CIS Controls v8: the evidence behind every control

153 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

CIS Control 1: Inventory and Control of Enterprise Assets

1.1Establish and Maintain Detailed Enterprise Asset Inventory moderate 1.2Address Unauthorized Assets moderate 1.3Utilize an Active Discovery Tool moderate 1.4Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory easy 1.5Use a Passive Asset Discovery Tool moderate

CIS Control 2: Inventory and Control of Software Assets

2.1Establish and Maintain a Software Inventory moderate 2.2Ensure Authorized Software is Currently Supported moderate 2.3Address Unauthorized Software moderate 2.4Utilize Automated Software Inventory Tools easy 2.5Allowlist Authorized Software moderate 2.6Allowlist Authorized Libraries moderate 2.7Allowlist Authorized Scripts moderate

CIS Control 3: Data Protection

3.1Establish and Maintain a Data Management Process moderate 3.2Establish and Maintain a Data Inventory moderate 3.3Configure Data Access Control Lists moderate 3.4Enforce Data Retention moderate 3.5Securely Dispose of Data moderate 3.6Encrypt Data on End-User Devices moderate 3.7Establish and Maintain a Data Classification Scheme moderate 3.8Document Data Flows moderate 3.9Encrypt Data on Removable Media moderate 3.10Encrypt Sensitive Data in Transit moderate 3.11Encrypt Sensitive Data at Rest moderate 3.12Segment Data Processing and Storage Based on Sensitivity moderate 3.13Deploy a Data Loss Prevention Solution moderate 3.14Log Sensitive Data Access easy

CIS Control 4: Secure Configuration of Enterprise Assets and Software

4.1Establish and Maintain a Secure Configuration Process easy 4.2Establish and Maintain a Secure Configuration Process for Network Infrastructure easy 4.3Configure Automatic Session Locking on Enterprise Assets moderate 4.4Implement and Manage a Firewall on Servers moderate 4.5Implement and Manage a Firewall on End-User Devices moderate 4.6Securely Manage Enterprise Assets and Software moderate 4.7Manage Default Accounts on Enterprise Assets and Software moderate 4.8Uninstall or Disable Unnecessary Services on Enterprise Assets and Software moderate 4.9Configure Trusted DNS Servers on Enterprise Assets moderate 4.10Enforce Automatic Device Lockout on Portable End-User Devices moderate 4.11Enforce Remote Wipe Capability on Portable End-User Devices moderate 4.12Separate Enterprise Workspaces on Mobile End-User Devices moderate

CIS Control 5: Account Management

5.1Establish and Maintain an Inventory of Accounts moderate 5.2Use Unique Passwords moderate 5.3Disable Dormant Accounts moderate 5.4Restrict Administrator Privileges to Dedicated Administrator Accounts moderate 5.5Establish and Maintain an Inventory of Service Accounts moderate 5.6Centralize Account Management moderate

CIS Control 6: Access Control Management

6.1Establish an Access Granting Process moderate 6.2Establish an Access Revoking Process moderate 6.3Require MFA for Externally-Exposed Applications easy 6.4Require MFA for Remote Network Access easy 6.5Require MFA for Administrative Access easy 6.6Establish and Maintain an Inventory of Authentication and Authorization Systems moderate 6.7Centralize Access Control moderate 6.8Define and Maintain Role-Based Access Control moderate

CIS Control 7: Continuous Vulnerability Management

7.1Establish and Maintain a Vulnerability Management Process moderate 7.2Establish and Maintain a Remediation Process moderate 7.3Perform Automated Operating System Patch Management easy 7.4Perform Automated Application Patch Management easy 7.5Perform Automated Vulnerability Scans of Internal Enterprise Assets easy 7.6Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets easy 7.7Remediate Detected Vulnerabilities moderate

CIS Control 8: Audit Log Management

8.1Establish and Maintain an Audit Log Management Process easy 8.2Collect Audit Logs easy 8.3Ensure Adequate Audit Log Storage easy 8.4Standardize Time Synchronization easy 8.5Collect Detailed Audit Logs easy 8.6Collect DNS Query Audit Logs easy 8.7Collect URL Request Audit Logs easy 8.8Collect Command-Line Audit Logs easy 8.9Centralize Audit Logs easy 8.10Retain Audit Logs easy 8.11Conduct Audit Log Reviews easy 8.12Collect Service Provider Logs easy

CIS Control 9: Email and Web Browser Protections

9.1Ensure Use of Only Fully Supported Browsers and Email Clients moderate 9.2Use DNS Filtering Services moderate 9.3Maintain and Enforce Network-Based URL Filters moderate 9.4Restrict Unnecessary or Unauthorized Browser and Email Client Extensions moderate 9.5Implement DMARC moderate 9.6Block Unnecessary File Types moderate 9.7Deploy and Maintain Email Server Anti-Malware Protections moderate

