Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CIS18 critical security controls is a comprehensive set of instructions and measures released by The Center for Internet Security. Controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 critical security controls cover the different fields of cyber security, including vulnerability management, secure configuration, access control, incident management and more. It is a comprehensive set of instructions and measures released by The Center for Internet Security. The controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 controls were formerly known as the SANS Critical Security Controls (SANS Top 20), and the current version 8.1 is updated to align with the evolving industry standards and cyber security threats. The controls are a prescriptive, prioritized, and simplified set of best practices that any organization can use to strengthen their security measures.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets
with the potential to store or process data, to include: end-user devices (including portable and
mobile), network devices, non-computing/IoT devices, and servers. Ensure the inventory records the
network address (if static), hardware address, machine name, enterprise asset owner, department
for each asset, and whether the asset has been approved to connect to the network. For mobile
end-user devices, MDM type tools can support this process, where appropriate. This inventory
includes assets connected to the infrastructure physically, virtually, remotely, and those within cloud
environments. Additionally, it includes assets that are regularly connected to the enterprise’s network
infrastructure, even if they are not under control of the enterprise. Review and update the inventory of
all enterprise assets bi-annually, or more frequently.
Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may
choose to remove the asset from the network, deny the asset from connecting remotely to the
network, or quarantine the asset.
Utilize an active discovery tool to identify assets connected to the enterprise’s network. Configure the
active discovery tool to execute daily, or more frequently.
Use DHCP logging on all DHCP servers or Internet Protocol (IP) address management tools to
update the enterprise’s asset inventory. Review and use logs to update the enterprise’s asset
inventory weekly, or more frequently.
Use a passive discovery tool to identify assets connected to the enterprise’s network. Review and use
scans to update the enterprise’s asset inventory at least weekly, or more frequently.
Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The
software inventory must document the title, publisher, initial install/use date, and business purpose
for each entry; where appropriate, include the Uniform Resource Locator (URL), app store(s),
version(s), deployment mechanism, decommission date, and number of licenses. Review and update
the software inventory bi-annually, or more frequently.
Ensure that only currently supported software is designated as authorized in the software inventory
for enterprise assets. If software is unsupported, yet necessary for the fulfillment of the enterprise’s
mission, document an exception detailing mitigating controls and residual risk acceptance. For any
unsupported software without an exception documentation, designate as unauthorized. Review the
software list to verify software support at least monthly, or more frequently.
Ensure that unauthorized software is either removed from use on enterprise assets or receives a
documented exception. Review monthly, or more frequently.
Utilize software inventory tools, when possible, throughout the enterprise to automate the discovery
and documentation of installed software.
Use technical controls, such as application allowlisting, to ensure that only authorized software can
execute or be accessed. Reassess bi-annually, or more frequently.
Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx,
and .so files, are allowed to load into a system process. Block unauthorized libraries from loading into
a system process. Reassess bi-annually, or more frequently.
Use technical controls, such as digital signatures and version control, to ensure that only authorized
scripts, such as specific .ps1, and .py files are allowed to execute. Block unauthorized scripts from
executing. Reassess bi-annually, or more frequently.
Establish and maintain a documented data management process. In the process, address data
sensitivity, data owner, handling of data, data retention limits, and disposal requirements, based on
sensitivity and retention standards for the enterprise. Review and update documentation annually, or
when significant enterprise changes occur that could impact this Safeguard.
Establish and maintain a data inventory based on the enterprise’s data management process.
Inventory sensitive data, at a minimum. Review and update inventory annually, at a minimum, with a
priority on sensitive data.
Configure data access control lists based on a user’s need to know. Apply data access control lists,
also known as access permissions, to local and remote file systems, databases, and applications.
Retain data according to the enterprise’s documented data management process. Data retention
must include both minimum and maximum timelines.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.