CIS Critical Security Controls v8

CIS Critical Security Controls v8

• CIS Controls v8 1.1 — Establish and Maintain Detailed Enterprise Asset Inventory
• CIS Controls v8 1.2 — Address Unauthorized Assets
• CIS Controls v8 1.3 — Utilize an Active Discovery Tool
• CIS Controls v8 1.4 — Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory
• CIS Controls v8 1.5 — Use a Passive Asset Discovery Tool

CIS Critical Security Controls v8

• CIS Controls v8 2.1 — Establish and Maintain a Software Inventory
• CIS Controls v8 2.2 — Ensure Authorized Software is Currently Supported
• CIS Controls v8 2.3 — Address Unauthorized Software
• CIS Controls v8 2.4 — Utilize Automated Software Inventory Tools
• CIS Controls v8 2.5 — Allowlist Authorized Software

+ 2 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 3.1 — Establish and Maintain a Data Management Process
• CIS Controls v8 3.2 — Establish and Maintain a Data Inventory
• CIS Controls v8 3.3 — Configure Data Access Control Lists
• CIS Controls v8 3.4 — Enforce Data Retention
• CIS Controls v8 3.5 — Securely Dispose of Data

+ 9 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 4.1 — Establish and Maintain a Secure Configuration Process
• CIS Controls v8 4.2 — Establish and Maintain a Secure Configuration Process for Network Infrastructure
• CIS Controls v8 4.3 — Configure Automatic Session Locking on Enterprise Assets
• CIS Controls v8 4.4 — Implement and Manage a Firewall on Servers
• CIS Controls v8 4.5 — Implement and Manage a Firewall on End-User Devices

+ 7 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 5.1 — Establish and Maintain an Inventory of Accounts
• CIS Controls v8 5.2 — Use Unique Passwords
• CIS Controls v8 5.3 — Disable Dormant Accounts
• CIS Controls v8 5.4 — Restrict Administrator Privileges to Dedicated Administrator Accounts
• CIS Controls v8 5.5 — Establish and Maintain an Inventory of Service Accounts

+ 1 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 6.1 — Establish an Access Granting Process
• CIS Controls v8 6.2 — Establish an Access Revoking Process
• CIS Controls v8 6.3 — Require MFA for Externally-Exposed Applications
• CIS Controls v8 6.4 — Require MFA for Remote Network Access
• CIS Controls v8 6.5 — Require MFA for Administrative Access

+ 3 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 7.1 — Establish and Maintain a Vulnerability Management Process
• CIS Controls v8 7.2 — Establish and Maintain a Remediation Process
• CIS Controls v8 7.3 — Perform Automated Operating System Patch Management
• CIS Controls v8 7.4 — Perform Automated Application Patch Management
• CIS Controls v8 7.5 — Perform Automated Vulnerability Scans of Internal Enterprise Assets

+ 2 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 8.1 — Establish and Maintain an Audit Log Management Process
• CIS Controls v8 8.2 — Collect Audit Logs
• CIS Controls v8 8.3 — Ensure Adequate Audit Log Storage
• CIS Controls v8 8.4 — Standardize Time Synchronization
• CIS Controls v8 8.5 — Collect Detailed Audit Logs

+ 7 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 9.1 — Ensure Use of Only Fully Supported Browsers and Email Clients
• CIS Controls v8 9.2 — Use DNS Filtering Services
• CIS Controls v8 9.3 — Maintain and Enforce Network-Based URL Filters
• CIS Controls v8 9.4 — Restrict Unnecessary or Unauthorized Browser and Email Client Extensions
• CIS Controls v8 9.5 — Implement DMARC

+ 2 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 10.1 — Deploy and Maintain Anti-Malware Software
• CIS Controls v8 10.2 — Configure Automatic Anti-Malware Signature Updates
• CIS Controls v8 10.3 — Disable Autorun and Autoplay for Removable Media
• CIS Controls v8 10.4 — Configure Automatic Anti-Malware Scanning of Removable Media
• CIS Controls v8 10.5 — Enable Anti-Exploitation Features

+ 2 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 11.1 — Establish and Maintain a Data Recovery Process
• CIS Controls v8 11.2 — Perform Automated Backups
• CIS Controls v8 11.3 — Protect Recovery Data
• CIS Controls v8 11.4 — Establish and Maintain an Isolated Instance of Recovery Data
• CIS Controls v8 11.5 — Test Data Recovery

CIS Critical Security Controls v8

• CIS Controls v8 12.1 — Ensure Network Infrastructure is Up-to-Date
• CIS Controls v8 12.2 — Establish and Maintain a Secure Network Architecture
• CIS Controls v8 12.3 — Securely Manage Network Infrastructure
• CIS Controls v8 12.4 — Establish and Maintain Architecture Diagram(s)
• CIS Controls v8 12.5 — Centralize Network Authentication, Authorization, and Auditing (AAA)

+ 3 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 13.1 — Centralize Security Event Alerting
• CIS Controls v8 13.2 — Deploy a Host-Based Intrusion Detection Solution
• CIS Controls v8 13.3 — Deploy a Network Intrusion Detection Solution
• CIS Controls v8 13.4 — Perform Traffic Filtering Between Network Segments
• CIS Controls v8 13.5 — Manage Access Control for Remote Assets

+ 6 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 14.1 — Establish and Maintain a Security Awareness Program
• CIS Controls v8 14.2 — Train Workforce Members to Recognize Social Engineering Attacks
• CIS Controls v8 14.3 — Train Workforce Members on Authentication Best Practices
• CIS Controls v8 14.4 — Train Workforce on Data Handling Best Practices
• CIS Controls v8 14.5 — Train Workforce Members on Causes of Unintentional Data Exposure

+ 4 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 15.1 — Establish and Maintain an Inventory of Service Providers
• CIS Controls v8 15.2 — Establish and Maintain a Service Provider Management Policy
• CIS Controls v8 15.3 — Classify Service Providers
• CIS Controls v8 15.4 — Ensure Service Provider Contracts Include Security Requirements
• CIS Controls v8 15.5 — Assess Service Providers

+ 2 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 16.1 — Establish and Maintain a Secure Application Development Process
• CIS Controls v8 16.2 — Establish and Maintain a Process to Accept and Address Software Vulnerabilities
• CIS Controls v8 16.3 — Perform Root Cause Analysis on Security Vulnerabilities
• CIS Controls v8 16.4 — Establish and Manage an Inventory of Third-Party Software Components
• CIS Controls v8 16.5 — Use Up-to-Date and Trusted Third-Party Software Components

+ 9 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 17.1 — Designate Personnel to Manage Incident Handling
• CIS Controls v8 17.2 — Establish and Maintain Contact Information for Reporting Security Incidents
• CIS Controls v8 17.3 — Establish and Maintain an Enterprise Process for Reporting Incidents
• CIS Controls v8 17.4 — Establish and Maintain an Incident Response Process
• CIS Controls v8 17.5 — Assign Key Roles and Responsibilities

+ 4 more in this section

CIS Critical Security Controls v8

• CIS Controls v8 18.1 — Establish and Maintain a Penetration Testing Program
• CIS Controls v8 18.2 — Perform Periodic External Penetration Tests
• CIS Controls v8 18.3 — Remediate Penetration Test Findings
• CIS Controls v8 18.4 — Validate Security Measures
• CIS Controls v8 18.5 — Perform Periodic Internal Penetration Tests