# CIS Critical Security Controls v8 > The Center for Internet Security's prioritised set of 18 controls and 153 safeguards for cyber defence. Implementation Groups IG1, IG2 and IG3 stage adoption from a hygiene baseline up to advanced defence. - Source: https://support.icompaas.com/compliance/cis-controls-v8 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## CIS Critical Security Controls v8: control library 153 controls in 18 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown. ### Control 1 — Inventory and Control of Enterprise Assets CIS Critical Security Controls v8 - [CIS Controls v8 1.1 — Establish and Maintain Detailed Enterprise Asset Inventory](https://support.icompaas.com/compliance/cis-controls-v8/1-1-establish-and-maintain-detailed-enterprise-asset-inventory) - [CIS Controls v8 1.2 — Address Unauthorized Assets](https://support.icompaas.com/compliance/cis-controls-v8/1-2-address-unauthorized-assets) - [CIS Controls v8 1.3 — Utilize an Active Discovery Tool](https://support.icompaas.com/compliance/cis-controls-v8/1-3-utilize-an-active-discovery-tool) - [CIS Controls v8 1.4 — Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory](https://support.icompaas.com/compliance/cis-controls-v8/1-4-use-dynamic-host-configuration-protocol-dhcp-logging-to-update-enterprise-asset) - [CIS Controls v8 1.5 — Use a Passive Asset Discovery Tool](https://support.icompaas.com/compliance/cis-controls-v8/1-5-use-a-passive-asset-discovery-tool) ### Control 2 — Inventory and Control of Software Assets CIS Critical Security Controls v8 - [CIS Controls v8 2.1 — Establish and Maintain a Software Inventory](https://support.icompaas.com/compliance/cis-controls-v8/2-1-establish-and-maintain-a-software-inventory) - [CIS Controls v8 2.2 — Ensure Authorized Software is Currently Supported](https://support.icompaas.com/compliance/cis-controls-v8/2-2-ensure-authorized-software-is-currently-supported) - [CIS Controls v8 2.3 — Address Unauthorized Software](https://support.icompaas.com/compliance/cis-controls-v8/2-3-address-unauthorized-software) - [CIS Controls v8 2.4 — Utilize Automated Software Inventory Tools](https://support.icompaas.com/compliance/cis-controls-v8/2-4-utilize-automated-software-inventory-tools) - [CIS Controls v8 2.5 — Allowlist Authorized Software](https://support.icompaas.com/compliance/cis-controls-v8/2-5-allowlist-authorized-software) - [CIS Controls v8 2.6 — Allowlist Authorized Libraries](https://support.icompaas.com/compliance/cis-controls-v8/2-6-allowlist-authorized-libraries) - [CIS Controls v8 2.7 — Allowlist Authorized Scripts](https://support.icompaas.com/compliance/cis-controls-v8/2-7-allowlist-authorized-scripts) ### Control 3 — Data Protection CIS Critical Security Controls v8 - [CIS Controls v8 3.1 — Establish and Maintain a Data Management Process](https://support.icompaas.com/compliance/cis-controls-v8/3-1-establish-and-maintain-a-data-management-process) - [CIS Controls v8 3.2 — Establish and Maintain a Data Inventory](https://support.icompaas.com/compliance/cis-controls-v8/3-2-establish-and-maintain-a-data-inventory) - [CIS Controls v8 3.3 — Configure Data Access Control Lists](https://support.icompaas.com/compliance/cis-controls-v8/3-3-configure-data-access-control-lists) - [CIS Controls v8 3.4 — Enforce Data Retention](https://support.icompaas.com/compliance/cis-controls-v8/3-4-enforce-data-retention) - [CIS Controls v8 3.5 — Securely Dispose of Data](https://support.icompaas.com/compliance/cis-controls-v8/3-5-securely-dispose-of-data) - [CIS Controls v8 3.6 — Encrypt Data on End-User Devices](https://support.icompaas.com/compliance/cis-controls-v8/3-6-encrypt-data-on-end-user-devices) - [CIS Controls