CIS Controls v8 Guide
CIS Controls v8 Guide
v8
Version 8
To further clarify the Creative Commons license related to the CIS Controls® content, you are authorized to
copy and redistribute the content as a framework for use by you, within your organization and outside of your
organization, for non-commercial purposes only, provided that (i) appropriate credit is given to CIS, and (ii)
a link to the license is provided. Additionally, if you remix, transform, or build upon the CIS Controls, you may
not distribute the modified materials. Users of the CIS Controls framework are also required to refer to (http://
www.cisecurity.org/controls/) when referring to the CIS Controls in order to ensure that users are employing
the most up-to-date guidance. Commercial use of the CIS Controls is subject to the prior approval of the
Center for Internet Security, Inc. (CIS®).
May 2021
Overview. . ..............................................................................................................1
Introduction 1
This Version of the CIS Controls 3
The CIS Controls Ecosystem (“It’s not about the list”) 4
How to Get Started 5
Using or Transitioning from Prior Versions of the CIS Controls 5
Structure of the CIS Controls 5
Implementation Groups 6
Application A program, or group of programs, hosted on enterprise assets and designed for end-
users. Applications are considered a software asset in this document. Examples include
web, database, cloud-based, and mobile applications.
Authentication systems A system or mechanism used to identify a user through associating an incoming request
with a set of identifying credentials. The credentials provided are compared to those on
a file in a database of the authorized user’s information on a local operating system, user
directory service, or within an authentication server. Examples of authentication systems
can include active directory, Multi-Factor Authentication (MFA), biometrics, and tokens.
Authorization systems A system or mechanism used to determine access levels or user/client privileges related
to system resources including files, services, computer programs, data, and application
features. An authorization system grants or denies access to a resource based on the
user’s identity. Examples of authorization systems can include active directory, access
control lists, and role-based access control lists.
Cloud environment A virtualized environment that provides convenient, on-demand network access
to a shared pool of configurable resources such as network, computing, storage,
applications, and services. There are five essential characteristics to a cloud
environment: on-demand self-service, broad network access, resource pooling, rapid
elasticity, and measured service. Some services offered through cloud environments
include Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as
a Service (IaaS).
Database Organized collection of data, generally stored and accessed electronically from a
computer system. Databases can reside remotely or on-site. Database Management
Systems (DMSs) are used to administer databases, and are not considered part of a
database for this document.
End-user devices Information technology (IT) assets used among members of an enterprise during work,
off-hours, or any other purpose. End-user devices include mobile and portable devices
such as laptops, smartphones and tablets, as well as desktops and workstations. For the
purpose of this document, end-user devices are a subset of enterprise assets.
Enterprise assets Assets with the potential to store or process data. For the purpose of this document,
enterprise assets include end-user devices, network devices, non-computing/Internet of
Things (IoT) devices, and servers, in virtual, cloud-based, and physical environments.
Externally-exposed Refers to enterprise assets that are public facing and discoverable through domain
enterprise assets name system reconnaissance and network scanning from the public internet outside of
the enterprise’s network.
Internal enterprise assets Refers to non-public facing enterprise assets that can only be identified through network
scans and reconnaissance from within an enterprise’s network through authorized
authenticated or unauthenticated access.
Mobile end-user devices Small, enterprise issued end-user devices with intrinsic wireless capability, such as
smartphones and tablets. Mobile end-user devices are a subset of portable end-user
devices, including laptops, which may require external hardware for connectivity. For the
purpose of this document, mobile end-user devices are a subset of end-user devices.
Network devices Electronic devices required for communication and interaction between devices on a
computer network. Network devices include wireless access points, firewalls, physical/
virtual gateways, routers, and switches. These devices consist of physical hardware,
as well as virtual and cloud-based devices. For the purpose of this document, network
devices are a subset of enterprise assets.
Network infrastructure Refers to all of the resources of a network that make network or internet connectivity,
management, business operations, and communication possible. It consists of hardware
and software, systems and devices, and it enables computing and communication
between users, services, applications, and processes. Network infrastructure can be
cloud, physical, or virtual.
Non-computing/Internet Devices embedded with sensors, software, and other technologies for the purpose
of Things (IoT) devices of connecting, storing, and exchanging data with other devices and systems over the
internet. While these devices are not used for computational processes, they support an
enterprise’s ability to conduct business processes. Examples of these devices include
printers, smart screens, physical security sensors, industrial control systems, and
information technology sensors. For the purpose of this document, non-computing/IoT
devices are a subset of enterprise assets.
Operating system System software on enterprise assets that manages computer hardware and software
resources, and provides common services for programs. Operating systems are
considered a software asset and can be single- and multi-tasking, single- and multi-
user, distributed, templated, embedded, real-time, and library.
Physical environment Physical hardware parts that make up a network, including cables and routers. The
hardware is required for communication and interaction between devices on a network.
Portable Transportable, end-user devices that have the capability to wirelessly connect to a
end-user devices network. For the purpose of this document, portable end-user devices can include
laptops and mobile devices such as smartphones and tablets, all of which are a subset
of enterprise assets.
Remote devices Any enterprise asset capable of connecting to a network remotely, usually from public
internet. This can include enterprise assets such as end-user devices, network devices,
non-computing/Internet of Things (IoT) devices, and servers.
Remote file systems Enable an application that runs on an enterprise asset to access files stored on a
different asset. Remote file systems often make other resources, such as remote non-
computing devices, accessible from an asset. The remote file access takes place
using some form of local area network, wide area network, point-to-point link, or other
communication mechanism. These file systems are often referred to as network file
systems or distributed file systems.
Servers A device or system that provides resources, data, services, or programs to other devices
on either a local area network or wide area network. Servers can provide resources
and use them from another system at the same time. Examples include web servers,
application servers, mail servers, and file servers.
Service accounts A dedicated account with escalated privileges used for running applications and other
processes. Service accounts may also be created just to own data and configuration
files. They are not intended to be used by people, except for performing administrative
operations.
Software assets Also referred to as software in this document, these are the programs and other
operating information used within an enterprise asset. Software assets include operating
systems and applications.
User accounts An identity created for a person in a computer or computing system. For the purpose
of this document, user accounts refer to “standard” or “interactive” user accounts with
limited privileges and are used for general tasks such as reading email and surfing the
web. User accounts with escalated privileges are covered under administrator accounts.
Virtual environment Simulates hardware to allow a software environment to run without the need to use
a lot of actual hardware. Virtualized environments are used to make a small number
of resources act as many with plenty of processing, memory, storage, and network
capacity. Virtualization is a fundamental technology that allows cloud computing to work.
Led by the Center for Internet Security® (CIS®), the CIS Controls have matured into an
international community of volunteer individuals and institutions that:
• Share insights into attacks and attackers, identify root causes, and translate that
into classes of defensive action
• Create and share tools, working aids, and stories of adoption and problem-solving
• Map the CIS Controls to regulatory and compliance frameworks in order to ensure
alignment and bring collective priority and focus to them
• Identify common problems and barriers (like initial assessment and implementation
roadmaps), and solve them as a community
The CIS Controls reflect the combined knowledge of experts from every part of the
ecosystem (companies, governments, individuals), with every role (threat responders
and analysts, technologists, information technology (IT) operators and defenders,
vulnerability-finders, tool makers, solution providers, users, policy-makers, auditors,
etc.), and across many sectors (government, power, defense, finance, transportation,
academia, consulting, security, IT, etc.), who have banded together to create, adopt, and
support the CIS Controls.
