The written policies the CIS Controls call for, built around CIS's free IG1 policy templates: what each template covers, which Safeguards it supports, and what the assessment specification checks in the documented process.
What a CIS-aligned enterprise asset management policy must cover: the inventory fields Safeguard 1.1 lists, the weekly handling of unauthorized assets, review frequency and how the assessment specification scores the inventory.
What a CIS-aligned software asset management policy must cover: inventory fields, twice-yearly review, monthly vendor support checks, documented exceptions for unsupported software and handling unauthorized software.
What a CIS-aligned data management policy must contain: the five elements of Safeguard 3.1, minimum and maximum retention, disposal proportionate to sensitivity, encryption on end-user devices and how completeness is scored.
What a CIS-aligned secure configuration policy covers across Controls 4, 9 and 12: the documented configuration process and its yearly review, network device configuration, default accounts, supported browsers and up-to-date network infrastructure.
What a CIS-aligned account and credential policy must set: the account inventory and its quarterly scoring window, unique password lengths, 45-day dormant account rule, access granting and revoking processes and MFA for exposed and admin access.
What a CIS-aligned vulnerability management policy must include: the documented process and yearly review, a risk-based remediation process reviewed monthly, monthly automated OS patching and the scoring windows the assessment specification uses.
What a CIS-aligned audit log management policy must define: logging requirements, how logs are collected, reviewed and kept, enough storage, and why Control 8 grows from 3 Safeguards at IG1 to 11 at IG2.
What a CIS-aligned malware defense policy covers: anti-malware on every enterprise asset, automatic signature updates, autorun for removable media, and the IG2 additions of central management and behavior-based detection.
What a CIS-aligned data recovery policy must set: scope, prioritization and backup security, weekly or more frequent automated backups, protecting and isolating recovery data, and recovery testing at IG2.
What a CIS-aligned security awareness and skills training policy must require: training at hire and yearly, the eight IG1 training topics from social engineering to insecure networks, and the IG2 role-specific training.
What a CIS-aligned service provider management policy must address: the provider inventory required at IG1, classification, contract security requirements, assessment, monitoring and decommissioning as the policy grows into IG2 and IG3.
What a CIS-aligned incident response policy must establish: an incident handling lead and backup, contact lists, a workforce reporting process, and the documented response process, roles and communications that IG2 adds.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.