v8 3.7 — Establish and Maintain a Data Classification Scheme](https://support.icompaas.com/compliance/cis-controls-v8/3-7-establish-and-maintain-a-data-classification-scheme) - [CIS Controls v8 3.8 — Document Data Flows](https://support.icompaas.com/compliance/cis-controls-v8/3-8-document-data-flows) - [CIS Controls v8 3.9 — Encrypt Data on Removable Media](https://support.icompaas.com/compliance/cis-controls-v8/3-9-encrypt-data-on-removable-media) - [CIS Controls v8 3.10 — Encrypt Sensitive Data in Transit](https://support.icompaas.com/compliance/cis-controls-v8/3-10-encrypt-sensitive-data-in-transit) - [CIS Controls v8 3.11 — Encrypt Sensitive Data at Rest](https://support.icompaas.com/compliance/cis-controls-v8/3-11-encrypt-sensitive-data-at-rest) - [CIS Controls v8 3.12 — Segment Data Processing and Storage Based on Sensitivity](https://support.icompaas.com/compliance/cis-controls-v8/3-12-segment-data-processing-and-storage-based-on-sensitivity) - [CIS Controls v8 3.13 — Deploy a Data Loss Prevention Solution](https://support.icompaas.com/compliance/cis-controls-v8/3-13-deploy-a-data-loss-prevention-solution) - [CIS Controls v8 3.14 — Log Sensitive Data Access](https://support.icompaas.com/compliance/cis-controls-v8/3-14-log-sensitive-data-access) ### Control 4 — Secure Configuration of Enterprise Assets and Software CIS Critical Security Controls v8 - [CIS Controls v8 4.1 — Establish and Maintain a Secure Configuration Process](https://support.icompaas.com/compliance/cis-controls-v8/4-1-establish-and-maintain-a-secure-configuration-process) - [CIS Controls v8 4.2 — Establish and Maintain a Secure Configuration Process for Network Infrastructure](https://support.icompaas.com/compliance/cis-controls-v8/4-2-establish-and-maintain-a-secure-configuration-process-for-network-infrastructure) - [CIS Controls v8 4.3 — Configure Automatic Session Locking on Enterprise Assets](https://support.icompaas.com/compliance/cis-controls-v8/4-3-configure-automatic-session-locking-on-enterprise-assets) - [CIS Controls v8 4.4 — Implement and Manage a Firewall on Servers](https://support.icompaas.com/compliance/cis-controls-v8/4-4-implement-and-manage-a-firewall-on-servers) - [CIS Controls v8 4.5 — Implement and Manage a Firewall on End-User Devices](https://support.icompaas.com/compliance/cis-controls-v8/4-5-implement-and-manage-a-firewall-on-end-user-devices) - [CIS Controls v8 4.6 — Securely Manage Enterprise Assets and Software](https://support.icompaas.com/compliance/cis-controls-v8/4-6-securely-manage-enterprise-assets-and-software) - [CIS Controls v8 4.7 — Manage Default Accounts on Enterprise Assets and Software](https://support.icompaas.com/compliance/cis-controls-v8/4-7-manage-default-accounts-on-enterprise-assets-and-software) - [CIS Controls v8 4.8 — Uninstall or Disable Unnecessary Services on Enterprise Assets and Software](https://support.icompaas.com/compliance/cis-controls-v8/4-8-uninstall-or-disable-unnecessary-services-on-enterprise-assets-and-software) - [CIS Controls v8 4.9 — Configure Trusted DNS Servers on Enterprise Assets](https://support.icompaas.com/compliance/cis-controls-v8/4-9-configure-trusted-dns-servers-on-enterprise-assets) - [CIS Controls v8 4.10 — Enforce Automatic Device Lockout on Portable End-User Devices](https://support.icompaas.com/compliance/cis-controls-v8/4-10-enforce-automatic-device-lockout-on-portable-end-user-devices) - [CIS Controls v8 4.11 — Enforce Remote Wipe Capability on Portable End-User Devices](https://support.icompaas.com/compliance/cis-controls-v8/4-11-enforce-remote-wipe-capability-on-portable-end-user-devices) - [CIS Controls v8 4.12 — Separate Enterprise Workspaces on Mobile End-User