CIS Critical Security Controls v8.1

Inventory and Control of Enterprise Assets (5 safeguards)

Malware Defenses (7 safeguards)

Data Recovery (5 safeguards)

Network Infrastructure Management (8 safeguards)

Network Monitoring and Defense (11 safeguards)

Security Awareness and Skills Training (9 safeguards)

Service Provider Management (7 safeguards)

Application Software Security (14 safeguards)

Incident Response Management (9 safeguards)

Penetration Testing (5 safeguards)

Inventory and Control of Software Assets (7 safeguards)

Data Protection (14 safeguards)

Secure Configuration of Enterprise Assets and Software (12 safeguards)

Account Management (6 safeguards)

Access Control Management (8 safeguards)

Continuous Vulnerability Management (7 safeguards)

Audit Log Management (12 safeguards)

Email and Web Browser Protections (7 safeguards)

Establish and Maintain Detailed Enterprise Asset Inventory

Address Unauthorized Assets

Utilize an Active Discovery Tool

Use DHCP Logging to Update Enterprise Asset Inventory

Use a Passive Asset Discovery Tool

Deploy and Maintain Anti-Malware Software

Configure Automatic Anti-Malware Signature Updates

Disable Autorun and Autoplay for Removable Media

Configure Automatic Anti-Malware Scanning of Removable Media

Enable Anti-Exploitation Features

Centrally Manage Anti-Malware Software

Use Behavior-Based Anti-Malware Software

Establish and Maintain a Data Recovery Process

Perform Automated Backups

Protect Recovery Data

Establish and Maintain an Isolated Instance of Recovery Data

Test Data Recovery

Ensure Network Infrastructure is Up-to-Date

Establish and Maintain a Secure Network Architecture

Securely Manage Network Infrastructure

Establish and Maintain Architecture Diagram(s)

Centralize Network AAA

Use of Secure Network Management and Communication Protocols

Ensure Remote Devices Utilize a VPN and Connect to AAA Infrastructure

Establish and Maintain Dedicated Computing Resources for Admin Work

Centralize Security Event Alerting

Perform Application Layer Filtering

Tune Security Event Alerting Thresholds

Deploy a Host-Based Intrusion Detection Solution

Deploy a Network Intrusion Detection Solution

Perform Traffic Filtering Between Network Segments

Manage Access Control for Remote Assets

Collect Network Traffic Flow Logs

Deploy a Host-Based Intrusion Prevention Solution

Deploy a Network Intrusion Prevention Solution

Deploy Port-Level Access Control

Establish and Maintain a Security Awareness Program

Train Workforce to Recognize Social Engineering Attacks

Train Workforce on Authentication Best Practices

Train Workforce on Data Handling Best Practices

Train Workforce on Causes of Unintentional Data Exposure

Train Workforce on Recognizing and Reporting Security Incidents

Train Workforce on How to Identify Missing Security Updates

Train Workforce on Dangers of Insecure Networks

Conduct Role-Specific Security Awareness and Skills Training

Establish and Maintain an Inventory of Service Providers

Establish and Maintain a Service Provider Management Policy

Classify Service Providers

Ensure Service Provider Contracts Include Security Requirements

Assess Service Providers

Monitor Service Providers

Securely Decommission Service Providers

Establish and Maintain a Secure Application Development Process

Apply Secure Design Principles in Application Architectures

Leverage Vetted Modules or Services for App Security Components

Implement Code-Level Security Checks

Conduct Application Penetration Testing

Conduct Threat Modeling

Establish and Maintain a Process to Accept and Address Software Vulnerabilities

Perform Root Cause Analysis on Security Vulnerabilities

Establish and Manage an Inventory of Third-Party Software Components

Use Up-to-Date and Trusted Third-Party Software Components

Establish and Maintain a Severity Rating System for App Vulns

Use Standard Hardening Configuration Templates for App Infrastructure

Separate Production and Non-Production Systems

Train Developers in Application Security Concepts and Secure Coding

Designate Personnel to Manage Incident Handling

Establish and Maintain Contact Information for Reporting Security Incidents

Establish and Maintain an Enterprise Process for Reporting Incidents

Establish and Maintain an Incident Response Process

Assign Key Roles and Responsibilities

Define Mechanisms for Communicating During Incident Response

Conduct Routine Incident Response Exercises

Conduct Post-Incident Reviews

Establish and Maintain Security Incident Thresholds

Establish and Maintain a Penetration Testing Program

Perform Periodic External Penetration Tests

Remediate Penetration Test Findings

Validate Security Measures

Perform Periodic Internal Penetration Tests

Establish and Maintain a Software Inventory

Ensure Authorized Software is Currently Supported

Address Unauthorized Software

Utilize Automated Software Inventory Tools

Allowlist Authorized Software

Allowlist Authorized Libraries

Allowlist Authorized Scripts

Establish and Maintain a Data Management Process

Encrypt Sensitive Data in Transit

Encrypt Sensitive Data at Rest

Segment Data Processing and Storage Based on Sensitivity

Deploy a Data Loss Prevention Solution

Log Sensitive Data Access

Establish and Maintain a Data Inventory

Configure Data Access Control Lists

Enforce Data Retention

Securely Dispose of Data

Encrypt Data on End-User Devices

Establish and Maintain a Data Classification Scheme

Document Data Flows

Encrypt Data on Removable Media

Establish and Maintain a Secure Configuration Process

Enforce Automatic Device Lockout on Portable End-User Devices

Enforce Remote Wipe Capability on Portable End-User Devices

Separate Enterprise Workspaces on Mobile End-User Devices

Establish and Maintain a Secure Configuration Process for Network Infrastructure

Configure Automatic Session Locking on Enterprise Assets

Implement and Manage a Firewall on Servers

Implement and Manage a Firewall on End-User Devices

Securely Manage Enterprise Assets and Software

Manage Default Accounts on Enterprise Assets and Software

Uninstall or Disable Unnecessary Services

Configure Trusted DNS Servers on Enterprise Assets

Establish and Maintain an Inventory of Accounts

Use Unique Passwords

Disable Dormant Accounts

Restrict Administrator Privileges to Dedicated Administrator Accounts

Establish and Maintain an Inventory of Service Accounts

Centralize Account Management

Establish an Access Granting Process

Establish an Access Revoking Process

Require MFA for Externally-Exposed Applications

Require MFA for Remote Network Access

Require MFA for Administrative Access

Establish and Maintain an Inventory of Authentication and Authorization Systems

Centralize Access Control

Define and Maintain Role-Based Access Control

Establish and Maintain a Vulnerability Management Process

Establish and Maintain a Remediation Process

Perform Automated Operating System Patch Management

Perform Automated Application Patch Management

Perform Automated Vulnerability Scans of Internal Enterprise Assets

Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets

Remediate Detected Vulnerabilities

Establish and Maintain an Audit Log Management Process

Retain Audit Logs

Conduct Audit Log Reviews

Collect Service Provider Logs

Collect Audit Logs

Ensure Adequate Audit Log Storage

Standardize Time Synchronization

Collect Detailed Audit Logs

Collect DNS Query Audit Logs

Collect URL Request Audit Logs

Collect Command-Line Audit Logs

Centralize Audit Logs

Ensure Use of Only Fully Supported Browsers and Email Clients

Use DNS Filtering Services

Maintain and Enforce Network-Based URL Filters

Restrict Unnecessary Browser and Email Client Extensions

Implement DMARC

Block Unnecessary File Types

Deploy and Maintain Email Server Anti-Malware Protections