Critical Security Control

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

Critical Security Control #4: Controlled Use of Administrative Privileges

Critical Security Control #5: Secure Configurations for Hardware and Software

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs

Critical Security Control #7: Email and Web Browser Protections

Critical Security Control #8: Malware Defenses

Critical Security Control #9: Limitation and Control of Network Ports

Critical Security Control #10: Data Recovery Capabilities

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers
and Switches

Critical Security Control #12: Boundary Defense

Critical Security Control #13: Data Protection

Critical Security Control #14: Controlled Access Based on the Need to Know

Critical Security Control #15: Wireless Access Control

Critical Security Control #16: Account Monitoring and Control

Critical Security Control #17: Implement a Security Awareness and Training Program

Critical Security Control #18: Application Software Security

Critical Security Control #19: Incident Response and Management

Critical Security Control #20: Penetration Tests and Red Team Exercises
 CIS Controls Master Mappings Tool (v7.1c)

NIST 800-53 rev4 NIST CSF v1.0

CA-7: Continuous Monitoring

CM-8: Information System Component Inventory ID.AM-1
IA-3: Device Identification and Authentication ID.AM-3
SA-4: Acquisition Process
SC-17: Public Key Infrastructure Certificates ID.AM-4
SI-4: Information System Monitoring PR.DS-3
PM-5: Information System Inventory

CA-7: Continuous Monitoring

CM-2: Baseline Configuration
CM-8: Information System Component Inventory
CM-10: Software Usage Restrictions
CM-11: User-Installed Software ID.AM-2
SA-4: Acquisition Process PR.DS-6
SC-18: Mobile Code
SC-34: Non-Modifiable Executable Programs
SI-4: Information System Monitoring
PM-5: Information System Inventory

CA-2: Security Assessments ID.RA-1

CA-7: Continuous Monitoring ID.RA-2
RA-5: Vulnerability Scanning
SC-34: Non-Modifiable Executable Programs PR.IP-12
SI-4: Information System Monitoring DE.CM-8
SI-7: Software, Firmware, and Information Integrity RS.MI-3

AC-2: Account Management

AC-6: Least Privilege
AC-17: Remote Access PR.AC-4
AC-19: Access Control for Mobile Devices PR.AT-2
CA-7: Continuous Monitoring
IA-2: Identification and Authentication (Organizational Users) PR.MA-2
IA-4: Identifier Management PR.PT-3
IA-5: Authenticator Management
SI-4: Information System Monitoring
 CA-7: Continuous Monitoring
CM-2: Baseline Configuration
CM-3: Configuration Change Control
CM-5: Access Restrictions for Change
CM-6: Configuration Settings
CM-7: Least Functionality
CM-8: Information System Component Inventory
CM-9: Configuration Management Plan
CM-11: User-Installed Software PR.IP-1
MA-4: Nonlocal Maintenance
RA-5: Vulnerability Scanning
SA-4: Acquisition Process
SC-15: Collaborative Computing Devices
SC-34: Non-Modifiable Executable Programs
SI-2: Flaw Remediation
SI-4: Information System Monitoring

AC-23: Data Mining Protection

AU-2: Audit Events
AU-3: Content of Audit Records
AU-4: Audit Storage Capacity
AU-5: Response to Audit Processing Failures
AU-6: Audit Review, Analysis, and Reporting PR.PT-1
AU-7: Audit Reduction and Report Generation DE.AE-3
AU-8: Time Stamps DE.DP-1
AU-9: Protection of Audit Information DE.DP-2
AU-10: Non-repudiation DE.DP-3
AU-11: Audit Record Retention DE.DP-4
AU-12: Audit Generation DE.DP-5
AU-13: Monitoring for Information Disclosure
AU-14: Session Audit
CA-7: Continuous Monitoring
IA-10: Adaptive Identification and Authentication
SI-4: Information System Monitoring

CA-7: Continuous Monitoring

CM-2: Baseline Configuration
CM-3: Configuration Change Control
CM-5: Access Restrictions for Change
CM-6: Configuration Settings
CM-7: Least Functionality
CM-8: Information System Component Inventory
CM-9: Configuration Management Plan
CM-11: User-Installed Software PR.IP-1
MA-4: Nonlocal Maintenance
RA-5: Vulnerability Scanning
SA-4: Acquisition Process
SC-15: Collaborative Computing Devices
SC-34: Non-Modifiable Executable Programs
SI-2: Flaw Remediation
SI-4: Information System Monitoring
 CA-7: Continuous Monitoring
SC-39: Process Isolation PR.PT-2
SC-44: Detonation Chambers
SI-3: Malicious Code Protection DE.CM-4
SI-4: Information System Monitoring DE.CM-5
SI-8: Spam Protection

AC-4: Information Flow Enforcement

CA-7: Continuous Monitoring
CA-9: Internal System Connections
CM-2: Baseline Configuration
CM-6: Configuration Settings
CM-8: Information System Component Inventory
SC-20: Secure Name /Address Resolution Service PR.AC-5
(Authoritative Source) DE.AE-1
SC-21: Secure Name /Address Resolution Service (Recursive
or Caching Resolver)
SC-22: Architecture and Provisioning for Name/Address
Resolution Service
SC-41: Port and I/O Device Access
SI-4: Information System Monitoring

CP-9: Information System Backup

CP-10: Information System Recovery and Reconstitution PR.IP-4
MP-4: Media Storage

AC-4: Information Flow Enforcement

CA-3: System Interconnections
CA-7: Continuous Monitoring
CA-9: Internal System Connections
CM-2: Baseline Configuration PR.AC-5
CM-3: Configuration Change Control
CM-5: Access Restrictions for Change PR.IP-1
CM-6: Configuration Settings PR.PT-4
CM-8: Information System Component Inventory
MA-4: Nonlocal Maintenance
SC-24: Fail in Known State
SI-4: Information System Monitoring

AC-4: Information Flow Enforcement

AC-17: Remote Access
AC-20: Use of External Information Systems
CA-3: System Interconnections PR.AC-3
CA-7: Continuous Monitoring PR.AC-5
CA-9: Internal System Connections
CM-2: Baseline Configuration PR.MA-2
SA-9: External Information System Services DE.AE-1
SC-7: Boundary Protection
SC-8: Transmission Confidentiality and Integrity
SI-4: Information System Monitoring
 AC-3: Access Enforcement
AC-4: Information Flow Enforcement
AC-23: Data Mining Protection
CA-7: Continuous Monitoring
CA-9: Internal System Connections PR.AC-5
IR-9: Information Spillage Response PR.DS-2
MP-5: Media Transport
SA-18: Tamper Resistance and Detection PR.DS-5
SC-8: Transmission Confidentiality and Integrity PR.PT-2
SC-28: Protection of Information at Rest
SC-31: Covert Channel Analysis
SC-41: Port and I/O Device Access
SI-4: Information System Monitoring

AC-1: Access Control Policy and Procedures

AC-2: Account Management
AC-3: Access Enforcement PR.AC-4
AC-6: Least Privilege PR.AC-5
AC-24: Access Control Decisions PR.DS-1
CA-7: Continuous Monitoring PR.DS-2
MP-3: Media Marking PR.PT-2
RA-2: Security Categorization PR.PT-3
SC-16: Transmission of Security Attributes
SI-4: Information System Monitoring

AC-18: Wireless Access

AC-19: Access Control for Mobile Devices
CA-3: System Interconnections
CA-7: Continuous Monitoring
CM-2: Baseline Configuration
IA-3: Device Identification and Authentication
SC-8: Transmission Confidentiality and Integrity
SC-17: Public Key Infrastructure Certificates
SC-40: Wireless Link Protection
SI-4: Information System Monitoring

AC-2: Account Management

AC-3: Access Enforcement
AC-7: Unsuccessful Logon Attempts
AC-11: Session Lock
AC-12: Session Termination PR.AC-1
CA-7: Continuous Monitoring PR.AC-4
IA-5: Authenticator Management PR.PT-3
IA-10: Adaptive Identification and Authentication
SC-17: Public Key Infrastructure Certificates
SC-23: Session Authenticity
SI-4: Information System Monitoring
AT-1: Security Awareness and Training Policy and Procedures
AT-2: Security Awareness Training
AT-3: Role-Based Security Training PR.AT-1
AT-4: Security Training Records PR.AT-2
SA-11: Developer Security Testing and Evaluation PR.AT-3
SA-16: Developer-Provided Training PR.AT-4
PM-13: Information Security Workforce PR.AT-5
PM-14: Testing, Training, & Monitoring
PM-16: Threat Awareness Program

SA-13: Trustworthiness
SA-15: Development Process, Standards, and Tools
SA-16: Developer-Provided Training
SA-17: Developer Security Architecture and Design
SA-20: Customized Development of Critical Components
SA-21: Developer Screening PR.DS-7
SC-39: Process Isolation
SI-10: Information Input Validation
SI-11: Error Handling
SI-15: Information Output Filtering
SI-16: Memory Protection

PR.IP-10
DE.AE-2
IR-1: Incident Response Policy and Procedures DE.AE-4
IR-2: Incident Response Training DE.AE-5
IR-3: Incident Response Testing DE.CM-1-7
IR-4: Incident Handling RS.RP-1
IR-5: Incident Monitoring RS.CO-1-5
IR-6: Incident Reporting RS.AN-1-4
IR-7: Incident Response Assistance RS.MI-1-2
IR-8: Incident Response Plan RS.IM-1-2
IR-10: Integrated Information Security Analysis Team RC.RP-1
RC.IM-1-2
RC.CO-1-3

CA-2: Security Assessments

CA-5: Plan of Action and Milestones
CA-6: Security Authorization
CA-8: Penetration Testing
RA-6: Technical Surveillance Countermeasures Survey
SI-6: Security Function Verification
PM-6: Information Security Measures of Performance
PM-14: Testing, Training, & Monitoring

This work is licensed under a Creative Commons Attribution-ShareAlik

NIST CSF v1.1 NIST 800-82 rev2

ID.AM-1
ID.AM-3 6.2.16
ID.AM-4 6.2.17
PR.DS-3

ID.AM-2 6.2.16
PR.DS-6 6.2.17

ID.RA-1
ID.RA-2
PR.IP-12 6.2.16
DE.CM-8 6.2.17
RS.AN-5
RS.MI-3

PR.AC-4 5.15
PR.AT-2 6.2.7
PR.MA-2 6.2.16
PR.PT-3 6.2.17
 6.2.16
PR.IP-1
6.2.17

PR.PT-1
DE.AE-3
DE.DP-1 5.16
DE.DP-2 6.2.16
DE.DP-3 6.2.17
DE.DP-4
DE.DP-5

6.2.16
PR.IP-1
6.2.17
PR.PT-2
6.2.16
DE.CM-4
6.2.17
DE.CM-5

PR.AC-5 6.2.16
DE.AE-1 6.2.17

6.2.16
PR.IP-4
6.2.17

PR.AC-5
5.15
PR.IP-1
6.2.7
PR.PT-4

PR.AC-3
PR.AC-5
5.1 - 5.11
PR.MA-2
DE.AE-1
PR.AC-5
PR.DS-2
PR.DS-5
PR.PT-2

PR.AC-4
PR.AC-5 5.1
PR.DS-1 5.4
PR.DS-2 5.5
PR.PT-2 6.2.1
PR.PT-3

PR.AC-1
PR.AC-4
5.15
PR.AC-6
6.2.7
PR.AC-7
PR.PT-3
 PR.AT-1
PR.AT-2
PR.AT-3 6.2.2
PR.AT-4
PR.AT-5

PR.DS-7

PR.IP-10
DE.AE-2
DE.AE-4
DE.AE-5
DE.CM-1-7
RS.RP-1
5.17
RS.CO-1-5
6.2.8
RS.AN-1-4
RS.MI-1-2
RS.IM-1-2
RC.RP-1
RC.IM-1-2
RC.CO-1-3

6.2.3
6.2.4

ons Attribution-ShareAlike 4.0 International License.

