CIS Controls v8.1: the evidence behind each requirement
153 safeguards. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.
Each safeguard shows its Implementation Groups. IG1 is the essential baseline for every enterprise, IG2 adds to it, IG3 is all 153. Version 8.1 adds the Govern security function and asks for more processes to be documented; numbering is unchanged from v8.
CIS Control 1: Inventory and Control of Enterprise Assets
1.1Establish and Maintain Detailed Enterprise Asset Inventory easy1.2Address Unauthorized Assets easy1.3Utilize an Active Discovery Tool moderate1.4Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory easy1.5Use a Passive Asset Discovery Tool hardCIS Control 2: Inventory and Control of Software Assets
2.1Establish and Maintain a Software Inventory moderate2.2Ensure Authorized Software is Currently Supported moderate2.3Address Unauthorized Software moderate2.4Utilize Automated Software Inventory Tools easy2.5Allowlist Authorized Software moderate2.6Allowlist Authorized Libraries moderate2.7Allowlist Authorized Scripts moderateCIS Control 3: Data Protection
3.1Establish and Maintain a Data Management Process moderate3.2Establish and Maintain a Data Inventory hard3.3Configure Data Access Control Lists hard3.4Enforce Data Retention moderate3.5Securely Dispose of Data moderate3.6Encrypt Data on End-User Devices easy3.7Establish and Maintain a Data Classification Scheme hard3.8Document Data Flows hard3.9Encrypt Data on Removable Media moderate3.10Encrypt Sensitive Data in Transit moderate3.11Encrypt Sensitive Data at Rest moderate3.12Segment Data Processing and Storage Based on Sensitivity hard3.13Deploy a Data Loss Prevention Solution easy3.14Log Sensitive Data Access easyCIS Control 4: Secure Configuration of Enterprise Assets and Software
4.1Establish and Maintain a Secure Configuration Process easy4.2Establish and Maintain a Secure Configuration Process for Network Infrastructure moderate4.3Configure Automatic Session Locking on Enterprise Assets moderate4.4Implement and Manage a Firewall on Servers easy4.5Implement and Manage a Firewall on End-User Devices easy4.6Securely Manage Enterprise Assets and Software moderate4.7Manage Default Accounts on Enterprise Assets and Software easy4.8Uninstall or Disable Unnecessary Services on Enterprise Assets and Software easy4.9Configure Trusted DNS Servers on Enterprise Assets easy4.10Enforce Automatic Device Lockout on Portable End-User Devices easy4.11Enforce Remote Wipe Capability on Portable End-User Devices moderate4.12Separate Enterprise Workspaces on Mobile End-User Devices moderateCIS Control 5: Account Management
5.1Establish and Maintain an Inventory of Accounts moderate5.2Use Unique Passwords moderate5.3Disable Dormant Accounts moderate5.4Restrict Administrator Privileges to Dedicated Administrator Accounts moderate5.5Establish and Maintain an Inventory of Service Accounts moderate5.6Centralize Account Management easyCIS Control 6: Access Control Management
6.1Establish an Access Granting Process easy6.2Establish an Access Revoking Process hard6.3Require MFA for Externally-Exposed Applications moderate6.4Require MFA for Remote Network Access easy6.5Require MFA for Administrative Access easy6.6Establish and Maintain an Inventory of Authentication and Authorization Systems hard6.7Centralize Access Control hard6.8Define and Maintain Role-Based Access Control hardCIS Control 7: Continuous Vulnerability Management
7.1Establish and Maintain a Vulnerability Management Process hard7.2Establish and Maintain a Remediation Process moderate7.3Perform Automated Operating System Patch Management easy7.4Perform Automated Application Patch Management easy7.5Perform Automated Vulnerability Scans of Internal Enterprise Assets moderate7.6Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets easy7.7Remediate Detected Vulnerabilities moderateCIS Control 8: Audit Log Management
8.1Establish and Maintain an Audit Log Management Process hard8.2Collect Audit Logs easy8.3Ensure Adequate Audit Log Storage easy8.4Standardize Time Synchronization easy8.5Collect Detailed Audit Logs easy8.6Collect DNS Query Audit Logs easy8.7Collect URL Request Audit Logs easy8.8Collect Command-Line Audit Logs easy8.9Centralize Audit Logs easy8.10Retain Audit Logs moderate8.11Conduct Audit Log Reviews easy8.12Collect Service Provider Logs easyCIS Control 9: Email and Web Browser Protections
9.1Ensure Use of Only Fully Supported Browsers and Email Clients easy9.2Use DNS Filtering Services moderate9.3Maintain and Enforce Network-Based URL Filters hard9.4Restrict Unnecessary or Unauthorized Browser and Email Client Extensions hard9.5Implement DMARC hard9.6Block Unnecessary File Types moderate9.7Deploy and Maintain Email Server Anti-Malware Protections moderateCIS Control 10: Malware Defenses