Devices](https://support.icompaas.com/compliance/cis-controls-v8/4-12-separate-enterprise-workspaces-on-mobile-end-user-devices) ### Control 5 — Account Management CIS Critical Security Controls v8 - [CIS Controls v8 5.1 — Establish and Maintain an Inventory of Accounts](https://support.icompaas.com/compliance/cis-controls-v8/5-1-establish-and-maintain-an-inventory-of-accounts) - [CIS Controls v8 5.2 — Use Unique Passwords](https://support.icompaas.com/compliance/cis-controls-v8/5-2-use-unique-passwords) - [CIS Controls v8 5.3 — Disable Dormant Accounts](https://support.icompaas.com/compliance/cis-controls-v8/5-3-disable-dormant-accounts) - [CIS Controls v8 5.4 — Restrict Administrator Privileges to Dedicated Administrator Accounts](https://support.icompaas.com/compliance/cis-controls-v8/5-4-restrict-administrator-privileges-to-dedicated-administrator-accounts) - [CIS Controls v8 5.5 — Establish and Maintain an Inventory of Service Accounts](https://support.icompaas.com/compliance/cis-controls-v8/5-5-establish-and-maintain-an-inventory-of-service-accounts) - [CIS Controls v8 5.6 — Centralize Account Management](https://support.icompaas.com/compliance/cis-controls-v8/5-6-centralize-account-management) ### Control 6 — Access Control Management CIS Critical Security Controls v8 - [CIS Controls v8 6.1 — Establish an Access Granting Process](https://support.icompaas.com/compliance/cis-controls-v8/6-1-establish-an-access-granting-process) - [CIS Controls v8 6.2 — Establish an Access Revoking Process](https://support.icompaas.com/compliance/cis-controls-v8/6-2-establish-an-access-revoking-process) - [CIS Controls v8 6.3 — Require MFA for Externally-Exposed Applications](https://support.icompaas.com/compliance/cis-controls-v8/6-3-require-mfa-for-externally-exposed-applications) - [CIS Controls v8 6.4 — Require MFA for Remote Network Access](https://support.icompaas.com/compliance/cis-controls-v8/6-4-require-mfa-for-remote-network-access) - [CIS Controls v8 6.5 — Require MFA for Administrative Access](https://support.icompaas.com/compliance/cis-controls-v8/6-5-require-mfa-for-administrative-access) - [CIS Controls v8 6.6 — Establish and Maintain an Inventory of Authentication and Authorization Systems](https://support.icompaas.com/compliance/cis-controls-v8/6-6-establish-and-maintain-an-inventory-of-authentication-and-authorization-systems) - [CIS Controls v8 6.7 — Centralize Access Control](https://support.icompaas.com/compliance/cis-controls-v8/6-7-centralize-access-control) - [CIS Controls v8 6.8 — Define and Maintain Role-Based Access Control](https://support.icompaas.com/compliance/cis-controls-v8/6-8-define-and-maintain-role-based-access-control) ### Control 7 — Continuous Vulnerability Management CIS Critical Security Controls v8 - [CIS Controls v8 7.1 — Establish and Maintain a Vulnerability Management Process](https://support.icompaas.com/compliance/cis-controls-v8/7-1-establish-and-maintain-a-vulnerability-management-process) - [CIS Controls v8 7.2 — Establish and Maintain a Remediation Process](https://support.icompaas.com/compliance/cis-controls-v8/7-2-establish-and-maintain-a-remediation-process) - [CIS Controls v8 7.3 — Perform Automated Operating System Patch Management](https://support.icompaas.com/compliance/cis-controls-v8/7-3-perform-automated-operating-system-patch-management) - [CIS Controls v8 7.4 — Perform Automated Application Patch Management](https://support.icompaas.com/compliance/cis-controls-v8/7-4-perform-automated-application-patch-management) - [CIS Controls v8 7.5 — Perform Automated Vulnerability Scans of Internal Enterprise Assets](https://support.icompaas.com/compliance/cis-controls-v8/7-5-perform-automated-vulnerability-scans-of-internal-enterprise-assets) - [CIS