# CIS Controls v8 1.5 — Use a Passive Asset Discovery Tool - Source: https://support.icompaas.com/compliance/cis-controls-v8/1-5-use-a-passive-asset-discovery-tool - Section: [Compliance](https://support.icompaas.com/compliance) › [CIS Critical Security Controls v8](https://support.icompaas.com/compliance/cis-controls-v8) › Control 1 — Inventory and Control of Enterprise Assets - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **CIS Controls v8**·Control `1.5`·medium·Component: **Detect** ## What this control requires > Use a passive discovery tool to identify assets connected to the enterprise's network. Review and use scans to update the enterprise's asset inventory at least weekly, or more frequently. > > — CIS Controls v8, Control 1.5 ### In plain English Use a passive discovery tool to identify assets connected to the enterprise's network. In practice, this means you can prove you use network-level controls on a defined cadence. ## Why it matters The CIS Controls are an industry-vetted, prioritised defence: skipping a safeguard widens the attack surface that the safeguards above and below it assume is closed. Audit frameworks (FedRAMP, PCI DSS, HIPAA) all cite CIS as evidence of due care. ## What an auditor looks for A CIS-aligned reviewer wants to see (a) which Implementation Group you are targeting, (b) a documented owner for the safeguard, and (c) a tooling or process artefact (config, scan output, ticket) that proves the safeguard runs on the cadence the control demands. Within **Detect**, the assessor will trace your implementation back to the catalogue reference (Control 1.5) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Cloud Posture **CSPM.** Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold. #### Network Security **AWS.** VPC Flow Logs to S3, default-deny security groups, AWS Network Firewall for north-south, and Transit Gateway for hub-and-spoke segmentation. **Azure.** NSGs with deny-by-default, Azure Firewall Premium with TLS inspection, Private Endpoints for PaaS, and Microsoft Defender for Cloud's secure score for drift. **GCP.** VPC Service Controls perimeters around sensitive APIs, Cloud NGFW Enterprise for L7 inspection, Private Service Connect for managed services. #### Configuration Management **Policy-as-code.** Codify the control as Service Control Policies (AWS), Azure Policy initiatives, or Organisation Policy (GCP) so the platform enforces what the document promises. **IaC.** Gate Terraform / Pulumi / CloudFormation changes with Checkov / tfsec / OPA so misconfigurations never reach production. **Drift.** Run a CSPM (Wiz / Prisma / Defender for Cloud / Security Command Center) over every account and route findings to a single risk register. ### Operational checklist - **Use.** Document the trigger, the owner and the cadence. - **Review.** Document the trigger, the owner and the cadence. - **Scope:** network, passive asset discovery tool, enterprise. ## Evidence to collect - **Infra Scan.** Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings. Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Use a Passive Asset Discovery Tool. ## Common pitfalls - Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why. - Default-allow egress rules; East-West traffic with no segmentation; jump hosts on the public internet with password auth. - Manual cloud-console changes that never make it back to Terraform — drift accumulates until the next outage forces a reconciliation. - Inventories that exclude SaaS, shadow IT and ephemeral cloud resources (Lambda, Cloud Run, K8s pods) miss the assets where most modern incidents start. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**NIST SP 800-53 Rev. 5 CM-2(2)** — Automation Support For Accuracy And Currency](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/cm-2-2-automation-support-for-accuracy-and-currency) - [**NIST SP 800-171 Rev. 3 3.13.6** — Network Communications - Deny by Default - Allow by Exception](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-6-network-communications-deny-by-default-allow-by-exception) ## Related controls in CIS Controls v8 - [**Control 1.3** — Utilize an Active Discovery Tool](https://support.icompaas.com/compliance/cis-controls-v8/1-3-utilize-an-active-discovery-tool) - [**Control 12.6** — Use of Secure Network Management and Communication Protocols](https://support.icompaas.com/compliance/cis-controls-v8/12-6-use-of-secure-network-management-and-communication-protocols) - [**Control 12.8** — Establish and Maintain Dedicated Computing Resources for All Administrative Work](https://support.icompaas.com/compliance/cis-controls-v8/12-8-establish-and-maintain-dedicated-computing-resources-for-all-administrative-work) - [**Control 4.9** — Configure Trusted DNS Servers on Enterprise Assets](https://support.icompaas.com/compliance/cis-controls-v8/4-9-configure-trusted-dns-servers-on-enterprise-assets) - [**Control 8.4** — Standardize Time Synchronization](https://support.icompaas.com/compliance/cis-controls-v8/8-4-standardize-time-synchronization) - [**Control 9.3** — Maintain and Enforce Network-Based URL Filters](https://support.icompaas.com/compliance/cis-controls-v8/9-3-maintain-and-enforce-network-based-url-filters) ## References - [Center for Internet Security — CIS Controls v8](https://www.cisecurity.org/controls/v8) - Catalogue identifier: `Control 1.5` Topics: network securitycloud postureconfiguration managementasset inventory ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.