10.1Deploy and Maintain Anti-Malware Software easy10.2Configure Automatic Anti-Malware Signature Updates moderate10.3Disable Autorun and Autoplay for Removable Media easy10.4Configure Automatic Anti-Malware Scanning of Removable Media moderate10.5Enable Anti-Exploitation Features easy10.6Centrally Manage Anti-Malware Software moderate10.7Use Behavior-Based Anti-Malware Software easyCIS Control 11: Data Recovery
11.1Establish and Maintain a Data Recovery Process hard11.2Perform Automated Backups moderate11.3Protect Recovery Data moderate11.4Establish and Maintain an Isolated Instance of Recovery Data moderate11.5Test Data Recovery moderateCIS Control 12: Network Infrastructure Management
12.1Ensure Network Infrastructure is Up-to-Date easy12.2Establish and Maintain a Secure Network Architecture hard12.3Securely Manage Network Infrastructure easy12.4Establish and Maintain Architecture Diagram(s) hard12.5Centralize Network Authentication, Authorization, and Auditing (AAA) easy12.6Use of Secure Network Management and Communication Protocols easy12.7Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise’s AAA Infrastructure easy12.8Establish and Maintain Dedicated Computing Resources for All Administrative Work easyCIS Control 13: Network Monitoring and Defense
13.1Centralize Security Event Alerting easy13.2Deploy a Host-Based Intrusion Detection Solution easy13.3Deploy a Network Intrusion Detection Solution easy13.4Perform Traffic Filtering Between Network Segments moderate13.5Manage Access Control for Remote Assets easy13.6Collect Network Traffic Flow Logs easy13.7Deploy a Host-Based Intrusion Prevention Solution easy13.8Deploy a Network Intrusion Prevention Solution moderate13.9Deploy Port-Level Access Control easy13.10Perform Application Layer Filtering moderate13.11Tune Security Event Alerting Thresholds easyCIS Control 14: Security Awareness and Skills Training
14.1Establish and Maintain a Security Awareness Program moderate14.2Train Workforce Members to Recognize Social Engineering Attacks moderate14.3Train Workforce Members on Authentication Best Practices moderate14.4Train Workforce on Data Handling Best Practices moderate14.5Train Workforce Members on Causes of Unintentional Data Exposure moderate14.6Train Workforce Members on Recognizing and Reporting Security Incidents moderate14.7Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates easy14.8Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks moderate14.9Conduct Role-Specific Security Awareness and Skills Training moderateCIS Control 15: Service Provider Management
15.1Establish and Maintain an Inventory of Service Providers hard15.2Establish and Maintain a Service Provider Management Policy hard15.3Classify Service Providers hard15.4Ensure Service Provider Contracts Include Security Requirements hard15.5Assess Service Providers hard15.6Monitor Service Providers moderate15.7Securely Decommission Service Providers moderateCIS Control 16: Application Software Security
16.1Establish and Maintain a Secure Application Development Process hard16.2Establish and Maintain a Process to Accept and Address Software Vulnerabilities hard16.3Perform Root Cause Analysis on Security Vulnerabilities hard16.4Establish and Manage an Inventory of Third-Party Software Components hard16.5Use Up-to-Date and Trusted Third-Party Software Components moderate16.6Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities hard16.7Use Standard Hardening Configuration Templates for Application Infrastructure moderate16.8Separate Production and Non-Production Systems moderate16.9Train Developers in Application Security Concepts and Secure Coding moderate16.10Apply Secure Design Principles in Application Architectures hard16.11Leverage Vetted Modules or Services for Application Security Components hard16.12Implement Code-Level Security Checks easy16.13Conduct Application Penetration Testing hard16.14Conduct Threat Modeling hardCIS Control 17: Incident Response Management
17.1Designate Personnel to Manage Incident Handling hard17.2Establish and Maintain Contact Information for Reporting Security Incidents hard17.3Establish and Maintain an Enterprise Process for Reporting Incidents hard17.4Establish and Maintain an Incident Response Process hard17.5Assign Key Roles and Responsibilities hard17.6Define Mechanisms for Communicating During Incident Response hard17.7Conduct Routine Incident Response Exercises hard17.8Conduct Post-Incident Reviews hard17.9Establish and Maintain Security Incident Thresholds hard