Controls v8 7.6 — Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets](https://support.icompaas.com/compliance/cis-controls-v8/7-6-perform-automated-vulnerability-scans-of-externally-exposed-enterprise-assets) - [CIS Controls v8 7.7 — Remediate Detected Vulnerabilities](https://support.icompaas.com/compliance/cis-controls-v8/7-7-remediate-detected-vulnerabilities) ### Control 8 — Audit Log Management CIS Critical Security Controls v8 - [CIS Controls v8 8.1 — Establish and Maintain an Audit Log Management Process](https://support.icompaas.com/compliance/cis-controls-v8/8-1-establish-and-maintain-an-audit-log-management-process) - [CIS Controls v8 8.2 — Collect Audit Logs](https://support.icompaas.com/compliance/cis-controls-v8/8-2-collect-audit-logs) - [CIS Controls v8 8.3 — Ensure Adequate Audit Log Storage](https://support.icompaas.com/compliance/cis-controls-v8/8-3-ensure-adequate-audit-log-storage) - [CIS Controls v8 8.4 — Standardize Time Synchronization](https://support.icompaas.com/compliance/cis-controls-v8/8-4-standardize-time-synchronization) - [CIS Controls v8 8.5 — Collect Detailed Audit Logs](https://support.icompaas.com/compliance/cis-controls-v8/8-5-collect-detailed-audit-logs) - [CIS Controls v8 8.6 — Collect DNS Query Audit Logs](https://support.icompaas.com/compliance/cis-controls-v8/8-6-collect-dns-query-audit-logs) - [CIS Controls v8 8.7 — Collect URL Request Audit Logs](https://support.icompaas.com/compliance/cis-controls-v8/8-7-collect-url-request-audit-logs) - [CIS Controls v8 8.8 — Collect Command-Line Audit Logs](https://support.icompaas.com/compliance/cis-controls-v8/8-8-collect-command-line-audit-logs) - [CIS Controls v8 8.9 — Centralize Audit Logs](https://support.icompaas.com/compliance/cis-controls-v8/8-9-centralize-audit-logs) - [CIS Controls v8 8.10 — Retain Audit Logs](https://support.icompaas.com/compliance/cis-controls-v8/8-10-retain-audit-logs) - [CIS Controls v8 8.11 — Conduct Audit Log Reviews](https://support.icompaas.com/compliance/cis-controls-v8/8-11-conduct-audit-log-reviews) - [CIS Controls v8 8.12 — Collect Service Provider Logs](https://support.icompaas.com/compliance/cis-controls-v8/8-12-collect-service-provider-logs) ### Control 9 — Email and Web Browser Protections CIS Critical Security Controls v8 - [CIS Controls v8 9.1 — Ensure Use of Only Fully Supported Browsers and Email Clients](https://support.icompaas.com/compliance/cis-controls-v8/9-1-ensure-use-of-only-fully-supported-browsers-and-email-clients) - [CIS Controls v8 9.2 — Use DNS Filtering Services](https://support.icompaas.com/compliance/cis-controls-v8/9-2-use-dns-filtering-services) - [CIS Controls v8 9.3 — Maintain and Enforce Network-Based URL Filters](https://support.icompaas.com/compliance/cis-controls-v8/9-3-maintain-and-enforce-network-based-url-filters) - [CIS Controls v8 9.4 — Restrict Unnecessary or Unauthorized Browser and Email Client Extensions](https://support.icompaas.com/compliance/cis-controls-v8/9-4-restrict-unnecessary-or-unauthorized-browser-and-email-client-extensions) - [CIS Controls v8 9.5 — Implement DMARC](https://support.icompaas.com/compliance/cis-controls-v8/9-5-implement-dmarc) - [CIS Controls v8 9.6 — Block Unnecessary File Types](https://support.icompaas.com/compliance/cis-controls-v8/9-6-block-unnecessary-file-types) - [CIS Controls v8 9.7 — Deploy and Maintain Email Server Anti-Malware Protections](https://support.icompaas.com/compliance/cis-controls-v8/9-7-deploy-and-maintain-email-server-anti-malware-protections) ### Control 10 — Malware Defenses CIS Critical Security Controls v8 - [CIS Controls v8 10.1 — Deploy and Maintain