The CIS Controls started like many similar activities; we gathered experts together,
and shared and argued until we reached an agreement. This can be very valuable,
depending on the people at the table and their experience. Through documenting and
sharing the output, all enterprises can benefit from the work of people they cannot
hire or even meet. You can improve the outcome (and your confidence in it) through
selecting experts that represent a wide range of knowledge, bringing consistency to the
process, and ensuring use of the best-available information (especially about attacks).
In the end, you are still depending on the good judgment of a relatively small group of
people, captured in an informal and narrative way.
At CIS, we have been on a multi-year path to bring more data, rigor, and transparency
to the process of best practice recommendations (the CIS Benchmarks™ and the
CIS Controls). All of these elements are essential to the maturation of a science to
underlie cyber defense; and, all are necessary to allow the tailoring and “negotiation” of
security actions applicable in specific cases, and as required through specific security
frameworks, regulations, and similar oversight schemes.
CIS has recently released the Community Defense Model (CDM), which is our most
data-driven approach so far. In its initial version, the CDM looks at the conclusions
from the most recent Verizon DBIR, along with data from the Multi-State Information
Sharing and Analysis Center® (MS-ISAC®), to identify what we believe to be the
five most important types of attacks. We describe those attacks using the MITRE
Adversarial Tactics, Techniques, and Common Knowledge® (MITRE ATT&CK®)
Framework in order to create attack patterns (or specific combinations of Tactics and
Techniques used in those attacks). This allows us to analyze the value of individual
defensive actions (i.e., Safeguards1) against those attacks. Specifically, it also provides a
consistent and explainable way to look at the security value of a given set of defensive
actions across the attacker’s life cycle, and provide a basis for strategies like defense-
in-depth. The details of this analysis are available on the CIS website. The bottom
line is that we have taken a major step towards identifying the security value of the
CIS Controls, or any subset of them. While these ideas are still evolving, at CIS we
are committed to the idea of security recommendations based on data, presented
transparently. For additional information, reference https://www.cisecurity.org/
controls/v8/.
These activities ensure that the CIS Security Best Practices (which include the CIS
Controls and CIS Benchmarks) are more than a checklist of “good things to do,” or
“things that could help”; instead, they are a prescriptive, prioritized, highly focused
set of actions that have a community support network to make them implementable,
usable, scalable, and in alignment with all industry or government security
requirements.
In addition, since Version 7, we have all seen significant changes in technology and the
cybersecurity ecosystem. Movement to cloud-based computing, virtualization, mobility,
outsourcing, Work-from-Home, and changing attacker tactics have been central in
every discussion. Physical devices, fixed boundaries, and discrete islands of security
implementation are less important, and so we reflect that in Version 8, through revised
terminology and grouping of Safeguards. Also, to guide adopters in implementing
Version 8, CIS created a glossary to remove ambiguity of terminology. Some ideas
have been combined or grouped differently to more naturally reflect the evolution of
technology, rather than how enterprise teams or responsibilities might be organized,
and always referring back to our guiding principles.
The text of the CIS Controls document is just one step of a process to design,
implement, measure, report, and manage enterprise security. Taking this entire work
stream into account as we write the CIS Controls, we can support the total enterprise
management process through: making sure that each Safeguard asks for “one thing,”
At CIS, we have always tried to be very conscious of the balance between addressing
current topics and the stability of an overall defensive improvement program. We have
always tried to focus on the foundations of good cyber defense—and, always tried to
keep our eyes on emerging new defensive technology—while avoiding the “shiny new
toys” or complex technology that is out of reach for most enterprises.
To support this, CIS acts as a catalyst and clearinghouse to help us all learn from each
other. Since Version 6, there has been an explosion of complementary information,
products, and services available from CIS, and from the industry-at-large. Please
contact CIS for the following kinds of working aids and other support materials,
https://www.cisecurity.org/controls/v8/:
• Mappings from the CIS Controls to a very wide variety for formal Risk Management
Frameworks (like NIST®, Federal Information Security Modernization Act (FISMA),
International Organization for Standardization (ISO), etc.)
• Use cases of enterprise adoption
• A list of ongoing references to the CIS Controls in national and international
standards, state and national legislation and regulation, trade and professional
associations, etc.
• Information tailored for small and medium enterprises
• Measurement and metrics for the CIS Controls
• Pointers to vendor white papers and other materials that support the CIS Controls
• Documentation on alignment with the NIST® Cybersecurity Framework
The CIS Controls IGs are self-assessed categories for enterprises. Each IG identifies a
subset of the CIS Controls that the community has broadly assessed to be applicable
for an enterprise with a similar risk profile and resources to strive to implement. These
IGs represent a horizontal look across the CIS Controls tailored to different types of
enterprises. Specifically, we have defined IG1 as “basic cyber hygiene,” the foundational
set of cyber defense Safeguards that every enterprise should apply to guard against
the most common attacks (https://www.cisecurity.org/controls/v8/). Each IG then
builds upon the previous one: IG2 includes IG1, and IG3 includes all CIS Safeguards in
IG1 and IG2.
For prior versions of the CIS Controls, we were able to provide only the simplest tools
to aid in transition from prior versions, basically a spreadsheet-based change log. For
Version 8, we have taken a much more holistic approach and worked with numerous
partners to ensure that the CIS Controls ecosystem is ready to support your transition,
https://www.cisecurity.org/controls/v8/.
IG1
Safeguards selected for IG2 help security teams cope with increased operational
complexity. Some Safeguards will depend on enterprise-grade technology and
specialized expertise to properly install and configure.
An IG3 enterprise employs security experts that specialize in the different facets of
cybersecurity (e.g., risk management, penetration testing, application security). IG3
assets and data contain sensitive information or functions that are subject to regulatory
and compliance oversight. An IG3 enterprise must address availability of services
and the confidentiality and integrity of sensitive data. Successful attacks can cause
significant harm to the public welfare.
Safeguards selected for IG3 must abate targeted attacks from a sophisticated adversary
and reduce the impact of zero-day attacks.
of Enterprise Assets
Safeguards Total• 5 IG1• 2/5 IG2• 4/5 IG3• 5/5
External attackers are continuously scanning the internet address space of target
enterprises, premise-based or in the cloud, identifying possibly unprotected assets
attached to an enterprise’s network. Attackers can take advantage of new assets that
are installed, yet not securely configured and patched. Internally, unidentified assets
can also have weak security configurations that can make them vulnerable to web- or
email-based malware; and, adversaries can leverage weak security configurations for
traversing the network, once they are inside.
Additional assets that connect to the enterprise’s network (e.g., demonstration systems,
temporary test systems, guest networks) should be identified and/or isolated in order to
prevent adversarial access from affecting the security of enterprise operations.