NIST SMB Guide DHS CDM Program

4.0d HWAM: Hardware Asset Management

HWAM: Hardware Asset Management

SWAM: Software Asset Management

3.2c VUL: Vulnerability Management

 CSM: Configuration Settings Management

3.3b Generic Audit Monitoring

3.2f
4.0b
4.0c
CSM: Configuration Settings Management
4.0e
4.0g
4.0i
3.3a

Boundary Protection

3.5a
3.5b

CSM: Configuration Settings Management

Boundary Protection

3.2d Boundary Protection

 TRUST: Access Control Management
3.2g
PRIV: Privileges

3.2e

3.1a
3.1c CRED: Credentials and Authentication
3.2a Management
4.0h
3.2i BEHV: Security-Related Behavior Management

VUL: Vulnerability Management

Plan for Events

3.4a
Respond to Events
ISO 27002:2013 ISO 27002:2005 IEC 62443-3-3:2013

A.8.1.1 A.7.1.1 SR 1.2

A.9.1.2 A.10.6.1 - A.10.6.2 SR 2.3
A.13.1.1 A.11.4.6 SR 7.8

A.12.5.1
SR 1.2
A.12.6.2

A.12.6.1
A.12.6.1
A.13.1.2
A.14.2.8
A.15.2.2

A.9.1.1
A.9.2.2 - A.9.2.6
A.11.5.1 - A.11.5.3
A.9.3.1
A.9.4.1 - A.9.4.4
 A.14.2.4
A.14.2.8 A.15.2.2
A.18.2.3

SR 1.12
A.12.4.1 - A.12.4.4 SR 2.8 - 2.11
A.10.10.1 - A.10.10.6
A.12.7.1 SR 3.9
SR 6.1 - 6.2

A.13.2.3
A.14.2.4
A.15.2.2
A.14.2.8
A.18.2.3
A.8.3.1
A.10.4.1 - A.10.4.2
A.12.2.1 SR 3.2
A.10.7.1
A.13.2.3

A.9.1.2
A.13.1.1 A.10.6.1 - A.10.6.2
A.13.1.2 A.11.4.4
A.14.1.2

A.10.1.1 A.10.5.1
SR 7.3 - 7.4
A.12.3.1 A.10.8.3

A.10.6.1 - A.10.6.2
A.9.1.2
A.11.4.5
A.13.1.1 SR 7.6
A.11.4.7
A.13.1.3
A.11.5.1 - A.11.5.3

A.10.6.1 - A.10.6.2
A.9.1.2
A.10.10.2
A.12.4.1 SR 1.13
A.11.4.2
A.12.7.1 SR 2.3
A.11.4.5
A.13.1.1 SR 5.2
A.11.4.7
A.13.1.3
A.11.5.1 - A.11.5.3
A.13.2.3
A.11.7.1 - A.11.7.2
 A.8.3.1 A.10.7.1
A.10.1.1 - A.10.1.2 A.12.3.1 - A.12.3.2 SR 3.1
A.13.2.3 A.12.5.4 SR 4.3
A.18.1.5 A.15.1.6

A.10.7.1
SR 2.1
A.10.10.1 - A.10.10.3
A.8.3.1 SR 4.1
A.11.4.5
A.9.1.1 SR 5.1
A.11.4.7
A.10.1.1 SR 5.3
A.11.6.1 - A.11.6.2
SR 7.7
A.12.5.4

A.10.1.1
SR 1.6
A.12.4.1
SR 2.2
A.12.7.1

A.9.1.1 A.8.3.3
A.9.2.1 - A.9.2.6 A.11.2.1 SR 1.1 - 1.13
A.9.3.1 A.11.2.3 - A.11.2.4 SR 2.1
A.9.4.1 - A.9.4.3 A.11.3.1 - A.11.3.3 SR 2.5
A.11.2.8 A.11.5.1 - A.11.5.3
 A.7.2.2 A.8.2.2

A.10.1.4
A.9.4.5
A.12.2.1
A.12.1.4
A.12.2.4 SR 3.3 - 3.8
A.14.2.1
A.12.5.2
A.14.2.6 - A.14.2.8
A.12.5.5

A.6.1.3 A.6.1.6
A.7.2.1 A.8.2.1
A.16.1.2 A.13.1.1
A.16.1.4 - A.16.1.7 A.13.2.1 - A.13.2.2

A.14.2.8 A.6.1.8
A.18.2.1 A.15.2.2 SR 3.3
A.18.2.3 A.15.3.1
NIST 800-171 NSA MNP

Map Your Network

Baseline Management
Document Your Network
Personal Electronic Device Management
Network Access Control
Log Management

Baseline Management
3.4.8
Executable Content Restrictions
3.4.9
Configuration and Change Management

3.11.2
Patch Management
3.11.3
Log Management
3.12.2
Configuration and Change Management
3.14.1

3.1.5 - 3.1.7
3.4.5 - 3.4.6 User Access
3.7.1 - 3.7.2 Baseline Management
3.7.5 - 3.7.6 Log Management
3.13.3
 Patch Management
Baseline Management
3.4.1 - 3.4.3
Data-at-Rest Protection
Configuration and Change Management

3.3.1 - 3.3.9
Log Management
3.14.7

Patch Management
Baseline Management
Data-at-Rest Protection
Configuration and Change Management
 Device Accessibility
Virus Scanners and Host Intrusion Prevention
3.7.4 Systems
3.14.2 - 3.14.6 Security Gateways, Proxies, and Firewalls
Network Security Monitoring
Log Management

Baseline Management
3.4.7
Configuration and Change Management

3.8.9 Backup Strategy

Map Your Network

Patch Management
3.4.1 - 3.4.3 Baseline Management
3.7.5 - 3.7.6 Document Your Network
Security Gateways, Proxies, and Firewalls
Configuration and Change Management

3.1.3 Map Your Network

3.1.12 - 3.1.15 Network Architecture
3.1.18 Baseline Management
3.1.20 - 3.1.22 Document Your Network
3.13.1 Personal Electronic Device Management
3.13.6 - 3.13.8 Security Gateways, Proxies, and Firewalls
3.13.12 - 3.13.13 Remote Access Security
3.13.15 Network Security Monitoring
Log Management
 3.1.19 Network Architecture
3.1.21 Device Accessibility
3.8.7 - 3.8.8 Security Gateways, Proxies, and Firewalls
3.13.16 Network Security Monitoring

3.1.2
Network Architecture
3.1.3
Device Accessibility
3.1.5
User Access
3.8.2
Data-at-Rest Protection
3.8.5 - 3.8.6
Log Management
3.13.4 - 3.13.6

Map Your Network

Baseline Management
3.1.16 - 3.1.17 Document Your Network
Personal Electronic Device Management
Network Access Control

3.1.8
3.1.10 - 3.1.11 User Access
3.5.1 - 3.5.9 Baseline Management
3.9.2 Log Management
3.13.9
3.2.2 - 3.2.3 Training

Training

3.6.1 - 3.6.3 Incident Response and Disaster Recovery Plans

Audit Strategy
DHS Chem Anti-Terrorism Australian Essential Eight Australian Top 35

8.8.2

1
1 14
17

2
2-3
6

4
5 9
7 11
25
3 2-5
4 21

15-16
35

2
5
17-20
31
 7
17
8.5.1 22
26
30

2
3
12
13
27

2
7 3
10

8.2.1 10-11
8.2.2 18-20
7
8.2.4 23
8.5.2 32-34
 26

8.2.3
26
8.3.4

8.2.5
7 25
8.3.2
8.4.1 28

8.7.1 24

8.5.3
8.5.4
8.6.1

8.9.1
 NSA Top 10 Canadian CSE Top 10

8
Application Whitelisting
10

2
Take Advantage of Software Improvements
8

3
Control Administrative Privileges
8
 Set a Secure Baseline Configuration 4
Take Advantage of Software Improvements 8

Set a Secure Baseline Configuration

8
Take Advantage of Software Improvements
 Use Anti-Virus File Reputation Services
8
Enable Anti-Exploitation Features

Limit Workstation-to-Workstation Communication 8

Set a Secure Baseline Configuration

Segregate Networks and Functions

1
Segregate Networks and Functions 5
9
 5
7
9

5
Segregate Networks and Functions 7
9
6
GCHQ 10 Steps UK Cyber Essentials UK ICO Protecting Data

Inappropriate locations for

processing data

Decommissioning of software
or services

Patch Management Software Updates

Configuration of SSL and TLS

Monitoring Access Control
Default Credentials
 Secure Configuration
Secure Configuration
Patch Management

Monitoring

Secure Configuration
Secure Configuration
Patch Management
Removable Media Controls
Malware Protection
Malware Protection

Decommissioning of software
Network Security or services
Unnecessary Services

Boundary firewalls and

Software Updates
Secure Configuration internet gateways
Inappropriate locations for
Network Security Secure Configuration
processing data
Patch Management

Home and Mobile Working Configuration of SSL and TLS

Boundary firewalls and
Monitoring Inappropriate locations for
internet gateways
Network Security processing data
Removable Media Controls

Managing User Privileges Inappropriate locations for

Access Control
Network Security processing data

Monitoring
Network Security

Managing User Privileges Access Control Configuration of SSL and TLS

User Education & Awareness

SQL Injection

Incident Management
PCI DSS 3.2 PCI DSS 3.1 PCI DSS 3.0

2.4 2.4 2.4

2.4 2.4 2.4

6.1 6.1 6.1

6.2 6.2 6.2
11.2 11.2 11.2

2.1 2.1 2.1

7.1 - 7.3 7.1 - 7.3 7.1 - 7.3
8.1 - 8.3 8.1 - 8.3 8.1 - 8.3
8.7 8.7 8.7
 2.2 2.2 2.2
2.3 2.3 2.3
6.2 6.2 6.2
11.5 11.5 11.5

