Control 1 Inventory and control of enterprise assets
CIS Control 1 Safeguards for knowing every device connected to the enterprise: the detailed asset inventory, handling unauthorized assets, and active, DHCP-based and passive discovery.
CIS Controls
The CIS Critical Security Controls v8.1: 18 Controls and 153 Safeguards prioritized by Implementation Group, with what each Safeguard asks for, how the CIS assessment specification measures it, the evidence that shows it and open-source tooling.
Control 2 Inventory and control of software assets
CIS Control 2 Safeguards for knowing and controlling the software that runs in the enterprise: the software inventory, support status, unauthorized software, automated inventory tools and allowlisting of software, libraries and scripts.
Control 3 Data protection
CIS Control 3 Safeguards for data: the data management process, data inventory, access control lists, retention, disposal, classification, data flows, encryption, segmentation, data loss prevention and logging of sensitive data access.
Control 4 Secure configuration of enterprise assets and software
CIS Control 4 Safeguards for hardening: documented secure configuration processes, session locking, host firewalls, secure administration, default accounts, unnecessary services, trusted DNS and mobile device controls.
Control 5 Account management
CIS Control 5 Safeguards for the accounts themselves: account and service account inventories, unique passwords, dormant accounts, dedicated administrator accounts and centralized account management.
Control 6 Access control management
CIS Control 6 Safeguards for granting and removing access: access granting and revoking processes, MFA for external applications, remote access and administrators, an inventory of identity systems, centralized access control and role-based access control.
Control 7 Continuous vulnerability management
CIS Control 7 Safeguards for finding and fixing vulnerabilities: the vulnerability management and remediation processes, automated operating system and application patching, internal and external scanning, and remediation.
Control 8 Audit log management
CIS Control 8 Safeguards for audit logging: the log management process, log collection and storage, time synchronization, detailed, DNS, URL and command-line logs, centralization, retention, review and service provider logs.
Control 9 Email and web browser protections
CIS Control 9 Safeguards for the email and web attack surface: supported browsers and email clients, DNS and URL filtering, browser and email extensions, DMARC, file type blocking and email server anti-malware.
Control 10 Malware defenses
CIS Control 10 covers stopping or containing malicious applications, code and scripts on enterprise assets: anti-malware deployment, signature updates, removable media, anti-exploitation features, central management and behavior-based detection.
Control 11 Data recovery
CIS Control 11 covers data recovery practices that can return in-scope enterprise assets to a trusted, pre-incident state: the recovery process, automated backups, protecting and isolating recovery data, and recovery testing.
Control 12 Network infrastructure management
CIS Control 12 covers actively managing network devices so attackers cannot exploit vulnerable network services and access points: patch currency, secure architecture, secure management, diagrams, centralized AAA, secure protocols, VPN and admin workstations.
Control 13 Network monitoring and defense
CIS Control 13 covers the processes and tools for monitoring and defending the enterprise network and user base: centralized alerting, host and network intrusion detection and prevention, segment filtering, remote access control, flow logs and alert tuning.
Control 14 Security awareness and skills training
CIS Control 14 covers the security awareness program and the training topics it must include: social engineering, authentication, data handling, unintentional exposure, incident reporting, missing updates, insecure networks and role-specific skills.
Control 15 Service provider management
CIS Control 15 covers evaluating service providers that hold sensitive data or run critical IT platforms or processes: provider inventory, policy, classification, contract security requirements, assessment, monitoring and secure decommissioning.
Control 16 Application software security
CIS Control 16 covers the security life cycle of in-house developed, hosted or acquired software: secure development process, vulnerability handling, third-party components, hardening, environment separation, developer training, code checks, application penetration testing and threat modeling.
Control 17 Incident response management
CIS Control 17 covers building and maintaining an incident response capability: incident handling personnel, contact lists, workforce reporting, the response process, roles, communication mechanisms, exercises, post-incident reviews and incident thresholds.
Control 18 Penetration testing
CIS Control 18 covers testing how effective and resilient enterprise assets are by finding and exploiting weaknesses in people, processes and technology: the testing program, external and internal tests, remediation and validating security measures.
CIS Controls IG1, IG2 and IG3
What each CIS Controls Implementation Group contains in practice: the 56 IG1 essential cyber hygiene Safeguards as a checklist, the 74 Safeguards IG2 adds, the 23 IG3 adds, and how small businesses start with IG1.
CIS Controls policy templates
The written policies the CIS Controls call for, built around CIS's free IG1 policy templates: what each template covers, which Safeguards it supports, and what the assessment specification checks in the documented process.
CIS Benchmarks and hardening
The CIS Benchmarks that put Control 4 secure configuration into practice: what they are, Level 1, Level 2 and STIG profiles, CIS-CAT scanning, CIS Hardened Images, cloud Benchmarks and open-source tools that check them.
CIS Controls risk assessment and measurement
How to assess risk and measure progress with the CIS Controls: CIS RAM, its IG1 workbook, the Controls as a reasonable security baseline, the Community Defense Model and the metrics in the assessment specification.
CIS Controls for cloud, mobile, IoT and service providers
Applying the CIS Controls outside the traditional office network and for specific kinds of organization: the cloud, mobile and IoT companion guides, MSPs and consultants delivering the Controls to clients, and state and local government.
CIS Controls guides
Buyer guides for organizations asked to adopt or show the CIS Controls: implementation groups, assessment, cost, roadmap, the NIST CSF comparison and state safe harbor laws.
