    • 18.1 Penetration testing program

      Run a penetration testing program sized to the organization, defining scope, frequency, limits, contacts and how findings are handled. Implementation Group: IG2.

      • Penetration Testing

    • 18.2 External penetration tests

      Have the internet-facing environment penetration tested on a regular schedule. Implementation Group: IG2.

      • Penetration Testing

    • 18.3 Fixing penetration test findings

      Remediate penetration test findings according to the organization's remediation priorities. Implementation Group: IG2.

      • Penetration Testing

    • 18.4 Validation of security measures

      Use each penetration test to check that defenses work, and adjust detection rules and other measures where they fell short. Implementation Group: IG3.

      • Penetration Testing

    • 18.5 Internal penetration tests

      Have the internal environment penetration tested on a regular schedule. Implementation Group: IG3.

      • Penetration Testing