10.1 - 10.9 10.1 - 10.8 10.1 - 10.7

2.2 2.2 2.2

2.3 2.3 2.3
6.2 6.2 6.2
11.5 11.5 11.5
5.1 - 5.4 5.1 - 5.4 5.1 - 5.4

1.4 1.4 1.4

4.3 4.3 4.3

9.5 - 9.7 9.5 - 9.7 9.5 - 9.7

1.1 - 1.2 1.1 - 1.2 1.1 - 1.2

2.2 2.2 2.2
6.2 6.2 6.2

1.1 - 1.3 1.1 - 1.3 1.1 - 1.3

8.3 8.3 8.3
10.9 10.8 10.8
11.4 11.4 11.4
 3.6 3.6 3.6
4.1 - 4.3 4.1 - 4.3 4.1 - 4.3

1.3 - 1.4 1.3 - 1.4 1.3 - 1.4

4.3 4.3 4.3
7.1 - 7.3 7.1 - 7.3 7.1 - 7.3
8.7 8.7 8.7

4.3 4.3 4.3

11.1 11.1 11.1

7.1 - 7.3 7.1 - 7.3 7.1 - 7.3

8.7 - 8.8 8.7 - 8.8 8.7 - 8.8
 12.6 12.6 12.6

6.3 6.3 6.3

6.5 - 6.7 6.5 - 6.7 6.5 - 6.7

12.10 12.10 12.10

11.3 11.3 11.3

 HIPAA

164.310(b): Workstation Use - R

164.310(c): Workstation Security - R

164.310(b): Workstation Use - R

164.310(c): Workstation Security - R

164.310(b): Workstation Use - R

164.310(c): Workstation Security - R

164.310(b): Workstation Use - R

164.310(c): Workstation Security - R
 164.310(b): Workstation Use - R
164.310(c): Workstation Security - R

164.308(a)(1): Security Management Process - Information System Activity Review R

164.308(a)(5): Security Awareness and Training - Log-in Monitoring A

164.310(b): Workstation Use - R

164.310(c): Workstation Security - R
164.308(a)(5): Security Awareness and Training - Protection from Malicious Software A
164.310(d)(1): Device and Media Controls - Accountability A
164.310(b): Workstation Use - R
164.310(c): Workstation Security - R

164.310(b): Workstation Use - R

164.310(c): Workstation Security - R

164.308(a)(7): Contingency Plan - Data Backup Plan R

164.308(a)(7): Contingency Plan - Disaster Recovery Plan R
164.308(a)(7): Contingency Plan - Testing and Revision Procedure A
164.310(d)(1): Device and Media Controls - Data Backup and Storage A
164.308(a)(4): Information Access Management - Isolating Health care Clearinghouse Function R
164.310(d)(1): Device and Media Controls - Accountability A
164.312(a)(1): Access Control - Encryption and Decryption A
164.312(e)(1): Transmission Security - Integrity Controls A
164.312(e)(1): Transmission Security - Encryption A

164.308(a)(1): Security Management Process - Information System Activity Review R

164.308(a)(4): Information Access Management - Isolating Health care Clearinghouse Function R
164.308(a)(4): Information Access Management - Access Authorization A
164.312(a)(1): Access Control - Encryption and Decryption A
164.312(c)(1): Integrity - Mechanism to Authenticate Electronic Protected Health Information A
164.312(a)(1): Access Control - Automatic Logoff A
164.312(d): Person or Entity Authentication - R
164.312(e)(1): Transmission Security - Integrity Controls A
164.312(e)(1): Transmission Security - Encryption A

164.308(a)(1): Security Management Process - Information System Activity Review R

164.308(a)(4): Information Access Management - Access Authorization A
164.308(a)(4): Information Access Management - Access Establishment and Modification A
164.308(a)(5): Security Awareness and Training - Password Management A
164.312(a)(1): Access Control - Unique User Identification R
164.312(a)(1): Access Control - Automatic Logoff A
164.312(d): Person or Entity Authentication - R
164.312(e)(1): Transmission Security - Integrity Controls A
164.312(e)(1): Transmission Security - Encryption A
 164.308(a)(5): Security Awareness and Training - Security Reminders A
164.308(a)(5): Security Awareness and Training - Protection from Malicious Software A
164.308(a)(5): Security Awareness and Training - Log-in Monitoring A
164.308(a)(5): Security Awareness and Training - Password Management A

164.308(a)(6): Security Incident Procedures - Response and Reporting R

FFIEC Information Security Booklet (2016)

II.C.5
II.C.22
II.C.12

II.C.9

II.C.21

II.C.9

II.C.6
II.C.9
II.C.16
II.C.9

II.C.7
II.C.9
II.C.13
II.C.15
II.C.19

II.C.9

II.C.7
II.C.11
II.C.17
II.C.18
II.C.19
 FFIEC Examiners Handbook

Host Security
User Equipment Security (Workstation, Laptop, Handheld)

Host Security
User Equipment Security (Workstation, Laptop, Handheld)

Host Security
User Equipment Security (Workstation, Laptop, Handheld)

Authentication and Access Controls

 Host Security
User Equipment Security (Workstation, Laptop, Handheld)

Security Monitoring

Host Security
User Equipment Security (Workstation, Laptop, Handheld)
 Host Security
User Equipment Security (Workstation, Laptop, Handheld)

Network Security

Encryption

Network Security

Network Security
Security Monitoring
 Encryption
Data Security

Authentication and Access Controls

Encryption
Data Security

Network Security
Encryption
Security Monitoring

Authentication and Access Controls

 Personnel Security

Application Security
Software Development & Acquisition
FFIEC Cybersecurity Assessment Tool (CAT) COBIT 5

APO13: Manage Security

Domain 3: Cybersecurity Controls - Preventative Controls
DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Detective Controls
BAI09: Manage Assets

Domain 3: Cybersecurity Controls - Preventative Controls APO13: Manage Security

Domain 3: Cybersecurity Controls - Detective Controls DSS05: Manage Security Services

Domain 3: Cybersecurity Controls - Preventative Controls APO13: Manage Security

Domain 3: Cybersecurity Controls - Detective Controls DSS05: Manage Security Services

Domain 3: Cybersecurity Controls - Preventative Controls APO13: Manage Security

Domain 3: Cybersecurity Controls - Detective Controls DSS05: Manage Security Services
 APO13: Manage Security
Domain 3: Cybersecurity Controls - Preventative Controls
DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Detective Controls
BAI10: Manage Configuration

Domain 2: Threat Intelligence & Collaboration - Monitoring

APO13: Manage Security
and Analyzing
DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Detective Controls

APO13: Manage Security

Domain 3: Cybersecurity Controls - Preventative Controls
DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Detective Controls
BAI10: Manage Configuration
Domain 2: Threat Intelligence & Collaboration - Monitoring
and Analyzing APO13: Manage Security
Domain 3: Cybersecurity Controls - Preventative Controls DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Detective Controls

Domain 3: Cybersecurity Controls - Preventative Controls APO13: Manage Security

Domain 3: Cybersecurity Controls - Detective Controls DSS05: Manage Security Services

APO13: Manage Security

Domain 3: Cybersecurity Controls - Preventative Controls
DSS05: Manage Security Services

APO13: Manage Security

Domain 3: Cybersecurity Controls - Preventative Controls
DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Detective Controls
BAI10: Manage Configuration

Domain 2: Threat Intelligence & Collaboration - Monitoring

and Analyzing APO13: Manage Security
Domain 3: Cybersecurity Controls - Preventative Controls DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Detective Controls
Domain 3: Cybersecurity Controls - Preventative Controls APO13: Manage Security
Domain 3: Cybersecurity Controls - Detective Controls DSS05: Manage Security Services

Domain 3: Cybersecurity Controls - Preventative Controls APO13: Manage Security

Domain 3: Cybersecurity Controls - Detective Controls DSS05: Manage Security Services

Domain 3: Cybersecurity Controls - Preventative Controls APO13: Manage Security

Domain 3: Cybersecurity Controls - Detective Controls DSS05: Manage Security Services

Domain 3: Cybersecurity Controls - Preventative Controls APO13: Manage Security

Domain 3: Cybersecurity Controls - Detective Controls DSS05: Manage Security Services
Domain 1: Cyber Risk Management & Oversight - Training and
APO13: Manage Security
Culture
DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Preventative Controls

APO13: Manage Security

Domain 3: Cybersecurity Controls - Preventative Controls
DSS05: Manage Security Services

Domain 5: Cyber Incident Management and Resilience -

Incident Resilience Planning and Strategy APO13: Manage Security
Domain 5: Cyber Incident Management and Resilience - DSS05: Manage Security Services
Detection, Response, and Mitigation DSS02: Manage Service Requests
Domain 5: Cyber Incident Management and Resilience - and Incidents
Escalation and Reporting

APO13: Manage Security

DSS05: Manage Security Services
Domain 3: Cybersecurity Controls - Detective Controls MEA02: Monitor, Evaluate and
Assess the System of Internal
Control
AICPA SOC2/3 TSC 2017 AICPA SOC 2/3 TSPC AICPA's GAPP

7.2.2
CC 6.1 8.2.1
8.2.2

CC 6.1 7.2.2
CC 6.8 8.2.1

7.2.2
CC 7.1 CC 6.1
8.2.1

7.2.2
CC 6.1 - CC 6.3
CC 5.1 - CC 5.6 8.2.1
CC 6.6 - CC 6.7
8.2.2
 7.2.2
CC 7.1
8.2.1

7.2.2
8.2.1

7.2.2
8.2.1
 7.2.2
CC 6.8 CC 5.8
8.2.1

7.2.2
8.2.1

7.2.2
A 1.2
8.2.1

7.2.2
8.2.1

7.2.2
CC 6.1 8.2.1
8.2.2
 7.2.2
8.2.1
CC 6.1
8.2.2
8.2.6

7.2.2
CC 6.1 - CC 6.3 CC 5.7 8.2.1
CC 6.6 - CC 6.7 C 1.2 - C 1.3 8.2.2
8.2.6

7.2.2
8.2.1
8.2.2

CC 6.1 - CC 6.3 7.2.2

CC 5.1 - CC 5.6
CC 6.6 - CC 6.7 8.2.1
 1.2.9
1.2.10
CC 2.1 - CC 2.6
7.2.2
8.2.1

7.2.2
8.2.1

CC 7.4 7.2.2
CC 6.2
CC 7.5 8.2.1

7.2.2
8.2.1
8.2.7
IRS Pub1075 SWIFT SG MAS TRM

6 - Acquisition and Development

9.4.12
of Information Systems

6 - Acquisition and Development

9.4.12 1.1-opt
of Information Systems

2.2 9 - Operational Infrastructure

9.3.4
2.7a Security Management

1.2
9.3.7 11 - Access Controls
2.6a
 9 - Operational Infrastructure
9.3.5 2.3
Security Management

9 - Operational Infrastructure
9.3.3 6.4
Security Management

9.3.17
9.4.3
9.4.16
9.4.17
 9 - Operational Infrastructure
9.3.17 6.1
Security Management

