Content library
CIS 18

CIS 18 controls

The CIS18 critical security controls is a comprehensive set of instructions and measures released by The Center for Internet Security. Controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.
Start free trial

Framework description

CIS 18 controls

The CIS18 critical security controls cover the different fields of cyber security, including vulnerability management, secure configuration, access control, incident management and more. It is a comprehensive set of instructions and measures released by The Center for Internet Security. The controls are designed to fix and prevent common vulnerabilities and to offer organizations a structured way to strengthen their security.

The CIS18 controls were formerly known as the SANS Critical Security Controls (SANS Top 20), and the current version 8.1 is updated to align with the evolving industry standards and cyber security threats. The controls are a prescriptive, prioritized, and simplified set of best practices that any organization can use to strengthen their security measures.

Connected requirements:
171
Related cyber security themes:
Privacy
Cyber security
Public sector

Requirements included in the framework

Policy
Linked frameworks
Framework
Tasks
Ensure Service Provider Contracts Include Security Requirements
15.4
CIS 18 controls
4
Assess Service Providers
15.5
CIS 18 controls
2
Monitor Service Providers
15.6
CIS 18 controls
2
Securely Decommission Service Providers
15.7
CIS 18 controls
2
Establish and Maintain a Secure Application Development Process
16.1
CIS 18 controls
3
Apply Secure Design Principles in Application Architectures
16.10
CIS 18 controls
2
Leverage Vetted Modules or Services for Application Security Components
16.11
CIS 18 controls
3
Implement Code-Level Security Checks
16.12
CIS 18 controls
2
Conduct Application Penetration Testing
16.13
CIS 18 controls
2
Conduct Threat Modeling
16.14
CIS 18 controls
2
Establish and Maintain a Process to Accept and Address Software Vulnerabilities
16.2
CIS 18 controls
2
Perform Root Cause Analysis on Security Vulnerabilities
16.3
CIS 18 controls
1
Establish and Manage an Inventory of Third-Party Software Components
16.4
CIS 18 controls
1
Use Up-to-Date and Trusted Third-Party Software Components
16.5
CIS 18 controls
2
Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
16.6
CIS 18 controls
2
Use Standard Hardening Configuration Templates for Application Infrastructure
16.7
CIS 18 controls
3
Separate Production and Non-Production Systems
16.8
CIS 18 controls
1
Train Developers in Application Security Concepts and Secure Coding
16.9
CIS 18 controls
3
Designate Personnel to Manage Incident Handling
17.1
CIS 18 controls
2
Establish and Maintain Contact Information for Reporting Security Incidents
17.2
CIS 18 controls
4
Establish and Maintain an Enterprise Process for Reporting Incidents
17.3
CIS 18 controls
2
Establish and Maintain an Incident Response Process
17.4
CIS 18 controls
1
Assign Key Roles and Responsibilities
17.5
CIS 18 controls
2
Define Mechanisms for Communicating During Incident Response
17.6
CIS 18 controls
1

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way‍
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Start free trial
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.

Get started today

Start free, in your familiar Teams environment.
If you have some questions first, book a meeting with us.

Start free 14-day trial
Book a meeting
How it works?
SummarySecurity tasks and assuranceDocumentation workflowsEmployee guidelinesReporting templates
Use cases
By frameworkAll frameworksISO 27001NIS2 directiveNIST CSFCSA CCMISO 27701GDPRISO 27017ISO 27018
By methodCyber risk managementEmployee awarenessCompliance reportingControl managementAsset managementDynamic policy documentsPrivacy management
Resources
AcademyWebinarsBlogHelp articlesVideo coursesContent libraryWeekly news digestsSubscribe to AcademyLeave a reviewPartner programTeamTerms of usePrivacy policy
Contact us
+358 10 231 6010
team@cyberday.ai
App works in:
Known in Finland as Digiturvamalli
© Cyberday Inc. Kalevantie 2 33100 Tampere, Finland
Cyberday.ai - Improve and certify your cyber security