Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CIS18 critical security controls is a comprehensive set of instructions and measures released by The Center for Internet Security. Controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 critical security controls cover the different fields of cyber security, including vulnerability management, secure configuration, access control, incident management and more. It is a comprehensive set of instructions and measures released by The Center for Internet Security. The controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 controls were formerly known as the SANS Critical Security Controls (SANS Top 20), and the current version 8.1 is updated to align with the evolving industry standards and cyber security threats. The controls are a prescriptive, prioritized, and simplified set of best practices that any organization can use to strengthen their security measures.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Securely dispose of data as outlined in the enterprise’s documented data management process.
Ensure the disposal process and method are commensurate with the data sensitivity.
Encrypt data on end-user devices containing sensitive data. Example implementations can include:
Windows BitLocker®, Apple FileVault®, Linux® dm-crypt.
Establish and maintain an overall data classification scheme for the enterprise. Enterprises may use
labels, such as “Sensitive,” “Confidential,” and “Public,” and classify their data according to those
labels. Review and update the classification scheme annually, or when significant enterprise changes
occur that could impact this Safeguard.
Document data flows. Data flow documentation includes service provider data flows and should be
based on the enterprise’s data management process. Review and update documentation annually, or
when significant enterprise changes occur that could impact this Safeguard.
Encrypt data on removable media.
Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security
(TLS) and Open Secure Shell (OpenSSH).
Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption,
also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional
encryption methods may include application-layer encryption, also known as client-side encryption,
where access to the data storage device(s) does not permit access to the plain-text data.
Segment data processing and storage based on the sensitivity of the data. Do not process sensitive
data on enterprise assets intended for lower sensitivity data.
Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all
sensitive data stored, processed, or transmitted through enterprise assets, including those located
onsite or at a remote service provider, and update the enterprise’s data inventory.
Log sensitive data access, including modification and disposal.
Establish and maintain a documented secure configuration process for enterprise assets (end-user
devices, including portable and mobile, non-computing/IoT devices, and servers) and software
(operating systems and applications). Review and update documentation annually, or when
significant enterprise changes occur that could impact this Safeguard.
Establish and maintain a documented secure configuration process for network devices. Review
and update documentation annually, or when significant enterprise changes occur that could impact
this Safeguard.
Configure automatic session locking on enterprise assets after a defined period of inactivity. For
general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user
devices, the period must not exceed 2 minutes.
Implement and manage a firewall on servers, where supported. Example implementations include a
virtual firewall, operating system firewall, or a third-party firewall agent.
Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.
Securely manage enterprise assets and software. Example implementations include managing
configuration through version-controlled Infrastructure-as-Code (IaC) and accessing administrative
interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer
Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype
Network) and HTTP, unless operationally essential.
Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.