CIS Controls v8 17.9 — Establish and Maintain Security Incident Thresholds

What this control requires

Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an event. Examples can include: abnormal activity, security vulnerability, security weakness, data breach, privacy incident, etc. Review annually, or when significant enterprise changes occur that could impact this Safeguard.

In plain English

Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an event. In practice, this means you can prove you establish and maintain data-level controls on a defined cadence.

Why it matters

The CIS Controls are an industry-vetted, prioritised defence: skipping a safeguard widens the attack surface that the safeguards above and below it assume is closed. Audit frameworks (FedRAMP, PCI DSS, HIPAA) all cite CIS as evidence of due care.

What an auditor looks for

A CIS-aligned reviewer wants to see (a) which Implementation Group you are targeting, (b) a documented owner for the safeguard, and (c) a tooling or process artefact (config, scan output, ticket) that proves the safeguard runs on the cadence the control demands.

Within Recover, the assessor will trace your implementation back to the catalogue reference (Control 17.9) and look for objective evidence on the latest two assessment cycles.

How to implement

Incident Response

Runbook. Maintain a runbook keyed by incident type with named roles (IC, comms, scribe), an out-of-band comms channel, and a 72-hour timeline for external notification.

Tabletop. Run a quarterly tabletop exercise (ransomware, insider, supply-chain) and feed gaps back into the runbook.

Logging Monitoring

AWS. Org-trail CloudTrail to a central log archive account, GuardDuty in every region, and Security Hub for cross-source correlation.

Azure. Pipe every diagnostic setting into a central Log Analytics workspace; onboard Microsoft Sentinel for SIEM/SOAR.

GCP. Aggregate audit logs in a dedicated logging project with sink to BigQuery; enable Security Command Center Premium and route findings to Chronicle SIEM.

Operational checklist

• Establish And Maintain. Document the trigger, the owner and the cadence.
• Scope: data, vulnerability, response, security incident, security incident thresholds, enterprise.

Evidence to collect

• Ticketing Workflow. ticketing_workflow evidence

Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Establish and Maintain Security Incident Thresholds.

Common pitfalls

• Runbooks that name a role but no person, or list a paging channel that no longer exists.
• Per-account logging that nobody stitches together at the org level — incidents that cross accounts go undetected for days.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• SOC 2 (2017 TSC) P6.3 — Logging and Retention of Unauthorized Disclosure Incidents
• NIST SP 800-171 Rev. 3 3.6.2 — Incident Monitoring, Reporting, and Response Assistance
• BSI C5:2020 SIM-04 — Duty of the users to report security incidents to a central body
• NIST SP 800-53 Rev. 5 AT-2(1) — Practical Exercises

Related controls in CIS Controls v8

• Control 11.2 — Perform Automated Backups
• Control 17.8 — Conduct Post-Incident Reviews
• Control 17.6 — Define Mechanisms for Communicating During Incident Response
• Control 11.5 — Test Data Recovery
• Control 17.4 — Establish and Maintain an Incident Response Process
• Control 17.7 — Conduct Routine Incident Response Exercises

References

• Center for Internet Security — CIS Controls v8
• Catalogue identifier: Control 17.9

Topics: incident responsechange managementlogging monitoringprivacy management