Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CIS18 critical security controls is a comprehensive set of instructions and measures released by The Center for Internet Security. Controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 critical security controls cover the different fields of cyber security, including vulnerability management, secure configuration, access control, incident management and more. It is a comprehensive set of instructions and measures released by The Center for Internet Security. The controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 controls were formerly known as the SANS Critical Security Controls (SANS Top 20), and the current version 8.1 is updated to align with the evolving industry standards and cyber security threats. The controls are a prescriptive, prioritized, and simplified set of best practices that any organization can use to strengthen their security measures.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.








Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or
supported. Example implementations include use of an Endpoint Detection and Response (EDR)
client or host-based IPS agent.








Deploy a network intrusion prevention solution, where appropriate. Example implementations include
the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.




Deploy port-level access control. Port-level access control utilizes 802.1x, or similar network access
control protocols, such as certificates, and may incorporate user and/or device authentication.




Perform application layer filtering. Example implementations include a filtering proxy, application
layer firewall, or gateway.








Tune security event alerting thresholds monthly, or more frequently.




Establish and maintain a security awareness program. The purpose of a security awareness program
is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure
manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or
when significant enterprise changes occur that could impact this Safeguard.












Train workforce members to recognize social engineering attacks, such as phishing, business email
compromise (BEC), pretexting, and tailgating.
















Train workforce members on authentication best practices. Example topics include MFA, password
composition, and credential management.












Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive data. This also includes training workforce members on clear screen and desk best
practices, such as locking their screen when they step away from their enterprise asset, erasing
physical and virtual whiteboards at the end of meetings, and storing data and assets securely.
















Train workforce members to be aware of causes for unintentional data exposure. Example topics
include mis-delivery of sensitive data, losing a portable end-user device, or publishing data to
unintended audiences.








Train workforce members to be able to recognize a potential incident and be able to report such
an incident.








Train workforce to understand how to verify and report out-of-date software patches or any failures
in automated processes and tools. Part of this training should include notifying IT personnel of any
failures in automated processes and tools.




Train workforce members on the dangers of connecting to, and transmitting data over, insecure
networks for enterprise activities. If the enterprise has remote workers, training must include
guidance to ensure that all users securely configure their home network infrastructure.








Conduct role-specific security awareness and skills training. Example implementations include
secure system administration courses for IT professionals, OWASP® Top 10 vulnerability awareness
and prevention training for web application developers, and advanced social engineering awareness
training for high-profile roles.












Establish and maintain an inventory of service providers. The inventory is to list all known service
providers, include classification(s), and designate an enterprise contact for each service provider.
Review and update the inventory annually, or when significant enterprise changes occur that could
impact this Safeguard.




















Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