Anti-Malware Software](https://support.icompaas.com/compliance/cis-controls-v8/10-1-deploy-and-maintain-anti-malware-software) - [CIS Controls v8 10.2 — Configure Automatic Anti-Malware Signature Updates](https://support.icompaas.com/compliance/cis-controls-v8/10-2-configure-automatic-anti-malware-signature-updates) - [CIS Controls v8 10.3 — Disable Autorun and Autoplay for Removable Media](https://support.icompaas.com/compliance/cis-controls-v8/10-3-disable-autorun-and-autoplay-for-removable-media) - [CIS Controls v8 10.4 — Configure Automatic Anti-Malware Scanning of Removable Media](https://support.icompaas.com/compliance/cis-controls-v8/10-4-configure-automatic-anti-malware-scanning-of-removable-media) - [CIS Controls v8 10.5 — Enable Anti-Exploitation Features](https://support.icompaas.com/compliance/cis-controls-v8/10-5-enable-anti-exploitation-features) - [CIS Controls v8 10.6 — Centrally Manage Anti-Malware Software](https://support.icompaas.com/compliance/cis-controls-v8/10-6-centrally-manage-anti-malware-software) - [CIS Controls v8 10.7 — Use Behavior-Based Anti-Malware Software](https://support.icompaas.com/compliance/cis-controls-v8/10-7-use-behavior-based-anti-malware-software) ### Control 11 — Data Recovery CIS Critical Security Controls v8 - [CIS Controls v8 11.1 — Establish and Maintain a Data Recovery Process](https://support.icompaas.com/compliance/cis-controls-v8/11-1-establish-and-maintain-a-data-recovery-process) - [CIS Controls v8 11.2 — Perform Automated Backups](https://support.icompaas.com/compliance/cis-controls-v8/11-2-perform-automated-backups) - [CIS Controls v8 11.3 — Protect Recovery Data](https://support.icompaas.com/compliance/cis-controls-v8/11-3-protect-recovery-data) - [CIS Controls v8 11.4 — Establish and Maintain an Isolated Instance of Recovery Data](https://support.icompaas.com/compliance/cis-controls-v8/11-4-establish-and-maintain-an-isolated-instance-of-recovery-data) - [CIS Controls v8 11.5 — Test Data Recovery](https://support.icompaas.com/compliance/cis-controls-v8/11-5-test-data-recovery) ### Control 12 — Network Infrastructure Management CIS Critical Security Controls v8 - [CIS Controls v8 12.1 — Ensure Network Infrastructure is Up-to-Date](https://support.icompaas.com/compliance/cis-controls-v8/12-1-ensure-network-infrastructure-is-up-to-date) - [CIS Controls v8 12.2 — Establish and Maintain a Secure Network Architecture](https://support.icompaas.com/compliance/cis-controls-v8/12-2-establish-and-maintain-a-secure-network-architecture) - [CIS Controls v8 12.3 — Securely Manage Network Infrastructure](https://support.icompaas.com/compliance/cis-controls-v8/12-3-securely-manage-network-infrastructure) - [CIS Controls v8 12.4 — Establish and Maintain Architecture Diagram(s)](https://support.icompaas.com/compliance/cis-controls-v8/12-4-establish-and-maintain-architecture-diagram-s) - [CIS Controls v8 12.5 — Centralize Network Authentication, Authorization, and Auditing (AAA)](https://support.icompaas.com/compliance/cis-controls-v8/12-5-centralize-network-authentication-authorization-and-auditing-aaa) - [CIS Controls v8 12.6 — Use of Secure Network Management and Communication Protocols](https://support.icompaas.com/compliance/cis-controls-v8/12-6-use-of-secure-network-management-and-communication-protocols) - [CIS Controls v8 12.7 — Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure](https://support.icompaas.com/compliance/cis-controls-v8/12-7-ensure-remote-devices-utilize-a-vpn-and-are-connecting-to-an-enterprise-s-aaa) - [CIS Controls v8 12.8 — Establish and Maintain Dedicated Computing Resources for All Administrative