8 - Systems Reliability,
9.3.6
Availability, and Recoverability

9.3.5
9.3.7
9.4.10

9.3.16 1.1 9 - Operational Infrastructure

9.4.10 6.5a Security Management
9.3.10
9 - Operational Infrastructure
9.4.10
Security Management

4.0
1.1
5.0 9 - Operational Infrastructure
2.1
6.1 Security Management
2.4a
9.3.1 11 - Access Controls
2.5a
9.3.16 12 - Online Financial Services
5.1
9.4.10

9 - Operational Infrastructure
9.4.18
Security Management

4.1
9.3.7
4.2 11 - Access Controls
9.3.13
5.2 12 - Online Financial Services
5.4a
 6.1
7.2
9.3.2

6 - Acquisition and Development

6.2
of Information Systems
6.3
7 - IT Service Management

7.1
9.3.8 7 - IT Service Management
7.4a

9 - Operational Infrastructure
9.3.3 7.3a
Security Management
Saudi AMA NERC CIP v7 NERC CIP v6

CIP-002-5.1 R1 CIP-002-5.1 R1
3.3.3
CIP-002-5.1 R2 CIP-002-5.1 R2

3.3.3 CIP-010-3 R1 CIP-010-2 R1

CIP-007-6 R2 CIP-007-6 R2
3.3.17
CIP-010-3 R3 CIP-010-2 R3

CIP-004-6 R4 CIP-004-6 R4
3.3.5 CIP-004-6 R5 CIP-004-6 R5
CIP-007-6 R5 CIP-007-6 R5
 CIP-007-6 R2 CIP-007-6 R2
3.3.6
CIP-010-3 R2 CIP-010-2 R2

3.3.14 CIP-007-6 R4 CIP-007-6 R4

3.3.6 CIP-007-6 R2 CIP-007-6 R2

3.3.8 CIP-010-3 R2 CIP-010-2 R2
 3.3.8
CIP-007-6 R3 CIP-007-6 R3
3.3.16

CIP-007-6 R1 CIP-007-6 R1
CIP-010-3 R2 CIP-010-2 R2

3.3.6
CIP-009-6 R1 CIP-009-6 R1
3.3.8

CIP-005-5 R1 CIP-005-5 R1
3.3.8 CIP-007-6 R2 CIP-007-6 R2
CIP-010-3 R1 CIP-010-2 R1

CIP-005-5 R1 CIP-005-5 R1
3.3.10 CIP-005-5 R2 CIP-005-5 R2
CIP-007-6 R4 CIP-007-6 R4
3.3.8 CIP-011-2 R1 CIP-011-2 R1

CIP-005-5 R1 CIP-005-5 R1
CIP-005-5 R2 CIP-005-5 R2
3.3.5
CIP-007-6 R4 CIP-007-6 R4
CIP-011-2 R1 CIP-011-2 R1

CIP-007-6 R4 CIP-007-6 R4

CIP-005-5 R1 CIP-005-5 R1
3.3.5 CIP-005-5 R2 CIP-005-5 R2
CIP-007-6 R4 CIP-007-6 R4
3.1.6 CIP-004-6 R1 CIP-004-6 R1
3.1.7 CIP-004-6 R2 CIP-004-6 R2

3.3.6

CIP-008-5 R1 CIP-008-5 R1
3.3.15 CIP-008-5 R2 CIP-008-5 R2
CIP-008-5 R3 CIP-008-5 R3

3.2.4
3.2.5
NERC CIP v5 NERC CIP v4 NERC CIP v3

CIP-002-3 R1
CIP-002-4 R1
CIP-002-3 R2
CIP-002-4 R2
CIP-002-3 R3
CIP-002-4 R3
CIP-002-5.1 R1 CIP-002-3 R4
CIP-003-4 R5
CIP-002-5.1 R2 CIP-003-3 R5
CIP-004-4 R4
CIP-004-3 R4
CIP-005-4 R2
CIP-005-3 R2
CIP-006-4 R3
CIP-006-3 R3

CIP-010-1 R1

CIP-005-4 R4 CIP-005-3 R4
CIP-007-5 R2
CIP-007-4 R3 CIP-007-3 R3
CIP-010-1 R3
CIP-007-4 R8 CIP-007-3 R8

CIP-003-4 R5 CIP-003-3 R5
CIP-004-4 R4 CIP-004-3 R4
CIP-004-5 R4
CIP-005-4 R2 CIP-005-3 R2
CIP-004-5 R5
CIP-005-4 R3 CIP-005-3 R3
CIP-007-5 R5
CIP-006-4 R3 CIP-006-3 R3
CIP-007-4 R3 CIP-007-3 R3
CIP-007-5 R2 CIP-003-4 R6 CIP-003-3 R6
CIP-010-1 R2 CIP-007-4 R3 CIP-007-3 R3

CIP-005-4 R3 CIP-005-3 R3
CIP-007-5 R4
CIP-007-4 R6 CIP-007-3 R6

CIP-007-5 R2 CIP-003-4 R6 CIP-003-3 R6

CIP-010-1 R2 CIP-007-4 R3 CIP-007-3 R3
CIP-007-5 R3 CIP-007-4 R4 CIP-007-3 R4

CIP-007-5 R1
CIP-007-4 R2 CIP-007-3 R2
CIP-010-1 R2

CIP-009-4 R4 CIP-009-3 R4
CIP-009 -5 R1
CIP-009-4 R5 CIP-009-3 R5

CIP-003-4 R6 CIP-003-3 R6
CIP-005-5 R1 CIP-004-4 R4 CIP-004-3 R4
CIP-007-5 R2 CIP-005-4 R2 CIP-005-3 R2
CIP-010-1 R1 CIP-006-4 R3 CIP-006-3 R3
CIP-007-4 R3 CIP-007-3 R3

CIP-005-5 R1
CIP-005-4 R3 CIP-005-3 R3
CIP-005-5 R2
CIP-007-4 R6 CIP-007-3 R6
CIP-007-5 R4
CIP-011-1 R1

CIP-005-5 R1 CIP-003-4 R5 CIP-003-3 R5

CIP-005-5 R2 CIP-004-4 R4 CIP-004-3 R4
CIP-007-5 R4 CIP-005-4 R2 CIP-005-3 R2
CIP-011-1 R1 CIP-006-4 R3 CIP-006-3 R3

CIP-005-4 R3 CIP-005-3 R3
CIP-007-5 R4
CIP-007-4 R6 CIP-007-3 R6

CIP-005-5 R1 CIP-005-4 R3 CIP-005-3 R3

CIP-005-5 R2 CIP-007-4 R5 CIP-007-3 R5
CIP-007-5 R4 CIP-007-4 R6 CIP-007-3 R6
CIP-004-5 R1 CIP-004-4 R1 CIP-004-3 R1
CIP-004-5 R2 CIP-004-4 R2 CIP-004-3 R2

CIP-008-5 R1
CIP-008-4 R1 CIP-008-3 R1
CIP-008-5 R2
CIP-008-4 R2 CIP-008-3 R2
CIP-008-5 R3
Cloud Security Alliance SEC OCIE for AWS FY15 FISMA Metrics

DCS-01
1: System Inventory
MOS-09
2: Continuous Monitoring
MOS-15

CCC-04
MOS-3 1: System Inventory
MOS-04 2: Continuous Monitoring
MOS-15

IVS-05
MOS-15
2: Continuous Monitoring
MOS-19
TVM-02

IAM-09 - IAM-13
3: Identity Credential and
MOS-16
Access Management
MOS-20
 IVS-07
MOS-15 Asset Configuration and
2: Continuous Monitoring
MOS-19 Management
TVM-02

IVS-01 Security Logging and

IVS-03 Monitoring

IVS-07
MOS-15
2: Continuous Monitoring
MOS-19
TVM-02
MOS-01
MOS-15 4: Anti Phishing and Malware
TVM-01 Defense
TVM-03

DSI-02
IVS-06
IPY-04

MOS-11 Disaster Recovery

DSI-02
IAM-03
IVS-06 Network Configuration and 3: Identity Credential and
IVS-09 Management Access Management
MOS-19
TVM-02

DSI-02
3: Identity Credential and
IVS-01
Network Configuration and Access Management
IVS-06
Management 6: Network Defense
IVS-09
7: Boundary Protection
MOS-16
 DSI-02
DSI-05
Data Encryption 5: Data Protection
EKM-01 - EKM-04
MOS-11

DSI-02
IVS-09 Logical Access Control
MOS-11

IVS-01
IVS-06
IVS-12
MOS-11

IAM-02
IAM-09 - IAM-12
3: Identity Credential and
MOS-14
Access Management
MOS-16
MOS-20
 HRS-10
8: Training and Education
MOS-05

AIS-01
AIS-03
AIS-04
CCC-01 - CCC-03
IVS-08

SEF-01 - SEF-05 Security Incident Response 9: Incident Response

 ITIL 2011 KPIs NV Gaming MICS v7 2015 MA - CoM 201 CMR 17.00

Information Security
Management

Information Security
VI-02
Management

Information Security
VI-01
Management

Information Security
Management
Information Security
Management

Information Security
System Parameters VI-04
Management

Information Security
Management
Information Security
VI-02
Management

Information Security
Network Security and Data Protection
Management

Information Security
Backups
Management

Information Security
Network Security and Data Protection
Management

VI-01
Information Security Network Security and Data Protection
VI-04
Management Remote Access
VI-05
Information Security V-19
Network Security and Data Protection
Management VI-03

V-04
Information Security V-05
Network Security and Data Protection
Management V-06
VI-03

Information Security
Network Security and Data Protection
Management

V-05
V-06
System Parameters V-08
Information Security User Accounts V-09
Management Generic User Accounts V-10
Service & Default Accounts V-11
V-17
VI-05
 IV-b
Information Security
IV-f
Management
V-02

Information Security In-House Software Development

Management Purchased Software Programs

Information Security
Management V-13
Incident Management

Information Security
Management
NY - NYCRR 500 Victorian PDSF v1.0 ANSSI - 40 Measures

1
34

16
17
18
20
23

2
Section 500.05 8-13
28-30

26
Section 500.12 Standard 4
27
 6
16
17

Section 500.06
 36

Section 500.12 8-13

4
5
Section 500.11
24
Section 500.12
25
31
 15
Section 500.15 Standard 4
19

Section 500.07
Section 500.13 Standard 4 21
Section 500.15

22

Section 500.06
Section 500.07 Standard 4 8-13
Section 500.12
Section 500.10
Standard 6 39
Section 500.14

Section 500.08

Standard 7 37
Section 500.16
Standard 8 38

Section 500.05
 CIS Controls

CIS Controls v7.1 mapped to NIST 800-53 (rev4)

