Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.
The CIS18 critical security controls is a comprehensive set of instructions and measures released by The Center for Internet Security. Controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 critical security controls cover the different fields of cyber security, including vulnerability management, secure configuration, access control, incident management and more. It is a comprehensive set of instructions and measures released by The Center for Internet Security. The controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
The CIS18 controls were formerly known as the SANS Critical Security Controls (SANS Top 20), and the current version 8.1 is updated to align with the evolving industry standards and cyber security threats. The controls are a prescriptive, prioritized, and simplified set of best practices that any organization can use to strengthen their security measures.
Below you'll find all of the requirements of this framework. In Cyberday, we map all requirement to global tasks, making multi-compliance management easy. Do it once, and see the progress across all frameworks!
Establish and maintain a service provider management policy. Ensure the policy addresses the
classification, inventory, assessment, monitoring, and decommissioning of service providers. Review
and update the policy annually, or when significant enterprise changes occur that could impact
this Safeguard.












Classify service providers. Classification consideration may include one or more characteristics, such
as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and
mitigated risk. Update and review classifications annually, or when significant enterprise changes
occur that could impact this Safeguard.
















Ensure service provider contracts include security requirements. Example requirements may
include minimum security program requirements, security incident and/or data breach notification
and response, data encryption requirements, and data disposal commitments. These security
requirements must be consistent with the enterprise’s service provider management policy. Review
service provider contracts annually to ensure contracts are not missing security requirements.
















Assess service providers consistent with the enterprise’s service provider management policy.
Assessment scope may vary based on classification(s), and may include review of standardized
assessment reports, such as Service Organization Control 2 (SOC 2) and Payment Card Industry
(PCI) Attestation of Compliance (AoC), customized questionnaires, or other appropriately rigorous
processes. Reassess service providers annually, at a minimum, or with new and renewed contracts.








Monitor service providers consistent with the enterprise’s service provider management policy.
Monitoring may include periodic reassessment of service provider compliance, monitoring service
provider release notes, and dark web monitoring.








Securely decommission service providers. Example considerations include user and service account
deactivation, termination of data flows, and secure disposal of enterprise data within service
provider systems.








Establish and maintain a secure application development process. In the process, address such items
as: secure application design standards, secure coding practices, developer training, vulnerability
management, security of third-party code, and application security testing procedures. Review and
update documentation annually, or when significant enterprise changes occur that could impact
this Safeguard.












Establish and maintain a process to accept and address reports of software vulnerabilities,
including providing a means for external entities to report. The process is to include such items
as: a vulnerability handling policy that identifies reporting process, responsible party for handling
vulnerability reports, and a process for intake, assignment, remediation, and remediation testing. As
part of the process, use a vulnerability tracking system that includes severity ratings and metrics
for measuring timing for identification, analysis, and remediation of vulnerabilities. Review and
update documentation annually, or when significant enterprise changes occur that could impact
this Safeguard.
Third-party application developers need to consider this an externally-facing policy that helps to set
expectations for outside stakeholders.








Perform root cause analysis on security vulnerabilities. When reviewing vulnerabilities, root cause
analysis is the task of evaluating underlying issues that create vulnerabilities in code, and allows
development teams to move beyond just fixing individual vulnerabilities as they arise.




Establish and manage an updated inventory of third-party components used in development, often
referred to as a “bill of materials,” as well as components slated for future use. This inventory is to
include any risks that each third-party component could pose. Evaluate the list at least monthly
to identify any changes or updates to these components, and validate that the component is still
supported.




Use up-to-date and trusted third-party software components. When possible, choose established
and proven frameworks and libraries that provide adequate security. Acquire these components from
trusted sources or evaluate the software for vulnerabilities before use.








Establish and maintain a severity rating system and process for application vulnerabilities that
facilitates prioritizing the order in which discovered vulnerabilities are fixed. This process includes
setting a minimum level of security acceptability for releasing code or applications. Severity ratings
bring a systematic way of triaging vulnerabilities that improves risk management and helps ensure
the most severe bugs are fixed first. Review and update the system and process annually.








Use standard, industry-recommended hardening configuration templates for application
infrastructure components. This includes underlying servers, databases, and web servers, and
applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not
allow in-house developed software to weaken configuration hardening.












Maintain separate environments for production and non-production systems.




Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities. Training can include general security
principles and application security standard practices. Conduct training at least annually and design
in a way to promote security within the development team, and build a culture of security among
the developers.












Apply secure design principles in application architectures. Secure design principles include the
concept of least privilege and enforcing mediation to validate every operation that the user makes,
promoting the concept of “never trust user input.” Examples include ensuring that explicit error
checking is performed and documented for all input, including for size, data type, and acceptable
ranges or formats. Secure design also means minimizing the application infrastructure attack surface,
such as turning off unprotected ports and services, removing unnecessary programs and files, and
renaming or removing default accounts.








Explore our comprehensive resources and improve your security with the themes of this framework.
Discover specific ways our platform streamlines your ISO 27001 compliance process, from automated controls to audit preparation.
Explore use caseTake our comprehensive assessment to identify gaps in your current implementation and get personalized recommendations.
Start assessmentDive deeper with our articles, case studies, and expert insights on framework implementation.
Read articleGet a concise overview of all requirements, controls, and implementation steps in our quick guide.
Get the guideSee how the overlap and differences with any other framework to optimize your compliance strategy.
Compare frameworkParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarParticipate in expert-led sessions covering implementation strategies, common pitfalls, and best practices for compliance.
Register for webinarUnderstand the basics of cyber security frameworks with our comprehensive guide.
Read the articleWhen building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.
Sets the overall compliance standard or regulation your organization needs to follow.
Break down the framework into specific obligations that must be met.
Concrete actions and activities your team carries out to satisfy each requirement.
Documented rules and practices that are created and maintained as a result of completing tasks.