Another challenge is that portable end-user devices will periodically join a network
and then disappear, making the inventory of currently available assets very dynamic.
Likewise, cloud environments and virtual machines can be difficult to track in asset
inventories when they are shut down or paused.
CIS Controls v8 Control 01: Inventory and Control of Enterprise Assets Page 9
Another benefit of complete enterprise asset management is supporting incident
response, both when investigating the origination of network traffic from an asset on
the network and when identifying all potentially vulnerable, or impacted, assets of
similar type or location during an incident.
→ For tablet and smart phone guidance, refer to the CIS Controls Mobile Companion
Guide – https://www.cisecurity.org/controls/v8/
→ For IoT guidance, refer to the CIS Controls Internet of Things Companion
Guide – https://www.cisecurity.org/controls/v8/
→ For Industrial Control Systems (ICS) guidance, refer to the CIS Controls ICS
Implementation Guide – https://www.cisecurity.org/controls/v8/
CIS Controls v8 Control 01: Inventory and Control of Enterprise Assets Page 10
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
1.1 Establish and Maintain Detailed Enterprise Asset Inventory Devices -Identify- • • •
Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential
to store or process data, to include: end-user devices (including portable and mobile), network devices, non-
computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware address,
machine name, data asset owner, department for each asset, and whether the asset has been approved to connect
to the network. For mobile end-user devices, MDM type tools can support this process, where appropriate. This
inventory includes assets connected to the infrastructure physically, virtually, remotely, and those within cloud
environments. Additionally, it includes assets that are regularly connected to the enterprise’s network infrastructure,
even if they are not under control of the enterprise. Review and update the inventory of all enterprise assets
bi-annually, or more frequently.
CIS Controls v8 Control 01: Inventory and Control of Enterprise Assets Page 11
02 Inventory and Control
CONTROL
of Software Assets
Safeguards Total• 7 IG1• 3/7 IG2• 6/7 IG3• 7/7
Even if a patch is not yet available, a complete software inventory list allows
an enterprise to guard against known attacks until the patch is released. Some
sophisticated attackers use “zero-day exploits,” which take advantage of previously
unknown vulnerabilities that have yet to have a patch released from the software
vendor. Depending on the severity of the exploit, an enterprise can implement
temporary mitigation measures to guard against attacks until the patch is released.
CIS Controls v8 Control 02: Inventory and Control of Software Assets Page 12
Procedures and tools
Allowlisting can be implemented using a combination of commercial allowlisting
tools, policies, or application execution tools that come with anti-malware suites and
popular operating systems. Commercial software inventory tools are widely available
and used in many enterprises today. The best of these tools provides an inventory
check of hundreds of common software used in enterprises. The tools pull information
about the patch level of each installed program to ensure that it is the latest version
and leverage standardized application names, such as those found in the Common
Platform Enumeration (CPE) specification. One example of a method that can be used
is the Security Content Automation Protocol (SCAP). Additional information on SCAP
can be found here: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.
SP.800-126r3.pdf
Features that implement allowlists are included in many modern endpoint security
suites and even natively implemented in certain versions of major operating systems.
Moreover, commercial solutions are increasingly bundling together anti-malware, anti-
spyware, personal firewall, and host-based IDS and Intrusion Prevention System (IPS),
along with application allow and block listing. In particular, most endpoint security
solutions can look at the name, file system location, and/or cryptographic hash of a
given executable to determine whether the application should be allowed to run on
the protected machine. The most effective of these tools offer custom allowlists based
on executable path, hash, or regular expression matching. Some even include a non-
malicious, yet unapproved, applications function that allows administrators to define
rules for execution of specific software for certain users and at certain times of the day.
→ For tablet and smart phone guidance, refer to the CIS Controls Mobile Companion
Guide – https://www.cisecurity.org/controls/v8/
→ For IoT guidance, refer to the CIS Controls Internet of Things Companion
Guide – https://www.cisecurity.org/controls/v8/
→ For Industrial Control Systems (ICS) guidance, refer to the CIS Controls ICS
Implementation Guide – https://www.cisecurity.org/controls/v8/
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
CIS Controls v8 Control 02: Inventory and Control of Software Assets Page 13
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
CIS Controls v8 Control 02: Inventory and Control of Software Assets Page 14
03 Data
CONTROL
Protection
Safeguards Total• 14 IG1• 6/14 IG2• 12/14 IG3• 14/14
Once attackers have penetrated an enterprise’s infrastructure, one of their first tasks is
to find and exfiltrate data. Enterprises might not be aware that sensitive data is leaving
their environment because they are not monitoring data outflows.
While many attacks occur on the network, others involve physical theft of portable
end-user devices, attacks on service providers or other partners holding sensitive data.
Other sensitive enterprise assets may also include non-computing devices that provide
management and control of physical systems, such as Supervisory Control and Data
Acquisition (SCADA) systems.
The enterprise’s loss of control over protected or sensitive data is a serious and often
reportable business impact. While some data is compromised or lost as a result of theft
or espionage, the vast majority are a result of poorly understood data management
rules, and user error. The adoption of data encryption, both in transit and at rest,
can provide mitigation against data compromise, and, even more important, it is a
regulatory requirement for most controlled data.
Once the sensitivity of the data has been defined, a data inventory or mapping
should be developed that identifies software accessing data at various sensitivity
levels and the enterprise assets that house those applications. Ideally, the network
would be separated so that enterprise assets of the same sensitivity level are on the
same network and separated from enterprise assets with different sensitivity levels. If
possible, firewalls need to control access to each segment, and have user access rules
applied to only allow those with a business need to access the data.
For more comprehensive treatment of this topic, we suggest the following resources to
help the enterprise with data protection:
→ For tablet and smart phone guidance, refer to the CIS Controls Mobile Companion
Guide – https://www.cisecurity.org/controls/v8/
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
3.12 Segment Data Processing and Storage Based on Sensitivity Network -Protect- • •
Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on
enterprise assets intended for lower sensitivity data.
of Enterprise Assets
and Software
Safeguards Total• 12 IG1• 7/12 IG2• 11/12 IG3• 12/12
Service providers play a key role in modern infrastructures, especially for smaller
enterprises. They often are not set up by default in the most secure configuration to
provide flexibility for their customers to apply their own security policies. Therefore,
the presence of default accounts or passwords, excessive access, or unnecessary
services are common in default configurations. These could introduce weaknesses that
are under the responsibility of the enterprise that is using the software, rather than the
service provider. This extends to ongoing management and updates, as some Platform
as a Service (PaaS) only extend to the operating system, so patching and updating
hosted applications are under the responsibility of the enterprise.
Even after a strong initial configuration is developed and applied, it must be continually
managed to avoid degrading security as software is updated or patched, new security
vulnerabilities are reported, and configurations are “tweaked,” to allow the installation of
new software or to support new operational requirements.