Work](https://support.icompaas.com/compliance/cis-controls-v8/12-8-establish-and-maintain-dedicated-computing-resources-for-all-administrative-work) ### Control 13 — Network Monitoring and Defense CIS Critical Security Controls v8 - [CIS Controls v8 13.1 — Centralize Security Event Alerting](https://support.icompaas.com/compliance/cis-controls-v8/13-1-centralize-security-event-alerting) - [CIS Controls v8 13.2 — Deploy a Host-Based Intrusion Detection Solution](https://support.icompaas.com/compliance/cis-controls-v8/13-2-deploy-a-host-based-intrusion-detection-solution) - [CIS Controls v8 13.3 — Deploy a Network Intrusion Detection Solution](https://support.icompaas.com/compliance/cis-controls-v8/13-3-deploy-a-network-intrusion-detection-solution) - [CIS Controls v8 13.4 — Perform Traffic Filtering Between Network Segments](https://support.icompaas.com/compliance/cis-controls-v8/13-4-perform-traffic-filtering-between-network-segments) - [CIS Controls v8 13.5 — Manage Access Control for Remote Assets](https://support.icompaas.com/compliance/cis-controls-v8/13-5-manage-access-control-for-remote-assets) - [CIS Controls v8 13.6 — Collect Network Traffic Flow Logs](https://support.icompaas.com/compliance/cis-controls-v8/13-6-collect-network-traffic-flow-logs) - [CIS Controls v8 13.7 — Deploy a Host-Based Intrusion Prevention Solution](https://support.icompaas.com/compliance/cis-controls-v8/13-7-deploy-a-host-based-intrusion-prevention-solution) - [CIS Controls v8 13.8 — Deploy a Network Intrusion Prevention Solution](https://support.icompaas.com/compliance/cis-controls-v8/13-8-deploy-a-network-intrusion-prevention-solution) - [CIS Controls v8 13.9 — Deploy Port-Level Access Control](https://support.icompaas.com/compliance/cis-controls-v8/13-9-deploy-port-level-access-control) - [CIS Controls v8 13.10 — Perform Application Layer Filtering](https://support.icompaas.com/compliance/cis-controls-v8/13-10-perform-application-layer-filtering) - [CIS Controls v8 13.11 — Tune Security Event Alerting Thresholds](https://support.icompaas.com/compliance/cis-controls-v8/13-11-tune-security-event-alerting-thresholds) ### Control 14 — Security Awareness and Skills Training CIS Critical Security Controls v8 - [CIS Controls v8 14.1 — Establish and Maintain a Security Awareness Program](https://support.icompaas.com/compliance/cis-controls-v8/14-1-establish-and-maintain-a-security-awareness-program) - [CIS Controls v8 14.2 — Train Workforce Members to Recognize Social Engineering Attacks](https://support.icompaas.com/compliance/cis-controls-v8/14-2-train-workforce-members-to-recognize-social-engineering-attacks) - [CIS Controls v8 14.3 — Train Workforce Members on Authentication Best Practices](https://support.icompaas.com/compliance/cis-controls-v8/14-3-train-workforce-members-on-authentication-best-practices) - [CIS Controls v8 14.4 — Train Workforce on Data Handling Best Practices](https://support.icompaas.com/compliance/cis-controls-v8/14-4-train-workforce-on-data-handling-best-practices) - [CIS Controls v8 14.5 — Train Workforce Members on Causes of Unintentional Data Exposure](https://support.icompaas.com/compliance/cis-controls-v8/14-5-train-workforce-members-on-causes-of-unintentional-data-exposure) - [CIS Controls v8 14.6 — Train Workforce Members on Recognizing and Reporting Security Incidents](https://support.icompaas.com/compliance/cis-controls-v8/14-6-train-workforce-members-on-recognizing-and-reporting-security-incidents) - [CIS Controls v8 14.7 — Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates](https://support.icompaas.com/compliance/cis-controls-v8/14-7-train-workforce-on-how-to-identify-and-report-if-their-enterprise-assets-are-missing) - [CIS Controls v8 14.8 — Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks](https://support.icompaas.com/compliance/cis-controls-v8/14-8-train-workforce-on-the-dangers-of-connecting-to-and-transmitting-enterprise-data) - [CIS Controls v8 14.9 — Conduct Role-Specific Security Awareness and Skills Training](https://support.icompaas.com/compliance/cis-controls-v8/14-9-conduct-role-specific-security-awareness-and-skills-training) ### Control 15 — Service Provider Management CIS Critical Security Controls v8 - [CIS Controls v8 15.1 — Establish and Maintain an Inventory of Service Providers](https://support.icompaas.com/compliance/cis-controls-v8/15-1-establish-and-maintain-an-inventory-of-service-providers) - [CIS Controls v8 15.2 — Establish and Maintain a Service Provider Management Policy](https://support.icompaas.com/compliance/cis-controls-v8/15-2-establish-and-maintain-a-service-provider-management-policy) - [CIS Controls v8 15.3 — Classify Service Providers](https://support.icompaas.com/compliance/cis-controls-v8/15-3-classify-service-providers) - [CIS Controls v8 15.4 — Ensure Service Provider Contracts Include Security Requirements](https://support.icompaas.com/compliance/cis-controls-v8/15-4-ensure-service-provider-contracts-include-security-requirements) - [CIS Controls v8 15.5 — Assess Service Providers](https://support.icompaas.com/compliance/cis-controls-v8/15-5-assess-service-providers) - [CIS Controls v8 15.6 — Monitor Service Providers](https://support.icompaas.com/compliance/cis-controls-v8/15-6-monitor-service-providers) - [CIS Controls v8 15.7 — Securely Decommission Service Providers](https://support.icompaas.com/compliance/cis-controls-v8/15-7-securely-decommission-service-providers) ### Control 16 — Application Software Security CIS Critical Security Controls v8 - [CIS Controls v8 16.1 — Establish and Maintain a Secure Application Development Process](https://support.icompaas.com/compliance/cis-controls-v8/16-1-establish-and-maintain-a-secure-application-development-process) - [CIS Controls v8 16.2 — Establish and Maintain a Process to Accept and Address Software Vulnerabilities](https://support.icompaas.com/compliance/cis-controls-v8/16-2-establish-and-maintain-a-process-to-accept-and-address-software-vulnerabilities) - [CIS Controls v8 16.3 — Perform Root Cause Analysis on Security Vulnerabilities](https://support.icompaas.com/compliance/cis-controls-v8/16-3-perform-root-cause-analysis-on-security-vulnerabilities) - [CIS Controls v8 16.4 — Establish and Manage an Inventory of Third-Party Software Components](https://support.icompaas.com/compliance/cis-controls-v8/16-4-establish-and-manage-an-inventory-of-third-party-software-components) - [CIS Controls v8 16.5 — Use Up-to-Date and Trusted Third-Party Software Components](https://support.icompaas.com/compliance/cis-controls-v8/16-5-use-up-to-date-and-trusted-third-party-software-components) - [CIS Controls v8 16.6 — Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities](https://support.icompaas.com/compliance/cis-controls-v8/16-6-establish-and-maintain-a-severity-rating-system-and-process-for-application) - [CIS Controls v8 16.7 — Use Standard Hardening Configuration Templates for Application Infrastructure](https://support.icompaas.com/compliance/cis-controls-v8/16-7-use-standard-hardening-configuration-templates-for-application-infrastructure) - [CIS Controls v8 16.8 — Separate Production and Non-Production Systems](https://support.icompaas.com/compliance/cis-controls-v8/16-8-separate-production-and-non-production-systems) - [CIS Controls v8 16.9 — Train Developers in Application Security Concepts and Secure Coding](https://support.icompaas.com/compliance/cis-controls-v8/16-9-train-developers-in-application-security-concepts-and-secure-coding) - [CIS