# CIS Controls v8 18.4 — Validate Security Measures - Source: https://support.icompaas.com/compliance/cis-controls-v8/18-4-validate-security-measures - Section: [Compliance](https://support.icompaas.com/compliance) › [CIS Critical Security Controls v8](https://support.icompaas.com/compliance/cis-controls-v8) › Control 18 — Penetration Testing - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **CIS Controls v8**·Control `18.4`·medium·Component: **Protect** ## What this control requires > Validate security measures after each penetration test. If deemed necessary, modify rulesets and capabilities to detect the techniques used during testing. > > — CIS Controls v8, Control 18.4 ### In plain English Validate security measures after each penetration test. In practice, this means you can prove you protect network-level controls on a defined cadence. ## Why it matters The CIS Controls are an industry-vetted, prioritised defence: skipping a safeguard widens the attack surface that the safeguards above and below it assume is closed. Audit frameworks (FedRAMP, PCI DSS, HIPAA) all cite CIS as evidence of due care. ## What an auditor looks for A CIS-aligned reviewer wants to see (a) which Implementation Group you are targeting, (b) a documented owner for the safeguard, and (c) a tooling or process artefact (config, scan output, ticket) that proves the safeguard runs on the cadence the control demands. Within **Protect**, the assessor will trace your implementation back to the catalogue reference (Control 18.4) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Cloud Posture **CSPM.** Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold. #### Code Review Testing **Pipeline.** Require at least one human reviewer plus passing CI (lint, type, unit, security scan) before merge — protected branches enforce this. #### Configuration Management **Policy-as-code.** Codify the control as Service Control Policies (AWS), Azure Policy initiatives, or Organisation Policy (GCP) so the platform enforces what the document promises. **IaC.** Gate Terraform / Pulumi / CloudFormation changes with Checkov / tfsec / OPA so misconfigurations never reach production. **Drift.** Run a CSPM (Wiz / Prisma / Defender for Cloud / Security Command Center) over every account and route findings to a single risk register. ### Operational checklist - **Protect.** Document the trigger, the owner and the cadence. - **Test.** Document the trigger, the owner and the cadence. - **Validate.** Document the trigger, the owner and the cadence. - **Scope:** network, security measures. ## Evidence to collect - **Infra Scan.** Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings. Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Validate Security Measures. ## Common pitfalls - Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why. - Manual cloud-console changes that never make it back to Terraform — drift accumulates until the next outage forces a reconciliation. - Default-allow egress rules; East-West traffic with no segmentation; jump hosts on the public internet with password auth. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**NIST SP 800-53 Rev. 5 CM-2(6)** — Development And Test Environments](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/cm-2-6-development-and-test-environments) - [**NIST SP 800-171 Rev. 3 3.4.6** — Least Functionality](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-4-6-least-functionality) - [**ISO/IEC 27001:2022 A.5.34** — Privacy and protection of personal identifiable information (PII)](https://support.icompaas.com/compliance/iso-27001-2022/a-5-34-privacy-and-protection-of-personal-identifiable-information-pii) - [**BSI C5:2020 PS-03** — Perimeter Protection](https://support.icompaas.com/compliance/bsi-c5-2020/ps-03-perimeter-protection) ## Related controls in CIS Controls v8 - [**Control 10.3** — Disable Autorun and Autoplay for Removable Media](https://support.icompaas.com/compliance/cis-controls-v8/10-3-disable-autorun-and-autoplay-for-removable-media) - [**Control 16.8** — Separate Production and Non-Production Systems](https://support.icompaas.com/compliance/cis-controls-v8/16-8-separate-production-and-non-production-systems) - [**Control 14.2** — Train Workforce Members to Recognize Social Engineering Attacks](https://support.icompaas.com/compliance/cis-controls-v8/14-2-train-workforce-members-to-recognize-social-engineering-attacks) - [**Control 7.3** — Perform Automated Operating System Patch Management](https://support.icompaas.com/compliance/cis-controls-v8/7-3-perform-automated-operating-system-patch-management) - [**Control 18.3** — Remediate Penetration Test Findings](https://support.icompaas.com/compliance/cis-controls-v8/18-3-remediate-penetration-test-findings) - [**Control 3.9** — Encrypt Data on Removable Media](https://support.icompaas.com/compliance/cis-controls-v8/3-9-encrypt-data-on-removable-media) ## References - [Center for Internet Security — CIS Controls v8](https://www.cisecurity.org/controls/v8) - Catalogue identifier: `Control 18.4` Topics: governance riskcloud posturecode review testingconfiguration managementnetwork security ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.