CIS · Control 14.8 · Priority: critical · Component: Protect

What this control covers

Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for enterprise activities. If the enterprise has remote workers, training must include guidance to ensure that all users securely configure their home network infrastructure.

Why it matters

A defended network limits blast radius after an initial compromise — the difference between an incident and a breach is often the controls described here.

How to implement

AWS

Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.

Azure

Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.

GCP

Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.

On-premises

Roll out role-based security awareness annually + phishing simulations quarterly. Track completion in your LMS and tie to performance review for repeat-fails.

Evidence to collect

  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks.

Quick checklist

  • Ensure — Network / Data
  • Configure — Network / Data
  • Securely — Network / Data
  • Protect — Network / Data
  • Train — Network / Data

Related articles on this site