# CIS 9.1 — Ensure Use of Only Fully Supported Browsers and Email Clients

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_cis_91_53b9b16c18-cis-91-ensure-use-of-only-fully-supported-browsers-and-email-clients
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [Protect](https://support.icompaas.com/support/solutions/folders/f_gen_62000112673_protect)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

CIS · Control 9.1 · Priority: critical · Component: Protect

### What this control covers

Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor.

### Why it matters

This is a foundational control: failure here typically magnifies impact across every other safeguard.

### How to implement

This is a policy / process control with no single technical implementation. Document the procedure, assign an accountable owner, and review on the cadence set by your ISMS / GRC programme.

### Evidence to collect

-   `vendor_risk_management` — See the iCompaas Evidence library for the canonical source for this evidence type.

Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Focus: Ensure Use of Only Fully Supported Browsers and Email Clients.

### Quick checklist

-   Ensure — Version / Email
-   Ensure Use — Version / Email
-   Protect — Version / Email

### Related articles on this site

-   [Ensure 'Additional email addresses' is configured with a security contact email](https://support.icompaas.com/support/solutions/articles/62000219763-ensure-additional-email-addresses-is-configured-with-a-security-contact-email)
-   [Ensure that 'HTTP Version' is the latest, if used to run the web app](https://support.icompaas.com/support/solutions/articles/62000219919-ensure-that-http-version-is-the-latest-if-used-to-run-the-web-app)
-   [Source Code Supply Chain Security](https://support.icompaas.com/support/solutions/articles/62000225179-source-code-supply-chain-security)
-   [Ensure IAM Users Receive Permissions Only Through Groups](https://support.icompaas.com/support/solutions/articles/62000228294-ensure-iam-users-receive-permissions-only-through-groups)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.