CIS Controls v8 Control 04: Secure Configuration of Enterprise Assets and Software Page 18
Procedures and tools
There are many available security baselines for each system. Enterprises should start
with these publicly developed, vetted, and supported security benchmarks, security
guides, or checklists. Some resources include:
For a larger or more complex enterprise, there will be multiple security baseline
configurations based on security requirements or classification of the data on the
enterprise asset. Here is an example of the steps to build a secure baseline image:
01 Determine the risk classification of the data handled/stored on the enterprise asset
(e.g., high, moderate, low risk).
02 Create a security configuration script that sets system security settings to meet the
requirements to protect the data used on the enterprise asset. Use benchmarks,
such as the ones described earlier in this section.
03 Install the base operating system software.
04 Apply appropriate operating system and security patches.
05 Install appropriate application software packages, tool, and utilities.
06 Apply appropriate updates to software installed in Step 4.
07 Install local customization scripts to this image.
08 Run the security script created in Step 2 to set the appropriate security level.
09 Run a SCAP compliant tool to record/score the system setting of the baseline
image.
10 Perform a security quality assurance test.
11 Save this base image in a secure location.
Commercial and/or free configuration management tools, such as the CIS Configuration
Assessment Tool (CIS-CAT®) https://learn.cisecurity.org/cis-cat-lite, can be
deployed to measure the settings of operating systems and applications of managed
machines to look for deviations from the standard image configurations. Commercial
configuration management tools use some combination of an agent installed on each
managed system, or agentless inspection of systems through remotely logging into
each enterprise asset using administrator credentials. Additionally, a hybrid approach is
sometimes used whereby a remote session is initiated, a temporary or dynamic agent is
deployed on the target system for the scan, and then the agent is removed.
CIS Controls v8 Control 04: Secure Configuration of Enterprise Assets and Software Page 19
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
4.7 Manage Default Accounts on Enterprise Assets and Software Users -Protect- • • •
Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured
vendor accounts. Example implementations can include: disabling default accounts or making them unusable.
CIS Controls v8 Control 04: Secure Configuration of Enterprise Assets and Software Page 20
05 Account
CONTROL
Management
Safeguards Total• 6 IG1• 4/6 IG2• 6/6 IG3• 6/6
Administrative, or highly privileged, accounts are a particular target, because they allow
attackers to add other accounts, or make changes to assets that could make them
more vulnerable to other attacks. Service accounts are also sensitive, as they are often
shared among teams, internal and external to the enterprise, and sometimes not known
about, only to be revealed in standard account management audits.
→ For guidance on the creation and use of passwords, reference the CIS Password
Policy Guide – https://www.cisecurity.org/white-papers/cis-password-
policy-guide/
Accounts must also be tracked; any account that is dormant must be disabled and
eventually removed from the system. There should be periodic audits to ensure all
active accounts are traced back to authorized users of the enterprise asset. Look
for new accounts added since previous review, especially administrator and service
accounts. Close attention should be made to identify and track administrative, or high-
privileged accounts and service accounts.
Users with administrator or other privileged access should have separate accounts for
those higher authority tasks. These accounts would only be used when performing
those tasks or accessing especially sensitive data, to reduce risk in case their normal
user account is compromised. For users with multiple accounts, their base user
account, used day-to-day for non-administrative tasks, should not have any elevated
privileges.
Single Sign-On (SSO) is convenient and secure when an enterprise has many
applications, including cloud applications, which helps reduce the number of
passwords a user must manage. Users are recommended to use password manager
applications to securely store their passwords, and should be instructed not to keep
them in spreadsheets or text files on their computers. MFA is recommended for
remote access.
Users must also be automatically logged out of the system after a period of inactivity,
and be trained to lock their screen when they leave their device to minimize the
possibility of someone else in physical proximity around the user accessing their
system, applications, or data.
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
Management
Safeguards Total• 8 IG1• 5/8 IG2• 7/8 IG3• 8/8
Overview Use processes and tools to create, assign, manage, and revoke
access credentials and privileges for user, administrator, and
service accounts for enterprise assets and software.
There are some user activities that pose greater risk to an enterprise, either because
they are accessed from untrusted networks, or performing administrator functions
that allow the ability to add, change, or remove other accounts, or make configuration
changes to operating systems or applications to make them less secure. This also
enforces the importance of using MFA and Privileged Access Management (PAM) tools.
Some users have access to enterprise assets or data they do not need for their role; this
might be due to an immature process that gives all users all access, or lingering access
as users change roles within the enterprise over time. Local administrator privileges to
users’ laptops is also an issue, as any malicious code installed or downloaded by the
user can have greater impact on the enterprise asset running as administrator. User,
administrator, and service account access should be based on enterprise role and need.
MFA should be universal for all privileged or administrator accounts. There are many
tools that have smartphone applications to perform this function, and are easy to
deploy. Using the number-generator feature is more secure than just sending a
Short Messaging Service (SMS) message with a one-time code, or prompting a
“push” alert for a user to accept. However, neither is recommended for privileged
account MFA. PAM tools are available for privileged account control, and provide a
one-time password that must be checked out for each use. For additional security
in system administration, using “jump-boxes” or out of band terminal connections is
recommended.
High-privileged accounts should not be used for day-to-day use, such as web surfing
and email reading. Administrators should have separate accounts that do not have
elevated privileges for daily office use, and should log into administrator accounts only
when performing administrator functions requiring that level of authorization. Security
personnel should periodically gather a list of running processes to determine whether
any browsers or email readers are running with high privileges.
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
Management
Safeguards Total• 7 IG1• 4/7 IG2• 7/7 IG3• 7/7
Attackers have access to the same information and can often take advantage of
vulnerabilities more quickly than an enterprise can remediate. While there is a gap in
time from a vulnerability being known to when it is patched, defenders can prioritize
which vulnerabilities are most impactful to the enterprise, or likely to be exploited
first due to ease of use. For example, when researchers or the community report new
vulnerabilities, vendors have to develop and deploy patches, indicators of compromise
(IOCs), and updates. Defenders need to assess the risk of the new vulnerability to the
enterprise, regression-test patches, and install the patch.
In addition to the scanning tools that check for vulnerabilities and misconfigurations
across the network, various free and commercial tools can evaluate security settings
and configurations of enterprise assets. Such tools can provide fine-grained insight
into unauthorized changes in configuration or the inadvertent introduction of security
weaknesses from administrators.
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
Management
Safeguards Total• 12 IG1• 3/12 IG2• 11/12 IG3• 12/12
Overview Collect, alert, review, and retain audit logs of events that could
help detect, understand, or recover from an attack.
There are two types of logs that are generally treated and often configured independently:
system logs and audit logs. System logs typically provide system-level events that show
various system process start/end times, crashes, etc. These are native to systems, and
take less configuration to turn on. Audit logs typically include user-level events—when a
user logged in, accessed a file, etc.—and take more planning and effort to set up.
Logging records are also critical for incident response. After an attack has been
detected, log analysis can help enterprises understand the extent of an attack.
Complete logging records can show, for example, when and how the attack occurred,
what information was accessed, and if data was exfiltrated. Retention of logs is also
critical in case a follow-up investigation is required or if an attack remained undetected
for a long period of time.