ID # NIST Control Name

Access Control
AC-1 Access Control Policy and Procedures
AC-2 Account Management
AC-3 Access Enforcement
AC-4 Information Flow Enforcement
AC-5 Separation of Duties
AC-6 Least Privilege
AC-7 Unsuccessful Logon Attempts
AC-8 System Use Notification
AC-9 Previous Logon (Access) Notification
AC-10 Concurrent Session Control
AC-11 Session Lock
AC-12 Session Termination
AC-13 Withdrawn
AC-14 Permitted Actions without Identification or Authentication
AC-15 Withdrawn
AC-16 Security Attributes
AC-17 Remote Access
AC-18 Wireless Access
AC-19 Access Control for Mobile Devices
AC-20 Use of External Information Systems
AC-21 Information Sharing
AC-22 Publicly Accessible Content
AC-23 Data Mining Protection
AC-24 Access Control Decisions
AC-25 Reference Monitor
Awareness and Training
AT-1 Security Awareness and Training Policy and Procedures
AT-2 Security Awareness Training
AT-3 Role-Based Security Training
AT-4 Security Training Records
AT-5 Withdrawn
Audit & Accountability
AU-1 Audit and Accountability Policy and Procedures
AU-2 Audit Events
AU-3 Content of Audit Records
AU-4 Audit Storage Capacity
AU-5 Response to Audit Processing Failures
AU-6 Audit Review, Analysis, and Reporting
AU-7 Audit Reduction and Report Generation
AU-8 Time Stamps
AU-9 Protection of Audit Information
AU-10 Non-repudiation
AU-11 Audit Record Retention
AU-12 Audit Generation
AU-13 Monitoring for Information Disclosure
AU-14 Session Audit
AU-15 Alternate Audit Capability
AU-16 Cross-Organizational Auditing
Security Assessment and Authorization
CA-1 Security Assessment and Authorization Policies and Procedures
CA-2 Security Assessments
CA-3 System Interconnections
CA-4 Withdrawn
CA-5 Plan of Action and Milestones
CA-6 Security Authorization
CA-7 Continuous Monitoring
CA-8 Penetration Testing
CA-9 Internal System Connections
Configuration Management
CM-1 Configuration Management Policy and Procedures
CM-2 Baseline Configuration
CM-3 Configuration Change Control
CM-4 Security Impact Analysis
CM-5 Access Restrictions for Change
CM-6 Configuration Settings
CM-7 Least Functionality
CM-8 Information System Component Inventory
CM-9 Configuration Management Plan
CM-10 Software Usage Restrictions
CM-11 User-Installed Software
Contingency Planning
CP-1 Contingency Planning Policy and Procedures
CP-2 Contingency Plan
CP-3 Contingency Training
CP-4 Contingency Plan Testing
CP-5 Withdrawn
CP-6 Alternate Storage Site
CP-7 Alternate Processing Site
CP-8 Telecommunications Services
CP-9 Information System Backup
CP-10 Information System Recovery and Reconstitution
CP-11 Alternate Communications Protocols
CP-12 Safe Mode
CP-13 Alternative Security Mechanisms
Identification and Authentication
IA-1 Identification and Authentication Policy and Procedures
IA-2 Identification and Authentication (Organizational Users)
IA-3 Device Identification and Authentication
IA-4 Identifier Management
IA-5 Authenticator Management
IA-6 Authenticator Feedback
IA-7 Cryptographic Module Authentication
IA-8 Identification and Authentication (Non- Organizational Users)
IA-9 Service Identification and Authentication
IA-10 Adaptive Identification and Authentication
IA-11 Re-authentication
Incident Response
IR-1 Incident Response Policy and Procedures
IR-2 Incident Response Training
IR-3 Incident Response Testing
IR-4 Incident Handling
IR-5 Incident Monitoring
IR-6 Incident Reporting
IR-7 Incident Response Assistance
IR-8 Incident Response Plan
IR-9 Information Spillage Response
IR-10 Integrated Information Security Analysis Team
Maintenance
MA-1 System Maintenance Policy and Procedures
MA-2 Controlled Maintenance
MA-3 Maintenance Tools
MA-4 Nonlocal Maintenance
MA-5 Maintenance Personnel
MA-6 Timely Maintenance
Media Protection
MP-1 Media Protection Policy and Procedures
MP-2 Media Access
MP-3 Media Marking
MP-4 Media Storage
MP-5 Media Transport
MP-6 Media Sanitization
MP-7 Media Use
MP-8 Media Downgrading
Physical and Environmental Protection
PE-1 Physical and Environmental Protection Policy and Procedures
PE-2 Physical Access Authorizations
PE-3 Physical Access Control
PE-4 Access Control for Transmission Medium
PE-5 Access Control for Output Devices
PE-6 Monitoring Physical Access
PE-7 Withdrawn
PE-8 Visitor Access Records
PE-9 Power Equipment and Cabling
PE-10 Emergency Shutoff
PE-11 Emergency Power
PE-12 Emergency Lighting
PE-13 Fire Protection
PE-14 Temperature and Humidity Controls
PE-15 Water Damage Protection
PE-16 Delivery and Removal
PE-17 Alternate Work Site
PE-18 Location of Information System Components
PE-19 Information Leakage
PE-20 Asset Monitoring and Tracking
Planning
PL-1 Security Planning Policy and Procedures
PL-2 System Security Plan
PL-3 Withdrawn
PL-4 Rules of Behavior
PL-5 Withdrawn
PL-6 Withdrawn
PL-7 Security Concept of Operations
PL-8 Information Security Architecture
PL-9 Central Management
Personnel Security
PS-1 Personnel Security Policy and Procedures
PS-2 Position Risk Designation
PS-3 Personnel Screening
PS-4 Personnel Termination
PS-5 Personnel Transfer
PS-6 Access Agreements
PS-7 Third-Party Personnel Security
PS-8 Personnel Sanctions
 Risk Assessment
RA-1 Risk Assessment Policy and Procedures
RA-2 Security Categorization
RA-3 Risk Assessment
RA-4 Withdrawn
RA-5 Vulnerability Scanning
RA-6 Technical Surveillance Countermeasures Survey
System and Services Acquisition
SA-1 System and Services Acquisition Policy and Procedures
SA-2 Allocation of Resources
SA-3 System Development Life Cycle
SA-4 Acquisition Process
SA-5 Information System Documentation
SA-6 Withdrawn
SA-7 Withdrawn
SA-8 Security Engineering Principles
SA-9 External Information System Services
SA-10 Developer Configuration Management
SA-11 Developer Security Testing and Evaluation
SA-12 Supply Chain Protection
SA-13 Trustworthiness
SA-14 Criticality Analysis
SA-15 Development Process, Standards, and Tools
SA-16 Developer-Provided Training
SA-17 Developer Security Architecture and Design
SA-18 Tamper Resistance and Detection
SA-19 Component Authenticity
SA-20 Customized Development of Critical Components
SA-21 Developer Screening
SA-22 Unsupported System Components
System and Communications Protection
SC-1 System and Communications Protection Policy and Procedures
SC-2 Application Partitioning
SC-3 Security Function Isolation
SC-4 Information in Shared Resources
SC-5 Denial of Service Protection
SC-6 Resource Availability
SC-7 Boundary Protection
SC-8 Transmission Confidentiality and Integrity
SC-9 Withdrawn
SC-10 Network Disconnect
SC-11 Trusted Path
SC-12 Cryptographic Key Establishment and Management
SC-13 Cryptographic Protection
SC-14 Withdrawn
SC-15 Collaborative Computing Devices
SC-16 Transmission of Security Attributes
SC-17 Public Key Infrastructure Certificates
SC-18 Mobile Code
SC-19 Voice Over Internet Protocol
SC-20 Secure Name /Address Resolution Service (Authoritative Source)
SC-21 Secure Name /Address Resolution Service (Recursive or Caching Resolver)
SC-22 Architecture and Provisioning for Name/Address Resolution Service
SC-23 Session Authenticity
SC-24 Fail in Known State
SC-25 Thin Nodes
SC-26 Honeypots
SC-27 Platform-Independent Applications
SC-28 Protection of Information at Rest
SC-29 Heterogeneity
SC-30 Concealment and Misdirection
SC-31 Covert Channel Analysis
SC-32 Information System Partitioning
SC-33 Withdrawn
SC-34 Non-Modifiable Executable Programs
SC-35 Honeyclients
SC-36 Distributed Processing and Storage
SC-37 Out-of-Band Channels
SC-38 Operations Security
SC-39 Process Isolation
SC-40 Wireless Link Protection
SC-41 Port and I/O Device Access
SC-42 Sensor Capability and Data
SC-43 Usage Restrictions
SC-44 Detonation Chambers
System and Information Integrity
SI-1 System and Information Integrity Policy and Procedures
SI-2 Flaw Remediation
SI-3 Malicious Code Protection
SI-4 Information System Monitoring
SI-5 Security Alerts, Advisories, and Directives
SI-6 Security Function Verification
SI-7 Software, Firmware, and Information Integrity
SI-8 Spam Protection
SI-9 Withdrawn
SI-10 Information Input Validation
SI-11 Error Handling
SI-12 Information Handling and Retention
SI-13 Predictable Failure Prevention
SI-14 Non-Persistence
SI-15 Information Output Filtering
SI-16 Memory Protection
SI-17 Fail-Safe Procedures
Program Management
PM-1 Information Security Program Plan
PM-2 Senior Information Security Officer
PM-3 Information Security Resources
PM-4 Plan of Action and Milestones Process
PM-5 Information System Inventory
PM-6 Information Security Measures of Performance
PM-7 Enterprise Architecture
PM-8 Critical Infrastructure Plan
PM-9 Risk Management Strategy
PM-10 Security Authorization Process
PM-11 Mission/Business Process Definition
PM-12 Isider Threat Program
PM-13 Information Security Workforce
PM-14 Testing, Training, & Monitoring
PM-15 Contacts with Security Groups and Associations
PM-16 Threat Awareness Program
 CIS Controls Master Mappings Tool (v7.1c)

Inventory of Authorized Continuous

Inventory of Authorized Vulnerability
v4) & Unauthorized Devices and Unauthorized Assessment and
Software Remediation

Priority CSC #1 CSC #2 CSC #3

P1
P1
P1
P1
P1
P1
P2
P1
P0
P2
P3
P2
---
P1
---
P0
P1
P1
P1
P1
P2
P2
P0
P0
P0

P1
P1
P1
P3
---

P1
P1
P1
P1
P1
P1
P2
P1
P1
P1
P3
P1
P0
P0
P0
P0

P1
P2 X
P1
---
P3
P3
P3 X X X
P1
P2

P1
P1 X
P1
P2
P1
P1
P1
P1 X X
P1
P2 X
P1 X

P1
P1
P2
P2
---
P1
P1
P1
P1
P1
P0
P0
P0

P1
P1
P1 X
P1
P1
P1
P1
P1
P0
P0
P0

P1
P2
P2
P1
P1
P1
P3
P1
P0
P0

P1
P2
P2
P1
P1
P2

P1
P1
P2
P1
P1
P1
P1
P0

P1
P1
P1
P1
P2
P1
---
P3
P1
P1
P1
P1
P1
P1
P1
P2
P2
P3
P0
P0

P1
P1
---
P2
---
---
P0
P1
P0

P1
P1
P1
P1
P2
P3
P1
P3
P1
P1
P1
---
P1 X
P0

P1
P1
P1
P1 X X
P2
---
---
P1
P1
P1
P1
P1
P0
P0
P2
P2
P1
P0
P0
P0
P0
P0

P1
P1
P1
P1
P1
P0
P1
P1
---
P2
P0
P1
P1
---
P1
P0
P1 X
P2 X
P1
P1
P1
P1
P1
P1
P0
P0
P0
P1
P0
P0
P0
P0
---
P0 X X
P0
P0
P0
P0
P1
P0
P0
P0
P0
P0