Controls v8 16.10 — Apply Secure Design Principles in Application Architectures](https://support.icompaas.com/compliance/cis-controls-v8/16-10-apply-secure-design-principles-in-application-architectures) - [CIS Controls v8 16.11 — Leverage Vetted Modules or Services for Application Security Components](https://support.icompaas.com/compliance/cis-controls-v8/16-11-leverage-vetted-modules-or-services-for-application-security-components) - [CIS Controls v8 16.12 — Implement Code-Level Security Checks](https://support.icompaas.com/compliance/cis-controls-v8/16-12-implement-code-level-security-checks) - [CIS Controls v8 16.13 — Conduct Application Penetration Testing](https://support.icompaas.com/compliance/cis-controls-v8/16-13-conduct-application-penetration-testing) - [CIS Controls v8 16.14 — Conduct Threat Modeling](https://support.icompaas.com/compliance/cis-controls-v8/16-14-conduct-threat-modeling) ### Control 17 — Incident Response Management CIS Critical Security Controls v8 - [CIS Controls v8 17.1 — Designate Personnel to Manage Incident Handling](https://support.icompaas.com/compliance/cis-controls-v8/17-1-designate-personnel-to-manage-incident-handling) - [CIS Controls v8 17.2 — Establish and Maintain Contact Information for Reporting Security Incidents](https://support.icompaas.com/compliance/cis-controls-v8/17-2-establish-and-maintain-contact-information-for-reporting-security-incidents) - [CIS Controls v8 17.3 — Establish and Maintain an Enterprise Process for Reporting Incidents](https://support.icompaas.com/compliance/cis-controls-v8/17-3-establish-and-maintain-an-enterprise-process-for-reporting-incidents) - [CIS Controls v8 17.4 — Establish and Maintain an Incident Response Process](https://support.icompaas.com/compliance/cis-controls-v8/17-4-establish-and-maintain-an-incident-response-process) - [CIS Controls v8 17.5 — Assign Key Roles and Responsibilities](https://support.icompaas.com/compliance/cis-controls-v8/17-5-assign-key-roles-and-responsibilities) - [CIS Controls v8 17.6 — Define Mechanisms for Communicating During Incident Response](https://support.icompaas.com/compliance/cis-controls-v8/17-6-define-mechanisms-for-communicating-during-incident-response) - [CIS Controls v8 17.7 — Conduct Routine Incident Response Exercises](https://support.icompaas.com/compliance/cis-controls-v8/17-7-conduct-routine-incident-response-exercises) - [CIS Controls v8 17.8 — Conduct Post-Incident Reviews](https://support.icompaas.com/compliance/cis-controls-v8/17-8-conduct-post-incident-reviews) - [CIS Controls v8 17.9 — Establish and Maintain Security Incident Thresholds](https://support.icompaas.com/compliance/cis-controls-v8/17-9-establish-and-maintain-security-incident-thresholds) ### Control 18 — Penetration Testing CIS Critical Security Controls v8 - [CIS Controls v8 18.1 — Establish and Maintain a Penetration Testing Program](https://support.icompaas.com/compliance/cis-controls-v8/18-1-establish-and-maintain-a-penetration-testing-program) - [CIS Controls v8 18.2 — Perform Periodic External Penetration Tests](https://support.icompaas.com/compliance/cis-controls-v8/18-2-perform-periodic-external-penetration-tests) - [CIS Controls v8 18.3 — Remediate Penetration Test Findings](https://support.icompaas.com/compliance/cis-controls-v8/18-3-remediate-penetration-test-findings) - [CIS Controls v8 18.4 — Validate Security Measures](https://support.icompaas.com/compliance/cis-controls-v8/18-4-validate-security-measures) - [CIS Controls v8 18.5 — Perform Periodic Internal Penetration Tests](https://support.icompaas.com/compliance/cis-controls-v8/18-5-perform-periodic-internal-penetration-tests)