Safeguards
NUMBER TITLE/ DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
8.1 Establish and Maintain an Audit Log Management Process Network -Protect- • • •
Establish and maintain an audit log management process that defines the enterprise’s logging requirements. At
a minimum, address the collection, review, and retention of audit logs for enterprise assets. Review and update
documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
Protections
Safeguards Total• 7 IG1• 2/7 IG2• 6/7 IG3• 7/7
Cybercriminals can exploit web browsers in multiple ways. If they have access to
exploits of vulnerable browsers, they can craft malicious webpages that can exploit
those vulnerabilities when browsed with an insecure, or unpatched, browser.
Alternatively, they can try to target any number of common web browser third-
party plugins that may allow them to hook into the browser or even directly into
the operating system or application. These plugins, much like any other software
within an environment, need to be reviewed for vulnerabilities, kept up-to-date with
latest patches or versions, and controlled. Many come from untrusted sources, and
some are even written to be malicious. Therefore, it is best to prevent users from
intentionally or unintentionally installing malware that might be hiding in some of
these plugins, extensions, and add-ons. Simple configuration updates to the browser
can make it much harder for malware to get installed through reducing the ability of
installing add-ons/plugins/extensions and preventing specific types of content from
automatically executing.
CIS Controls v8 Control 09: Email and Web Browser Protections Page 32
Most popular browsers employ a database of phishing and/or malware sites to
protect against the most common threats. A best practice is to enable these content
filters and turn on the pop-up blockers. Pop-ups are not only annoying; they can
also host embedded malware directly or lure users into clicking links using social
engineering tricks. To help enforce blocking of known malicious domains, also consider
subscribing to DNS filtering services to block attempts to access these websites at the
network level.
Email represents one the most interactive ways humans work with enterprise assets;
training and encouraging the right behavior is just as important as the technical
settings. Email is the most common threat vector against enterprises through tactics
such as phishing and Business Email Compromise (BEC).
Using a spam-filtering tool and malware scanning at the email gateway reduces the
number of malicious emails and attachments that come into the enterprise’s network.
Initiating Domain-based Message Authentication, Reporting, and Conformance
(DMARC) helps reduce spam and phishing activities. Installing an encryption tool
to secure email and communications adds another layer of user and network-based
security. In addition to blocking based on the sender, it is also worthwhile to only allow
certain file types that users need for their jobs. This will require coordination with
different business units to understand what types of files they receive via email to
ensure that there is not an interruption to their processes.
Since phishing email techniques are ever evolving to get past Something Posing
as Mail (SPAM) filter rules, it is important to train users on how to identify phishing,
and to notify IT Security when they see one. There are many platforms that perform
phishing tests against users to help educate them on different examples, and track
their improvement over time. Crowd-sourcing this knowledge into notifying IT Security
teams of phishing helps improve the protections and detections of email-based threats.
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
CIS Controls v8 Control 09: Email and Web Browser Protections Page 33
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
9.7 Deploy and Maintain Email Server Anti-Malware Protections Network -Protect- •
Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing.
CIS Controls v8 Control 09: Email and Web Browser Protections Page 34
10 Malware
CONTROL
Defenses
Safeguards Total• 7 IG1• 3/7 IG2• 7/7 IG3• 7/7
Being able to block or identify malware is only part of this CIS Control; there is also a
focus on centrally collecting the logs to support alerting, identification, and incident
response. As malicious actors continue to develop their methodologies, many are
starting to take a “living-off-the-land” (LotL) approach to minimize the likelihood of
being caught. This approach refers to attacker behavior that uses tools or features that
already exist in the target environment. Enabling logging, as per the Safeguards in
CIS Control 8, will make it significantly easier for the enterprise to follow the events to
understand what happened and why it happened.
10.3 Disable Autorun and Autoplay for Removable Media Devices -Protect- • • •
Disable autorun and autoplay auto-execute functionality for removable media.
Recovery
Safeguards Total• 5 IG1• 4/5 IG2• 5/5 IG3• 5/5
There has been an exponential rise in ransomware over the last few years. It is not a
new threat, though it has become more commercialized and organized as a reliable
method for attackers to make money. If an attacker encrypts an enterprise’s data and
demands ransom for its restoration, having a recent backup to recover to a known,
trusted state can be helpful. However, as ransomware has evolved, it has also become
an extortion technique, where data is exfiltrated before being encrypted, and the
attacker asks for payment to restore the enterprise’s data, as well as to keep it from
being sold or publicized. In this case, restoration would only solve the issue of restoring
systems to a trusted state and continuing operations. Leveraging the guidance within
the CIS Controls will help reduce the risk of ransomware through improved cyber
hygiene, as attackers usually use older or basic exploits on insecure systems.
Once per quarter (or whenever a new backup process or technology is introduced),
a testing team should evaluate a random sampling of backups and attempt to restore
them on a test bed environment. The restored backups should be verified to ensure
that the operating system, application, and data from the backup are all intact
and functional.
In the event of malware infection, restoration procedures should use a version of the
backup that is believed to predate the original infection.
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
Management
Safeguards Total• 8 IG1• 1/8 IG2• 7/8 IG3• 8/8
Default configurations for network devices are geared for ease-of-deployment and
ease-of-use—not security. Potential default vulnerabilities include open services and
ports, default accounts and passwords (including service accounts), support for older
vulnerable protocols, and pre-installation of unneeded software. Attackers search for
vulnerable default settings, gaps or inconsistencies in firewall rule sets, routers, and
switches and use those holes to penetrate defenses. They exploit flaws in these devices
to gain access to networks, redirect traffic on a network, and intercept data while in
transmission.
Commercial tools can be helpful to evaluate the rule sets of network filtering devices to
determine whether they are consistent or in conflict. This provides an automated sanity
check of network filters. These tools search for errors in rule sets or Access Controls
Lists (ACLs) that may allow unintended services through the network device. Such
tools should be run each time significant changes are made to firewall rule sets, router
ACLs, or other filtering technologies.
→ For telework and small office guidance, refer to the CIS Controls Telework and Small
Office Network Security Guide – https://www.cisecurity.org/controls/v8/
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
and Defense
Safeguards Total• 11 IG1• 0/11 IG2• 6/11 IG3• 11/11
Security tools can only be effective if they are supporting a process of continuous
monitoring that allows staff the ability to be alerted and respond to security incidents
quickly. Enterprises that adopt a purely technology-driven approach will also experience
more false positives, due to their over-reliance on alerts from tools. Identifying and
responding to these threats requires visibility into all threat vectors of the infrastructure
and leveraging humans in the process of detection, analysis, and response. It is critical
for large or heavily targeted enterprises to have a security operations capability to
prevent, detect, and quickly respond to cyber threats before they can impact the
enterprise. This process will generate activity reports and metrics that will help enhance
security policies, and support regulatory compliance for many enterprises.
As we have seen many times in the press, enterprises have been compromised for
weeks, months, or years before discovery. The primary benefit of having comprehensive
situational awareness is to increase the speed of detection and response. This is
critical to respond quickly when malware is discovered, credentials are stolen, or when
sensitive data is compromised to reduce impact to the enterprise.