P1
P1
P1
P1 X X X
P1
P1
P1 X
P2
---
P1
P2
P2
P0
P0
P0
P1
P0

P1
P1
P1
P1
P1 X X
P1
P1
P1
P1
P1
P1
P1
P1
P1
P1
P1
 Secure Configurations
Controlled Use of for Hardware and Maintenance,
Software on Mobile
Administrative Devices, Laptops, Monitoring, and
Privileges Workstations, and Analysis of Audit Logs
Servers
CSC #4 CSC #5 CSC #6

X
 X
X
X
X
X
X
X
X
X
X
X
X
X

X X X

X
X

X
X
X
X
X

X
X

X
X

X
X

X
 X

X X X
 Limitation and Control
Email and Web Browser
Protections Malware Defenses of Network Ports,
Protocols, and Services

CSC #7 CSC #8 CSC #9

X
X X

X X
X

X
X X
X
X X
X

X
 X
X

X
X
X

X
X

X
X
X

X X
 Secure Configuration
Data Recovery for Network Devices,
Capabilities such as Firewalls, Boundary Defense
Routers and Switches

CSC #10 CSC #11 CSC #12

X X

X
X X

X X

X X

X X
X

X
X

X
X
X

X
X
X

X
X
X

X X
 Controlled Access
Data Protection Based on the Need to Wireless Device Control
Know

CSC #13 CSC #14 CSC #15

X
X
X X
X

X
X

X
X
 X

X X X

X
 X

X
X
 X

X X
 X
X

X
X

X X X
 Implement a Security
Account Monitoring Application Software
and Control Awareness and Training Security
Program

CSC #16 CSC #17 CSC #18

X
X

X
X

X
X
X
X
X
X

X
 X

X
X X

X
X X
X

X
X
X

X
X
 X
X

X
X

X
Incident Response and Penetration Tests and
Management Red Team Exercises

CSC #19 CSC #20

X

X
X

X
X
X
X
X
X
X
X
X

X
X
X
X

X
 CIS Controls v7.1 mapped to the NIST Cyber Security Framework (v1.1)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to the NIST Cyber Security Framework (v1.1)

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Physical devices and Software platforms and

Organizational
systems within the applications within the
communication and data
organization are organization are
flows are mapped
inventoried inventoried

ID.AM-1 ID.AM-2 ID.AM-3

X X
X X
X X

X X

X X

X X

X X

X X

X
X
X
X
X

X
X
s, Routers and Switches
 Resources (e.g., hardware,
Cybersecurity roles and
devices, data, time,
responsibilities for the
personnel, and software)
External information entire workforce and third-
are prioritized based on
systems are catalogued party stakeholders (e.g.,
their classification,
suppliers, customers,
criticality, and business
partners) are established
value

ID.AM-4 ID.AM-5 ID.AM-6

X
X
X

X
The organization’s role in The organization’s place in Priorities for organizational
the supply chain is critical infrastructure and its mission, objectives, and
identified and industry sector is identified activities are established
communicated and communicated and communicated

ID.BE-1 ID.BE-2 ID.BE-3

 Resilience requirements to
support delivery of critical
Dependencies and critical Organizational
services are established for
functions for delivery of cybersecurity policy is
all operating states (e.g.
critical services are established and
under duress/attack, during
established communicated
recovery, normal
operations)

ID.BE-4 ID.BE-5 ID.GV-1

 Legal and regulatory
Cybersecurity roles and
requirements regarding
responsibilities are Governance and risk
cybersecurity, including
coordinated and aligned management processes
privacy and civil liberties
with internal roles and address cybersecurity risks
obligations, are understood
external partners
and managed

ID.GV-2 ID.GV-3 ID.GV-4

 Cyber threat intelligence is Threats, both internal and
Asset vulnerabilities are
received from information external, are identified and
identified and documented
sharing forums and sources documented

ID.RA-1 ID.RA-2 ID.RA-3

X X

X X

X X

X X
X X
X X
X X
Potential business impacts Threats, vulnerabilities,
Risk responses are
and likelihoods are likelihoods, and impacts are
identified and prioritized
identified used to determine risk

ID.RA-4 ID.RA-5 ID.RA-6

 The organization’s
Risk management processes determination of risk
Organizational risk
are established, managed, tolerance is informed by its
tolerance is determined and
and agreed to by role in critical infrastructure
clearly expressed
organizational stakeholders and sector specific risk
analysis

ID.RM-1 ID.RM-2 ID.RM-3

 Contracts with suppliers
and third-party partners are
Suppliers and third party
Cyber supply chain risk used to implement
partners of information
management processes are appropriate measures
systems, components, and
identified, established, designed to meet the
services are identified,
assessed, managed, and objectives of an
prioritized, and assessed
agreed to by organizational organization’s cybersecurity
using a cyber supply chain
stakeholders program and Cyber Supply
risk assessment process
Chain Risk Management
Plan.
ID.SC-1 ID.SC-2 ID.SC-3
 Suppliers and third-party
Identities and credentials
partners are routinely
Response and recovery are issued, managed,
assessed using audits, test
planning and testing are verified, revoked, and
results, or other forms of
conducted with suppliers audited for authorized
evaluations to confirm they
and third-party providers devices, users and
are meeting their
processes
contractual obligations.

ID.SC-4 ID-SC-5 PR.AC-1

X
X
X
X
X
X

X
X
X
X
X
X
 Access permissions and
authorizations are
Physical access to assets is
Remote access is managed managed, incorporating the
managed and protected
principles of least privilege
and separation of duties

PR.AC-2 PR.AC-3 PR.AC-4

X
X

X
X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
 Users, devices, and other
assets are authenticated
Network integrity is (e.g., single-factor, multi-
Identities are proofed and
protected (e.g., network factor) commensurate with
bound to credentials and
segregation, network the risk of the transaction
asserted in interactions
segmentation) (e.g., individuals’ security
and privacy risks and other
organizational risks)
PR.AC-5 PR.AC-6 PR.AC-7
X
X
X
X
X

X
X
X

X
X

X
X

X
X
X
X

X
X

X
X

X
X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Third-party stakeholders
Privileged users understand
All users are informed and (e.g., suppliers, customers,
their roles and
trained partners) understand their
responsibilities
roles and responsibilities

PR.AT-1 PR.AT-2 PR.AT-3

X
X

X
X
X

X
X
X
X X X
X X X

X X X

X X X

X X X
X X X
X X X

X X X

X X X
 Senior executives Physical and cybersecurity
understand their roles and personnel understand their Data-at-rest is protected
responsibilities roles and responsibilities

PR.AT-4 PR.AT-5 PR.DS-1

X

X
X

X
X
X X
X X

X X

X X

X X
X X
X X

X X

X X
 Assets are formally
Adequate capacity to
managed throughout
Data-in-transit is protected ensure availability is
removal, transfers, and
maintained
disposition

PR.DS-2 PR.DS-3 PR.DS-4

X
X
X

X
X
X

X
X
X
X

X
X

X
X

X
X
 Integrity checking The development and
Protections against data mechanisms are used to testing environment(s) are
leaks are implemented verify software, firmware, separate from the
and information integrity production environment

PR.DS-5 PR.DS-6 PR.DS-7

X
X
X
X
X

X
X
X
X

X
X
X
X

X
X
X
X

X
X
X
X
X
X

X
 A baseline configuration of
information
technology/industrial
Integrity checking A System Development Life
control systems is created
mechanisms are used to Cycle to manage systems is
and maintained
verify hardware integrity implemented
incorporating security
principles (e.g. concept of
least functionality)
PR.DS-8 PR.IP-1 PR.IP-2
X

X
X

X
X

X
X
X

X
X
X

X
X
 Policy and regulations
Configuration change Backups of information are regarding the physical
control processes are in conducted, maintained, and operating environment for
place tested organizational assets are
met

PR.IP-3 PR.IP-4 PR.IP-5

X
X
X

X
Data is destroyed according Protection processes are Effectiveness of protection
to policy improved technologies is shared

PR.IP-6 PR.IP-7 PR.IP-8

 Response plans (Incident
Response and Business Cybersecurity is included in
Continuity) and recovery Response and recovery human resources practices
plans (Incident Recovery plans are tested (e.g., deprovisioning,
and Disaster Recovery) are personnel screening)
in place and managed

PR.IP-9 PR.IP-10 PR.IP-11

X

X
 Remote maintenance of
Maintenance and repair of
A vulnerability organizational assets is
organizational assets are
management plan is approved, logged, and
performed and logged, with
developed and performed in a manner that
approved and controlled
implemented prevents unauthorized
tools
access

PR.IP-12 PR.MA-1 PR.MA-2

X

X
X
X
X

X
X

X
X
X

X
X
X
X

X
 The principle of least
Audit/log records are Removable media is
functionality is
determined, documented, protected and its use
incorporated by configuring
implemented, and reviewed restricted according to
systems to provide only
in accordance with policy policy
essential capabilities

PR.PT-1 PR.PT-2 PR.PT-3

X
X

X
X
 X

X
X
X

X
X
X
X
X
X
X
X
X

X
X
X
X
X
X
X

X
X
X
X

X
X

X X

X X

X X
X X

X X

X X

X X

X X
X X

X
X
X
X
X
X

X
X
X
X
X
X
 Mechanisms (e.g., failsafe,
A baseline of network
load balancing, hot swap)
Communications and operations and expected
are implemented to achieve
control networks are data flows for users and
resilience requirements in
protected systems is established and
normal and adverse
managed
situations

PR.PT-4 PR.PT-5 DE.AE-1

 X
X
X
X
X

X
X
X

X
X

X
 Event data are collected
Detected events are
and correlated from Impact of events is
analyzed to understand
multiple sources and determined
attack targets and methods
sensors

DE.AE-2 DE.AE-3 DE.AE-4

X
X
X
X
X
X
X
X
X X

X X

X X

X X

X X

X X

X X

X X
 The physical environment is
The network is monitored
Incident alert thresholds monitored to detect
to detect potential
are established potential cybersecurity
cybersecurity events
events

DE.AE-5 DE.CM-1 DE.CM-2

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
 Personnel activity is
monitored to detect Unauthorized mobile code
Malicious code is detected
potential cybersecurity is detected
events

DE.CM-3 DE.CM-4 DE.CM-5

X X

X X

X X

X X
X X
X X
X X
X X
X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
External service provider Monitoring for
activity is monitored to unauthorized personnel, Vulnerability scans are
detect potential connections, devices, and performed
cybersecurity events software is performed

