Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CIS18 critical security controls is a comprehensive set of instructions and measures released by The Center for Internet Security. Controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 critical security controls cover the different fields of cyber security, including vulnerability management, secure configuration, access control, incident management and more. It is a comprehensive set of instructions and measures released by The Center for Internet Security. The controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 controls were formerly known as the SANS Critical Security Controls (SANS Top 20), and the current version 8.1 is updated to align with the evolving industry standards and cyber security threats. The controls are a prescriptive, prioritized, and simplified set of best practices that any organization can use to strengthen their security measures.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Manage default accounts on enterprise assets and software, such as root, administrator, and other
pre-configured vendor accounts. Example implementations can include: disabling default accounts
or making them unusable.












Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file
sharing service, web application module, or service function.




Configure trusted DNS servers on network infrastructure. Example implementations include
configuring network devices to use enterprise-controlled DNS servers and/or reputable externally
accessible DNS servers.








Enforce automatic device lockout following a predetermined threshold of local failed authentication
attempts on portable end-user devices, where supported. For laptops, do not allow more than 20
failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication
attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration
Profile maxFailedAttempts.








Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed
appropriate such as lost or stolen devices, or when an individual no longer supports the enterprise.








Ensure separate enterprise workspaces are used on mobile end-user devices, where supported.
Example implementations include using an Apple® Configuration Profile or AndroidTM Work Profile to
separate enterprise applications and data from personal applications and data.








Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must at
a minimum include user, administrator accounts, and service accounts. The inventory, at a minimum,
should contain the person’s name, username, start/stop dates, and department. Validate that all
active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.












Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum,
an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character
password for accounts not using MFA.




















Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.








Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct
general computing activities, such as internet browsing, email, and productivity suite use, from the
user’s primary, non-privileged account.








Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain
department owner, review date, and purpose. Perform service account reviews to validate that all
active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.




Centralize account management through a directory or identity service.








Establish and follow a documented process, preferably automated, for granting access to enterprise
assets upon new hire or role change of a user.








Establish and follow a process, preferably automated, for revoking access to enterprise assets,
through disabling accounts immediately upon termination, rights revocation, or role change of a user.
Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.




Require all externally-exposed enterprise or third-party applications to enforce MFA, where
supported. Enforcing MFA through a directory service or SSO provider is a satisfactory
implementation of this Safeguard.
















Require MFA for remote network access.












Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