Through good situational awareness (i.e., security operations), enterprises will identify
and catalog Tactics, Techniques, and Procedures (TTPs) of attackers, including their
IOCs that will help the enterprise become more proactive in identifying future threats or
incidents. Recovery can be achieved faster when the response has access to complete
information about the environment and enterprise structure to develop efficient
response strategies.
At the core of this process is a trained and organized team that implements processes
for incident detection, analysis, and mitigation. These capabilities could be conducted
internally, or through consultants or a managed service provider. Enterprises should
consider network, enterprise asset, user credential, and data access activities.
Technology will play a crucial role to collect and analyze all of the data, and monitor
networks and enterprise assets internally and externally to the enterprise. Enterprises
should include visibility to cloud platforms that might not be in line with on-premises
security technology.
Forwarding all important logs to analytical programs, such as Security Information and
Event Management (SIEM) solutions, can provide value; however, they do not provide
a complete picture. Weekly log reviews are necessary to tune thresholds and identify
abnormal events. Correlation tools can make audit logs more useful for subsequent
manual inspection. These tools are not a replacement for skilled information security
personnel and system administrators. Even with automated log analysis tools, human
expertise and intuition are often required to identify and understand attacks.
As this process matures, enterprises will create, maintain, and evolve a knowledge
base that will help to understand and assess the business risks, developing an internal
threat intelligence capability. Threat intelligence is the collection of TTPs from incidents
and adversaries. To accomplish this, a situational awareness program will define and
evaluate which information sources are relevant to detect, report, and handle attacks.
Most mature enterprises can evolve to threat hunting, where trained staff manually
review system and user logs, data flows, and traffic patterns to find anomalies.
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
No security program can effectively address cyber risk without a means to address this
fundamental human vulnerability. Users at every level of the enterprise have different
risks. For example: executives manage more sensitive data; system administrators have
the ability to control access to systems and applications; and users in finance, human
resources, and contracts all have access to different types of sensitive data that can
make them targets.
The training should be updated regularly. This will increase the culture of security and
discourage risky workarounds.
CIS Controls v8 Control 14: Security Awareness and Skills Training Page 45
Training should also consider the enterprise’s different regulatory and threat posture.
Financial firms might have more compliance-related training on data handling and use,
healthcare enterprises on handling healthcare data, and merchants for credit card data.
Social engineering training, such as phishing tests, should also include awareness
of tactics that target different roles. For example, the financial team will receive
BEC attempts posing as executives asking to wire money, or receive emails from
compromised partners or vendors asking to change the bank account information for
their next payment.
For more comprehensive treatment of this topic, the following resources are helpful to
build an effective security awareness program:
→ EDUCAUSE – https://www.educause.edu/focus-areas-and-initiatives/policy-and-
security/cybersecurity-program/awareness-campaigns
→ SANS – https://www.sans.org/security-awareness-training/resources
→ For guidance on configuring home routers see the CIS Controls Telework and Small
Office Network Security Guide – https://www.cisecurity.org/white-papers/cis-
controls-telework-and-small-office-network-security-guide/
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
CIS Controls v8 Control 14: Security Awareness and Skills Training Page 46
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
CIS Controls v8 Control 14: Security Awareness and Skills Training Page 47
15 Service Provider
CONTROL
Management
Safeguards Total• 7 IG1• 1/7 IG2• 4/7 IG3• 7/7
There have been numerous examples where third-party breaches have significantly
impacted an enterprise; for example, as early as the late 2000s, payment cards were
compromised after attackers infiltrated smaller third-party vendors in the retail industry.
More recent examples include ransomware attacks that impact an enterprise indirectly,
due to one of their service providers being locked down, causing disruption to business.
Or worse, if directly connected, a ransomware attack could encrypt data on the
main enterprise.
Most data security and privacy regulations require their protection extend to third-party
service providers, such as with Health Insurance Portability and Accountability Act
(HIPAA) Business Associate agreements in healthcare, Federal Financial Institutions
Examination Council (FFIEC) requirements for the financial industry, and the United
Kingdom (U.K.) Cyber Essentials. Third-party trust is a core Governance Risk and
Compliance (GRC) function, as risks that are not managed within the enterprise are
transferred to entities outside the enterprise.
While reviewing the security of third-parties has been a task performed for decades,
there is not a universal standard for assessing security; and, many service providers
are being audited by their customers multiple times a month, causing impacts to their
own productivity. This is because every enterprise has a different “checklist” or set of
standards to grade the service provider. There are only a few industry standards, such
as in finance, with the Shared Assessments program, or in higher education, with
their Higher Education Community Vendor Assessment Toolkit (HECVAT). Insurance
companies selling cybersecurity policies also have their own measurements.
No matter what the enterprise’s size, there should be a policy about reviewing
service providers, an inventory of these vendors, and a risk rating associated with
their potential impact to the business in case of an incident. There should also be
language in the contracts to hold them accountable if there is an incident that impacts
the enterprise.
When performing reviews, focus on the services or departments of the provider that are
supporting the enterprise. A third-party that has a managed security service contract,
or retainer, and holds cybersecurity insurance, can also help with risk reduction.
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
Security
Safeguards Total• 14 IG1• 0/14 IG2• 11/14 IG3• 14/14
Lacking credentials, application flaws are the attack vector of choice. However, today’s
applications are developed, operated, and maintained in a highly complex, diverse,
and dynamic environment. Applications run on multiple platforms: web, mobile, cloud,
etc., with application architectures that are more complex than legacy client-server
or database-web server structures. Development life cycles have become shorter,
transitioning from months or years in long waterfall methodologies, to DevOps cycles
with frequent code updates. Also, applications are rarely created from scratch, and are
often “assembled” from a complex mix of development frameworks, libraries, existing
code, and new code. There are also modern and evolving data protection regulations
dealing with user privacy. These may require compliance to regional or sector-specific
data protection requirements.
These factors make traditional approaches to security, like control (of processes, code
sources, run-time environment, etc.), inspection, and testing, much more challenging.
Also, the risk that an application vulnerability introduces might not be understood,
except in a specific operational setting or context.
Application vulnerabilities can be present for many reasons: insecure design, insecure
infrastructure, coding mistakes, weak authentication, and failure to test for unusual or
unexpected conditions. Attackers can exploit specific vulnerabilities, including buffer
overflows, exposure to Structured Query Language (SQL) injection, cross-site scripting,
cross-site request forgery, and click-jacking of code to gain access to sensitive data,
or take control over vulnerable assets within the infrastructure as a launching point for
further attacks.
Development Group 1
• The enterprise largely relies on off-the-shelf or Open Source Software (OSS)
and packages with only the occasional addition of small applications or website
coding. The enterprise is capable of applying basic operational and procedural best
practices and of managing the security of its vendor-supplied software as a result of
following the guidance of the CIS Controls.
Development Group 2
• The enterprise relies on some custom (in-house or contractor-developed) web
and/or native code applications integrated with third-party components and runs
on-premises or in the cloud. The enterprise has a development staff that applies
software development best practices. The enterprise is attentive to the quality and
maintenance of third-party open source or commercial code on which it depends.