DE.CM-6 DE.CM-7 DE.CM-8

X

X
X
X
X
X X

X X

X X

X X

X X

X X

X X

X X
Roles and responsibilities
Detection activities comply
for detection are well Detection processes are
with all applicable
defined to ensure tested
requirements
accountability

DE.DP-1 DE.DP-2 DE.DP-3

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
Event detection information Detection processes are Response plan is executed
is communicated continuously improved during or after an incident

DE.DP-4 DE.DP-5 RS.RP-1

X X
X X
X X
X X
X X
X X
X X
X X
Personnel know their roles Incidents are reported Information is shared
and order of operations consistent with established consistent with response
when a response is needed criteria plans

RS.CO-1 RS.CO-2 RS.CO-3

 Voluntary information
Coordination with
sharing occurs with external Notifications from
stakeholders occurs
stakeholders to achieve detection systems are
consistent with response
broader cybersecurity investigated
plans
situational awareness

RS.CO-4 RS.CO-5 RS.AN-1

 Incidents are categorized
The impact of the incident
Forensics are performed consistent with response
is understood
plans

RS.AN-2 RS.AN-3 RS.AN-4

Processes are established to
receive, analyze and
respond to vulnerabilities
disclosed to the
organization from internal Incidents are contained Incidents are mitigated
and external sources (e.g.
internal testing, security
bulletins, or security
researchers)
RS.AN-5 RS.MI-1 RS.MI-2
X

X
X
X
X
 Newly identified
vulnerabilities are mitigated Response plans incorporate Response strategies are
or documented as accepted lessons learned updated
risks

RS.MI-3 RS.IM-1 RS.IM-2

X

X
X
X
X
Recovery plan is executed
Recovery plans incorporate Recovery strategies are
during or after a
lessons learned updated
cybersecurity incident

RC.RP-1 RC.IM-1 RC.IM-2

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
 Recovery activities are
communicated to internal
Public relations are Reputation is repaired after
and external stakeholders
managed an incident
as well as executive and
management teams

RC.CO-1 RC.CO-2 RC.CO-3

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
 CIS Controls v7.1 mapped to the NIST Cyber Security Framework (v1.0)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7
Critical Security Control #4: Controlled Use of Administrative Privileges
System 4.1

System 4.2

System 4.3

System 4.4

System 4.5
 System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

 Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6
 Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4
 Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2
Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10
Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6
Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to the NIST Cyber Security Framework (v1.0)

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.
Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.
curity Control #4: Controlled Use of Administrative Privileges
Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.
 Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.
Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.
Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
 Maintain an up-to-date inventory of all of the organization's network boundaries.
Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.
Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.
Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.
Enable the collection of NetFlow and logging data on all network boundary devices.
Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.
 If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.
 Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.
 Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.
 For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.
Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Physical devices and Software platforms and

Organizational
systems within the applications within the
communication and data
organization are organization are
flows are mapped
inventoried inventoried

ID.AM-1 ID.AM-2 ID.AM-3

X X
X X
X X

X X

X X

X X

X X

X X

X
X
X
X
X

X
X
s, Routers and Switches
 Resources (e.g., hardware, Cybersecurity roles and
devices, data, and software) responsibilities for the
External information are prioritized based on entire workforce and third-
systems are catalogued their classification, party stakeholders (e.g.,
criticality, and business suppliers, customers,
value partners) are established

ID.AM-4 ID.AM-5 ID.AM-6

X
X
X

X
The organization’s role in The organization’s place in Priorities for organizational
the supply chain is critical infrastructure and its mission, objectives, and
identified and industry sector is identified activities are established
communicated and communicated and communicated

ID.BE-1 ID.BE-2 ID.BE-3

Dependencies and critical
Resilience requirements to Organizational information
functions for delivery of
support delivery of critical security policy is
critical services are
services are established established
established

ID.BE-4 ID.BE-5 ID.GV-1

 Legal and regulatory
Information security roles &
requirements regarding
responsibilities are Governance and risk
cybersecurity, including
coordinated and aligned management processes
privacy and civil liberties
with internal roles and address cybersecurity risks
obligations, are understood
external partners
and managed

ID.GV-2 ID.GV-3 ID.GV-4

 Threat and vulnerability
Threats, both internal and
Asset vulnerabilities are information is received
external, are identified and
identified and documented from information sharing
documented
forums and sources

ID.RA-1 ID.RA-2 ID.RA-3

X X

X X

X X

X X
X X
X X
X X
Potential business impacts Threats, vulnerabilities,
Risk responses are
and likelihoods are likelihoods, and impacts are
identified and prioritized
identified used to determine risk

ID.RA-4 ID.RA-5 ID.RA-6

 The organization’s
Risk management processes determination of risk
Organizational risk
are established, managed, tolerance is informed by its
tolerance is determined and
and agreed to by role in critical infrastructure
clearly expressed
organizational stakeholders and sector specific risk
analysis

ID.RM-1 ID.RM-2 ID.RM-3

 Identities and credentials
Physical access to assets is
are managed for authorized Remote access is managed
managed and protected
devices and users

PR.AC-1 PR.AC-2 PR.AC-3

X
X

X
X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
 Access permissions are Network integrity is
managed, incorporating the protected, incorporating All users are informed and
principles of least privilege network segregation where trained
and separation of duties appropriate

PR.AC-4 PR.AC-5 PR.AT-1

X
X

X
X
X

X
X
X
X
X
X
X
X

X
X
X

X
X
X

X
X
X

X
X
X
X
 X

X
X

X X

X X

X X
X X

X X

X X

X X

X X

X X
X
X
X
X
X
X

X
X
X
X
X
X

X
X
X

X
X
X

X
 Third-party stakeholders
Senior executives
Privileged users understand (e.g., suppliers, customers,
understand roles &
roles & responsibilities partners) understand roles
responsibilities
& responsibilities

PR.AT-2 PR.AT-3 PR.AT-4

X
X

X
X
X

X
X
X
X X X
X X X
X X X

X X X

X X X
X X X
X X X

X X X

X X X
Physical and information
security personnel
Data-at-rest is protected Data-in-transit is protected
understand roles &
responsibilities

PR.AT-5 PR.DS-1 PR.DS-2

X

X
X
X
X
 X

X
X

X X

X X

X X
X X

X X

X X

X X

X X

X X
X
X
X

X
X
X

X
 Assets are formally
Adequate capacity to
managed throughout Protections against data
ensure availability is
removal, transfers, and leaks are implemented
maintained
disposition

PR.DS-3 PR.DS-4 PR.DS-5

X
X
X

X
X

X
X
X
X
X

X
X
 A baseline configuration of
Integrity checking The development and
information
mechanisms are used to testing environment(s) are
technology/industrial
verify software, firmware, separate from the
control systems is created
and information integrity production environment
and maintained

PR.DS-6 PR.DS-7 PR.IP-1

X
X
X
X
X

X
X
X

X
X

X
X

X
X
X

X
X
X

X
X
X

X
X
X
X
X
X

X
X
A System Development Life Configuration change Backups of information are
Cycle to manage systems is control processes are in conducted, maintained, and
implemented place tested periodically

PR.IP-2 PR.IP-3 PR.IP-4

X
X
X

X
 Policy and regulations
regarding the physical
Data is destroyed according Protection processes are
operating environment for
to policy continuously improved
organizational assets are
met

PR.IP-5 PR.IP-6 PR.IP-7

 Response plans (Incident
Response and Business
Effectiveness of protection
Continuity) and recovery Response and recovery
technologies is shared with
plans (Incident Recovery plans are tested
appropriate parties
and Disaster Recovery) are
in place and managed

PR.IP-8 PR.IP-9 PR.IP-10

X

X
 Maintenance and repair of
Cybersecurity is included in A vulnerability organizational assets is
human resources practices management plan is performed and logged in a
(e.g., deprovisioning, developed and timely manner, with
personnel screening) implemented approved and controlled
tools

PR.IP-11 PR.IP-12 PR.MA-1

X

X
X
X
X
 Remote maintenance of
organizational assets is Audit/log records are Removable media is
approved, logged, and determined, documented, protected and its use
performed in a manner that implemented, and reviewed restricted according to
prevents unauthorized in accordance with policy policy
access

PR.MA-2 PR.PT-1 PR.PT-2

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X
X

X
X
X
X
X
X
X

X
X
X

X
X
X
X
X

X
X

X
X

X
 A baseline of network
Access to systems and
Communications and operations and expected
assets is controlled,
control networks are data flows for users and
incorporating the principle
protected systems is established and
of least functionality
managed

PR.PT-3 PR.PT-4 DE.AE-1

X
X

X
X
X

X
X
X
 X
X
X
X
X

X
X
X

X
X
X

X
X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
 Event data are aggregated
Detected events are
and correlated from Impact of events is
analyzed to understand
multiple sources and determined
attack targets and methods
sensors

DE.AE-2 DE.AE-3 DE.AE-4

X
X
X
X
X
X
X
X
X X

X X

X X

X X

X X

X X

X X

X X
 The physical environment is
The network is monitored
Incident alert thresholds monitored to detect
to detect potential
are established potential cybersecurity
cybersecurity events
events

DE.AE-5 DE.CM-1 DE.CM-2

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
 Personnel activity is
monitored to detect Unauthorized mobile code
Malicious code is detected
potential cybersecurity is detected
events

DE.CM-3 DE.CM-4 DE.CM-5

X X
X X

X X

X X
X X
X X
X X
X X
X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
External service provider Monitoring for
activity is monitored to unauthorized personnel, Vulnerability scans are
detect potential connections, devices, and performed
cybersecurity events software is performed

DE.CM-6 DE.CM-7 DE.CM-8

X

X
X
X
X
X X

X X

X X

X X

X X

X X

X X

X X
Roles and responsibilities
Detection activities comply
for detection are well Detection processes are
with all applicable
defined to ensure tested
requirements
accountability

DE.DP-1 DE.DP-2 DE.DP-3

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
Event detection information
Detection processes are Response plan is executed
is communicated to
continuously improved during or after an event
appropriate parties

DE.DP-4 DE.DP-5 RS.RP-1

X X
X X
X X
X X
X X
X X
X X
X X
Personnel know their roles Events are reported Information is shared
and order of operations consistent with established consistent with response
when a response is needed criteria plans

RS.CO-1 RS.CO-2 RS.CO-3

 Voluntary information
Coordination with
sharing occurs with external Notifications from
stakeholders occurs
stakeholders to achieve detection systems are
consistent with response
broader cybersecurity investigated
plans
situational awareness

RS.CO-4 RS.CO-5 RS.AN-1

 Incidents are categorized
The impact of the incident
Forensics are performed consistent with response
is understood
plans

RS.AN-2 RS.AN-3 RS.AN-4

 Newly identified
vulnerabilities are mitigated
Incidents are contained Incidents are mitigated
or documented as accepted
risks

RS.MI-1 RS.MI-2 RS.MI-3

X

X
X
X
X
Response plans incorporate Response strategies are Recovery plan is executed
lessons learned updated during or after an event

