Safeguard 12.1 Keep network infrastructure up to date
Keeping routers, switches, firewalls and other network infrastructure on supported, current software, with a monthly version review; the only IG1 safeguard in Control 12.
Control 12 Network infrastructure management
CIS Control 12 covers actively managing network devices so attackers cannot exploit vulnerable network services and access points: patch currency, secure architecture, secure management, diagrams, centralized AAA, secure protocols, VPN and admin workstations.
Safeguard 12.2 Secure network architecture
Designing and maintaining a secure network architecture that addresses segmentation, least privilege and availability, backed by policy and design rather than diagrams alone; diagrams themselves are 12.4.
Safeguard 12.3 Secure network infrastructure management
Managing network infrastructure securely, for example through version-controlled infrastructure as code and secure management protocols such as SSH and HTTPS.
Safeguard 12.4 Network architecture diagrams
Maintaining network architecture diagrams or other network system documentation with an annual review cycle; the documentation counterpart to the architecture design in 12.2.
Safeguard 12.5 Centralized network AAA
Centralizing network authentication, authorization and auditing (AAA) for network devices and access, so administrator access and changes are controlled and logged in one place.
Safeguard 12.6 Secure network management protocols
Using secure network management and communication protocols such as 802.1X and WPA2 Enterprise or stronger, as opposed to the secure management practices of 12.3.
Safeguard 12.7 VPN and AAA for remote devices
Requiring users on end-user devices to authenticate to enterprise-managed VPN and authentication services before reaching enterprise resources; the remote access safeguard of Control 12.
Safeguard 12.8 Dedicated administrative computing resources
Providing physically or logically separated computing resources for all administrative work, segmented from the primary network and without internet access; the only IG3 safeguard in Control 12.