Development Group 3
• The enterprise makes a major investment in custom software that it requires to run
its business and serve its customers. It may host software on its own infrastructure,
in the cloud, or both, and may integrate a large range of third-party open source and
commercial software components. Software vendors and enterprises that deliver
SaaS should consider Development Group 3 as a minimum set of requirements.
The ideal application security program is one that introduces security as early into the
software development life cycle as possible. The management of security problems
should be consistent and integrated with standard software flaw/bug management,
as opposed to a separate process that competes for development resources. Larger
or more mature development teams should consider the practice of threat modeling
in the design phase. Design-level vulnerabilities are less common than code-level
vulnerabilities; however, they often are very severe and much harder to fix quickly.
Threat modeling is the process of identifying and addressing application security
design flaws before code is created. Threat modeling requires specific training,
technical, and business knowledge. It is best conducted through internal “security
champions” in each development team, to lead threat modeling practices for that
team’s software. It also provides valuable context to downstream activities, such as root
cause analysis and security testing.
Larger, or commercial, development teams may also consider a bug bounty program
where individuals are paid for finding flaws in their applications. Such a program is
best used to supplement an in-house secure development process and can provide
an efficient mechanism for identifying classes of vulnerabilities that the process needs
to focus on.
Finally, in 2020 NIST® published its Secure Software Development Framework (SSDF),
which brought together what the industry has learned about software security over the
past two decades and created a secure software development framework for planning,
evaluating, and communicating about software security activities. Enterprises acquiring
software or services can use this framework to build their security requirements and
understand whether a software provider’s development process follows best practices.
These are some application security resources:
→ NIST® SSDF – https://csrc.nist.gov/News/2020/mitigating-risk-of-
software-vulns-ssdf
→ OWASP® – https://owasp.org/
Management
Safeguards Total• 9 IG1• 3/9 IG2• 8/9 IG3• 9/9
We cannot expect our protections to be effective 100% of the time. When an incident
occurs, if an enterprise does not have a documented plan—even with good people—it is
almost impossible to know the right investigative procedures, reporting, data collection,
management responsibility, legal protocols, and communications strategy that will
allow the enterprise to successfully understand, manage, and recover.
Dwell time from when an attack happens to when it is identified can be days, weeks,
or months. The longer the attacker is in the enterprise’s infrastructure, the more
embedded they become and they will develop more ways to maintain persistent access
for when they are eventually discovered. With the rise of ransomware, which is a stable
moneymaker for attackers, this dwell time is critical, especially with modern tactics of
stealing data before encrypting it for ransom.
After defining incident response procedures, the incident response team, or a third-
party, should engage in periodic scenario-based training, working through a series of
attack scenarios fine-tuned to the threats and potential impacts the enterprise faces.
These scenarios help ensure that enterprise leadership and technical team members
understand their role in the incident response process to help prepare them to handle
incidents. It is inevitable that exercise and training scenarios will identify gaps in
plans and processes, and unexpected dependencies, which can then be updated
into the plan.
More mature enterprises should include threat intelligence and/or threat hunting
into their incident response process. This will help the team become more proactive,
identifying key or primary attackers to their enterprise or industry to monitor or search
for their TTPs. This will help focus detections and define response procedures to
identify and remediate more quickly.
The actions in CIS Control 17 provide specific, high-priority steps that can improve
enterprise security, and should be a part of any comprehensive incident and response
plan. In addition, we recommend the following resource dedicated to this topic:
Safeguards
NUMBER TITLE/DESCRIPTION ASSET TYPE SECURITY FUNCTION IG1 IG2 IG3
Testing
Safeguards Total• 5 IG1• 0/5 IG2• 3/5 IG3• 5/5
Independent penetration testing can provide valuable and objective insights about
the existence of vulnerabilities in enterprise assets and humans, and the efficacy of
defenses and mitigating controls to protect against adverse impacts to the enterprise.
They are part of a comprehensive, ongoing program of security management and
improvement. They can also reveal process weaknesses, such as incomplete or
inconsistent configuration management, or end-user training.
Another common term is “Red Team” exercises. These are similar to penetration tests
in that vulnerabilities are exploited; however, the difference is the focus. Red Teams
simulate specific attacker TTPs to evaluate how an enterprise’s environment would
withstand an attack from a specific adversary, or category of adversaries.
Penetration tests are expensive, complex, and potentially introduce their own risks.
Experienced people from reputable vendors must conduct them. Some risks include
unexpected shutdown of systems that might be unstable, exploits that might delete
or corrupt data or configurations, and the output of a testing report that needs to be
protected itself, because it gives step-by-step instructions on how to break into the
enterprise to target critical assets or data.
Each enterprise should define a clear scope and rules of engagement for penetration
testing. The scope of such projects should include, at a minimum, enterprise assets
with the highest valued information and production processing functionality. Other
lower-value systems may also be tested to see if they can be used as pivot points
to compromise higher-value targets. The rules of engagement for penetration test
analyses should describe, at a minimum, times of day for testing, duration of test(s),
and the overall test approach. Only a few people in the enterprise should know when a
penetration test is performed, and a primary point of contact in the enterprise should
be designated if problems occur. Increasingly popular recently is having penetration
tests conducted through third-party legal counsel to protect the penetration test report
from disclosure.
The Safeguards in this CIS Control provide specific, high-priority steps that can improve
enterprise security, and should be a part of any penetration testing. In addition, we
recommend the use of some of the excellent comprehensive resources dedicated to
this topic to support security test planning, management, and reporting:
Resources and
References
EDUCAUSE – https://www.educause.edu/focus-areas-and-initiatives/policy-and-
security/cybersecurity-program/awareness-campaigns
OWASP® – https://owasp.org/
SANS – https://www.sans.org/security-awareness-training/resources
Controls and
Safeguards Index
03 Data Protection
Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.
3.1 Establish and Maintain a Data Management Process Data -Identify- • • •
Establish and maintain a data management process. In the process, address data sensitivity, data owner, handling of data, data retention
limits, and disposal requirements, based on sensitivity and retention standards for the enterprise. Review and update documentation
annually, or when significant enterprise changes occur that could impact this Safeguard.
3.12 Segment Data Processing and Storage Based on Sensitivity Network -Protect- • •
Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended
for lower sensitivity data.
4.7 Manage Default Accounts on Enterprise Assets and Software Users -Protect- • • •
Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts.
Example implementations can include: disabling default accounts or making them unusable.
4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software Devices -Protect- • •
Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application
module, or service function.
4.10 Enforce Automatic Device Lockout on Portable End-User Devices Devices -Respond- • •
Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user
devices, where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more
than 10 failed authentication attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration Profile
maxFailedAttempts.
4.11 Enforce Remote Wipe Capability on Portable End-User Devices Devices -Protect- • •
Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate such as lost or stolen
devices, or when an individual no longer supports the enterprise.
05 Account Management
Use processes and tools to assign and manage authorization to credentials for user accounts, including administrator accounts, as well as service
accounts, to enterprise assets and software.