CIS Control 10: Malware Defenses

10.1Deploy and Maintain Anti-Malware Software moderate 10.2Configure Automatic Anti-Malware Signature Updates moderate 10.3Disable Autorun and Autoplay for Removable Media moderate 10.4Configure Automatic Anti-Malware Scanning of Removable Media moderate 10.5Enable Anti-Exploitation Features moderate 10.6Centrally Manage Anti-Malware Software moderate 10.7Use Behavior-Based Anti-Malware Software moderate

CIS Control 11: Data Recovery

11.1Establish and Maintain a Data Recovery Process moderate 11.2Perform Automated Backups easy 11.3Protect Recovery Data moderate 11.4Establish and Maintain an Isolated Instance of Recovery Data moderate 11.5Test Data Recovery moderate

CIS Control 12: Network Infrastructure Management

12.1Ensure Network Infrastructure is Up-to-Date moderate 12.2Establish and Maintain a Secure Network Architecture moderate 12.3Securely Manage Network Infrastructure moderate 12.4Establish and Maintain Architecture Diagram(s) moderate 12.5Centralize Network Authentication, Authorization, and Auditing (AAA) moderate 12.6Use of Secure Network Management and Communication Protocols moderate 12.7Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise’s AAA Infrastructure moderate 12.8Establish and Maintain Dedicated Computing Resources for All Administrative Work moderate

CIS Control 13: Network Monitoring and Defense

13.1Centralize Security Event Alerting moderate 13.2Deploy a Host-Based Intrusion Detection Solution moderate 13.3Deploy a Network Intrusion Detection Solution moderate 13.4Perform Traffic Filtering Between Network Segments moderate 13.5Manage Access Control for Remote Assets moderate 13.6Collect Network Traffic Flow Logs easy 13.7Deploy a Host-Based Intrusion Prevention Solution moderate 13.8Deploy a Network Intrusion Prevention Solution moderate 13.9Deploy Port-Level Access Control moderate 13.10Perform Application Layer Filtering moderate 13.11Tune Security Event Alerting Thresholds moderate

CIS Control 14: Security Awareness and Skills Training

14.1Establish and Maintain a Security Awareness Program moderate 14.2Train Workforce Members to Recognize Social Engineering Attacks moderate 14.3Train Workforce Members on Authentication Best Practices moderate 14.4Train Workforce on Data Handling Best Practices moderate 14.5Train Workforce Members on Causes of Unintentional Data Exposure moderate 14.6Train Workforce Members on Recognizing and Reporting Security Incidents moderate 14.7Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates moderate 14.8Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks moderate 14.9Conduct Role-Specific Security Awareness and Skills Training moderate

CIS Control 15: Service Provider Management

15.1Establish and Maintain an Inventory of Service Providers moderate 15.2Establish and Maintain a Service Provider Management Policy moderate 15.3Classify Service Providers moderate 15.4Ensure Service Provider Contracts Include Security Requirements moderate 15.5Assess Service Providers moderate 15.6Monitor Service Providers moderate 15.7Securely Decommission Service Providers moderate

CIS Control 16: Application Software Security

16.1Establish and Maintain a Secure Application Development Process moderate 16.2Establish and Maintain a Process to Accept and Address Software Vulnerabilities moderate 16.3Perform Root Cause Analysis on Security Vulnerabilities moderate 16.4Establish and Manage an Inventory of Third-Party Software Components moderate 16.5Use Up-to-Date and Trusted Third-Party Software Components moderate 16.6Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities moderate 16.7Use Standard Hardening Configuration Templates for Application Infrastructure moderate 16.8Separate Production and Non-Production Systems moderate 16.9Train Developers in Application Security Concepts and Secure Coding moderate 16.10Apply Secure Design Principles in Application Architectures moderate 16.11Leverage Vetted Modules or Services for Application Security Components moderate 16.12Implement Code-Level Security Checks moderate 16.13Conduct Application Penetration Testing moderate 16.14Conduct Threat Modeling moderate

CIS Control 17: Incident Response Management

17.1Designate Personnel to Manage Incident Handling moderate 17.2Establish and Maintain Contact Information for Reporting Security Incidents moderate 17.3Establish and Maintain an Enterprise Process for Reporting Incidents moderate 17.4Establish and Maintain an Incident Response Process moderate 17.5Assign Key Roles and Responsibilities moderate 17.6Define Mechanisms for Communicating During Incident Response moderate 17.7Conduct Routine Incident Response Exercises moderate 17.8Conduct Post-Incident Reviews moderate 17.9Establish and Maintain Security Incident Thresholds moderate

CIS Control 18: Penetration Testing

18.1Establish and Maintain a Penetration Testing Program moderate 18.2Perform Periodic External Penetration Tests moderate 18.3Remediate Penetration Test Findings moderate 18.4Validate Security Measures moderate 18.5Perform Periodic Internal Penetration Tests moderate