5.1 Establish and Maintain an Inventory of Accounts Users -Identify- • • •
Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and administrator
accounts. The inventory, at a minimum, should contain the person’s name, username, start/stop dates, and department. Validate that all
active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.
7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets Applications -Identify- • •
Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated
and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.
9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions Applications -Protect- • •
Restrict, either through uninstalling or disabling, any unauthorized or unnecessary browser or email client plugins, extensions, and
add-on applications.
9.7 Deploy and Maintain Email Server Anti-Malware Protections Network -Protect- •
Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing.
10 Malware Defenses
Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.
10.1 Deploy and Maintain Anti-Malware Software Devices -Protect- • • •
Deploy and maintain anti-malware software on all enterprise assets.
10.3 Disable Autorun and Autoplay for Removable Media Devices -Protect- • • •
Disable autorun and autoplay auto-execute functionality for removable media.
11 Data Recovery
Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.
11.1 Establish and Maintain a Data Recovery Process Data -Recover- • • •
Establish and maintain a data recovery process. In the process, address the scope of data recovery activities, recovery prioritization, and
the security of backup data. Review and update documentation annually, or when significant enterprise changes occur that could impact
this Safeguard.
11.4 Establish and Maintain an Isolated Instance of Recovery Data Data -Recover- • • •
Establish and maintain an isolated instance of recovery data. Example implementations include, version controlling backup destinations
through offline, cloud, or off-site systems or services.
12.5 Centralize Network Authentication, Authorization, and Auditing (AAA) Network -Protect- • •
Centralize network AAA.
12.6 Use of Secure Network Management and Communication Protocols Network -Protect- • •
Use secure network management and communication protocols (e.g., 802.1X, Wi-Fi Protected Access 2 (WPA2) Enterprise or greater).
12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise’s
AAA Infrastructure
Devices -Protect- • •
Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resources on end-
user devices.
14.2 Train Workforce Members to Recognize Social Engineering Attacks N/A -Protect- • • •
Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.
14.5 Train Workforce Members on Causes of Unintentional Data Exposure N/A -Protect- • • •
Train workforce members to be aware of causes for unintentional data exposure. Example topics include mis-delivery of sensitive data,
losing a portable end-user device, or publishing data to unintended audiences.
14.6 Train Workforce Members on Recognizing and Reporting Security Incidents N/A -Protect- • • •
Train workforce members to be able to recognize a potential incident and be able to report such an incident.
14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are
Missing Security Updates
N/A -Protect- • • •
Train workforce to understand how to verify and report out-of-date software patches or any failures in automated processes and tools.
Part of this training should include notifying IT personnel of any failures in automated processes and tools.
14.9 Conduct Role-Specific Security Awareness and Skills Training N/A -Protect- • • •
Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for
IT professionals, OWASP® Top 10 vulnerability awareness and prevention training for web application developers, and advanced social
engineering awareness training for high-profile roles.
15.2 Establish and Maintain a Service Provider Management Policy N/A -Identify- • •
Establish and maintain a service provider management policy. Ensure the policy addresses the classification, inventory, assessment,
monitoring, and decommissioning of service providers. Review and update the policy annually, or when significant enterprise changes
occur that could impact this Safeguard.
15.4 Ensure Service Provider Contracts Include Security Requirements N/A -Protect- • •
Ensure service provider contracts include security requirements. Example requirements may include minimum security program
requirements, security incident and/or data breach notification and response, data encryption requirements, and data disposal
commitments. These security requirements must be consistent with the enterprise’s service provider management policy. Review service
provider contracts annually to ensure contracts are not missing security requirements.
16.4 Establish and Manage an Inventory of Third-Party Software Components Applications -Protect- • •
Establish and manage an updated inventory of third-party components used in development, often referred to as a “bill of materials,” as
well as components slated for future use. This inventory is to include any risks that each third-party component could pose. Evaluate the
list at least monthly to identify any changes or updates to these components, and validate that the component is still supported.
16.5 Use Up-to-Date and Trusted Third-Party Software Components Applications -Protect- • •
Use up-to-date and trusted third-party software components. When possible, choose established and proven frameworks and libraries
that provide adequate security. Acquire these components from trusted sources or evaluate the software for vulnerabilities before use.
16.6 Establish and Maintain a Severity Rating System and Process for Application
Vulnerabilities
Applications -Protect- • •
Establish and maintain a severity rating system and process for application vulnerabilities that facilitates prioritizing the order in
which discovered vulnerabilities are fixed. This process includes setting a minimum level of security acceptability for releasing code or
applications. Severity ratings bring a systematic way of triaging vulnerabilities that improves risk management and helps ensure the most
severe bugs are fixed first. Review and update the system and process annually.
16.7 Use Standard Hardening Configuration Templates for Application Infrastructure Applications -Protect- • •
Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes
underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS
components. Do not allow in-house developed software to weaken configuration hardening.
16.9 Train Developers in Application Security Concepts and Secure Coding Applications -Protect- • •
Ensure that all software development personnel receive training in writing secure code for their specific development environment and
responsibilities. Training can include general security principles and application security standard practices. Conduct training at least
annually and design in a way to promote security within the development team, and build a culture of security among the developers.
16.11 Leverage Vetted Modules or Services for Application Security Components Applications -Protect- • •
Leverage vetted modules or services for application security components, such as identity management, encryption, and auditing and
logging. Using platform features in critical security functions will reduce developers’ workload and minimize the likelihood of design or
implementation errors. Modern operating systems provide effective mechanisms for identification, authentication, and authorization
and make those mechanisms available to applications. Use only standardized, currently accepted, and extensively reviewed encryption
algorithms. Operating systems also provide mechanisms to create and maintain secure audit logs.
17.2 Establish and Maintain Contact Information for Reporting Security Incidents N/A -Respond- • • •
Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may include internal
staff, third-party vendors, law enforcement, cyber insurance providers, relevant government agencies, Information Sharing and Analysis
Center (ISAC) partners, or other stakeholders. Verify contacts annually to ensure that information is up-to-date.
17.3 Establish and Maintain an Enterprise Process for Reporting Incidents N/A -Respond- • • •
Establish and maintain an enterprise process for the workforce to report security incidents. The process includes reporting timeframe,
personnel to report to, mechanism for reporting, and the minimum information to be reported. Ensure the process is publicly available to
all of the workforce. Review annually, or when significant enterprise changes occur that could impact this Safeguard.
17.6 Define Mechanisms for Communicating During Incident Response N/A -Respond- • •
Determine which primary and secondary mechanisms will be used to communicate and report during a security incident. Mechanisms
can include phone calls, emails, or letters. Keep in mind that certain mechanisms, such as emails, can be affected during a security
incident. Review annually, or when significant enterprise changes occur that could impact this Safeguard.
18 Penetration Testing
Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls (people, processes, and
technology), and simulating the objectives and actions of an attacker.
18.1 Establish and Maintain a Penetration Testing Program N/A -Identify- • •
Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration
testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted
services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact
information; remediation, such as how findings will be routed internally; and retrospective requirements.
cisecurity.org
[email protected]
518-266-3460
Center for Internet Security
@CISecurity
CenterforIntSec
TheCISecurity
cisecurity