RS.IM-1 RS.IM-2 RC.RP-1

X

X
Recovery plans incorporate Recovery strategies are Public relations are
lessons learned updated managed

RC.IM-1 RC.IM-2 RC.CO-1

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
 Recovery activities are
Reputation after an event is communicated to internal
repaired stakeholders and executive
and management teams

RC.CO-2 RC.CO-3
X X

X X

X X

X X

X X

X X

X X

X X
 CIS Controls v7.1 mapped to NIST 800-82 rev2

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to NIST 800-82 rev2

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Business Case for Build and Train a Cross

Risk Management Security Functional Team

3.1 4.1 4.2

s, Routers and Switches
 Define ICS Specific Implement an ICS
Define Charter and Security Risk
Scope Security Policies and Management
Procedures Framework

4.3 4.4 4.5

Network Segmentation
and Segregation Boundary Protection Firewalls

5.1 5.2 5.3

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X

X
X

X
X
 Recommended
Logically Separated
Control Network Network Segregation Defense-in-Depth
Architecture

5.4 5.5 5.6

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X X

X X

X X
X X

X X

X X

X X

X X
X X
 Recommended Firewall
General Firewall Network Address
Policies for ICS Rules for Specific Translation (NAT)
Services

5.7 5.8 5.9

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
Specific ICS Firewall Unidirectional
Issues Gateways Single Points of Failure

5.1 5.11 5.12

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
Redundancy and Fault Preventing Man-in-the- Authentication and
Tolerance Middle Attacks Authorization

5.13 5.14 5.15

X
X

X
X
X

X
X
X
X

X
X
X

X
X
X
X
X
X
X
X

X
X
X
X
X
X
 Incident Detection,
Monitoring, Logging,
and Auditing Response, and System Access Control
Recovery

5.16 5.17 6.2.1

X
X
X
X
X
X
X
X
X

X
X

X
X
X

X
 Audit and Security Assessment
Awareness and Training Accountability and Authorization

6.2.2 6.2.3 6.2.4

X
X

X
X
X

X
X X
X X
X X

X X

X X

X X

X X

X X
Configuration Identification and
Management Contingency Planning Authentication

6.2.5 6.2.6 6.2.7

X
X

X
X
X

X
X
X
X

X
X
X

X
X
X
X
X
X
X
X

X
X
X
X
X
X
Incident Response Maintenance Media Protection

6.2.8 6.2.9 6.2.10

X

X
 Physical and
Environmental Planning Personnel Security
Protection

6.2.11 6.2.12 6.2.13

 System and
System and Services
Risk Assessment Acquisition Communications
Protection

6.2.14 6.2.15 6.2.16

X
X
X

X
X
X
X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
System and Information
Integrity Program Management Privacy Controls

6.2.17 6.2.18 6.2.19

X
X
X

X
X
X
X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
 CIS Controls v7.1 mapped to NISTIR 7621 (rev 1): Small Business
Information Security

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4
 System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3
 System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7
 System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6
 System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

S Controls v7.1 mapped to NISTIR 7621 (rev 1): Small Business

Information Security

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
 The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
 Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

 On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
 Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Identify and control Conduct Background Require individual user

who has access to your accounts for each
business information Checks employee

3.1a 3.1b 3.1c

, Routers and Switches
X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Create policies and Limit employee access Install Surge Protectors
procedures for and Uninterruptible
information security to data and information Power Supplies (UPS)

3.1d 3.2a 3.2b

X
X
X
X
X
X

X
X
X
X
X
X
 Install and activate
Patch your operating software and hardware Secure your wireless
systems and access point and
applications firewalls on all your networks
business networks

3.2c 3.2d 3.2e

X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
Set up web and email Use encryption for Dispose of old
sensitive business computers and media
filters information safely

3.2f 3.2g 3.2h

X

X
X

X
X
X

X
X

X
X
 Install and update anti-
virus, -spyware, and Maintain and monitor
Train your employees
other –malware logs
programs

3.2i 3.3a 3.3b

X
X
X
X
X
X
X
 X

X
X
X
X
X
X
X

X
X
X

X
 Develop a plan for Make incremental
disasters and Make full backups of backups of important
important business
information security data/information business
incidents data/information

3.4a 3.5a 3.5b

X X
X X
X X

X X

X X
X

X
 Make improvements to
Consider cyber processes / Pay attention to the
people you work with
insurance procedures / and around
technologies

3.5c 3.5d 4.0a

 Do not connect
Use separate personal personal or untrusted
Be careful of email and business storage devices or
attachments and web
links computers, mobile hardware into your
devices, and accounts computer, mobile
device, or network

4.0b 4.0c 4.0d

X
X
X

X
X X

X X
X X

X X

X X

X X

X X

X X

X X
X X
Be careful downloading Do not give out Watch for harmful pop-
personal or business
software information ups

4.0e 4.0f 4.0g

X X

X X
X X

X X

X X

X X

X X

X X

X X
X X
 Conduct online business
Use strong passwords
more securely

4.0h 4.0i
X

X
X

X
X
X
X
X
X
X
X

X
X
X
X
X
X
 CIS Controls v7.1 mapped to the DHS CDM Program

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

 Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to the DHS CDM Program

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
 Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Hardware Asset Software Asset Configuration Settings

Management Management Management

HWAM SWAM CSM

X
X
X

X X

X X

X X
X X
X X
X X
X X

X X

X X
X X
X

X
X

X
X

X
X
s, Routers and Switches
X

X
X
X

X
Vulnerability Access Control Security-Related
Management Management Behavior Management

VUL TRUST BEHV

X

X
X
X
X
X

X
X

X
 X
X

X
X
X

X
X

X
X
X
X
X
X
X

X
 Credentials &
Authentication Privileges Boundary Protection
Management

CRED PRIV
X
X
X
X
X

X
X
X

X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
 Generic Audit
Plan for Events Respond to Events Monitoring
X
X
X
X
X
X
X
X
X X

X X

X X

X X

X X

X X

X X

X X
 Document
Requirements Quality Management Risk Management
 CIS Controls v7.1 mapped to ISO 27002:2013

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to ISO 27002:2013

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Information security
Policies for information Review of the policies
security for information security roles and
responsibilities

A.5.1.1 A.5.1.2 A.6.1.1

s, Routers and Switches
 Contact with Contact with special
Segregation of duties authorities interest groups

A.6.1.2 A.6.1.3 A.6.1.4

X

X
Information security in
project management Mobile device policy Teleworking

A.6.1.5 A.6.2.1 A.6.2.2

 Terms and conditions of Management
Screening employment responsibilities

A.7.1.1 A.7.1.2 A.7.2.1

X

X
 Information security Termination or change
awareness, education Disciplinary process of employment
and training responsibilities

A.7.2.2 A.7.2.3 A.7.3.1

X
X

X
X
X

X
 Acceptable use of
Inventory of assets Ownership of assets assets

A.8.1.1 A.8.1.2 A.8.1.3

X
X
X

X
 Classification of
Return of assets information Labelling of information

A.8.1.4 A.8.2.1 A.8.2.2

 Management of
Handling of assets removable media Disposal of media

A.8.2.3 A.8.3.1 A.8.3.2

X

X
X
X
X
X
X
X

X
X
X
X

X
X

X
X

X
X
 Access to networks and
Physical media transfer Access control policy netwok services

A.8.3.3 A.9.1.1 A.9.1.2

X
X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X

X
X
X

X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
User registration and User access
de-registration provisioning Privilege management

A.9.2.1 A.9.2.2 A.9.2.3

X X
X X

X X
X X
X X

X X

X X
X X
X X
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
Management of secret
Review of user access Removal or adjustment
authentication rights of access rights
information of users

A.9.2.4 A.9.2.5 A.9.2.6

X X X
X X X

X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Use of secret Use of secret
Secure log-on
authentication authentication procedures
information information

A.9.3.1 A.9.4.1 A.9.4.2

X X X
X X X

X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
Password management Use of privileged utility Access control to
system programs program source code

A.9.4.3 A.9.4.4 A.9.4.5

X X
X X

X X
X X
X X

X X

X X
X X
X X
X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X
X
X
X

X
 Policy on the use of Physical security
cryptographic controls Key management perimeter

A.10.1.1 A.10.1.2 A.11.1.1

X
X
X

X
X X
X X

X X
X X
X X
X X

X X

X X
X X

X
X

X
X

X
X
X
X

X
X
X

X
X
 Protecting against
Securing office, rooms
Physical entry controls and facilities external end
environmental threats

A.11.1.2 A.11.1.3 A.11.1.4

 Delivery and loading Equipment siting and
Working in secure areas areas protection

A.11.1.5 A.11.1.6 A.11.2.1

 Equipment
Supporting utilities Cabling security maintenance

A.11.2.2 A.11.2.3 A.11.2.4

 Security of equipment Security disposal or re-
Removal of assets and assets off-premises use of equipment

A.11.2.5 A.11.2.6 A.11.2.7

Unattended user Clear desk and clear Documented operating
equipment screen policy procedures

A.11.2.8 A.11.2.9 A.12.1.1

X
X
X
X
X
X

X
X
X
X
X
X
 Separation of
development, test and
Change management Capacity management operational
environments

A.12.1.2 A.12.1.3 A.12.1.4

X
X

X
X
X
X
X
X

X
Controls against
malware Information backup Event logging

A.12.2.1 A.12.3.1 A.12.4.1

X
X
X
X
X
X
X
X
X

X
X
X
X
X

X
X
X

X
X

X
X
X
X
X

X
X
X

X
X
Protection of log Administrator and
information operator logs Clock synchronisation

A.12.4.2 A.12.4.3 A.12.4.4

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
Installation of software Management of Restrictions on
on operational systems technical vulnerabilities software installation

A.12.5.1 A.12.6.1 A.12.6.2

X X

X X

X X
X X
X X
X X
X X

X X

X X
X X

X
X
X
X
Information systems Security of network
audit controls Network controls services

A.12.7.1 A.13.1.1 A.13.1.2

X
X
X

X
X
X
X
X
X
X
X
X
X

X
X
X

X
 X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X
X
X
X

X
X
X

X
X
Segregation in Information transfer Agreements on
networks policies and procedures information transfer

A.13.1.3 A.13.2.1 A.13.2.2

 X X
X X
X X
X X
X X

X
X
X

X
X

X
 Security requirements
Confidentiality or non-
Electronic messaging disclosure agreements analysis and
specification

A.13.2.3 A.13.2.4 A.14.1.1

X

X
X

X
X

X
X
X
X
X
X

X
X

X
X
X
X

X
X
Securing applications
Protecting application Secure development
services on public services transactions policy
networks

A.14.1.2 A.14.1.3 A.14.2.1

X
X
X
X
X
X
X

X
X
X
X
X
X

X
 Technical review of
System change control applications after Restrictions on changes
procedures operating platform to software packages
changes

A.14.2.2 A.14.2.3 A.14.2.4

X

X
X

X
X

X
X
 Secure system Secure development Outsourced
engineering principles environment development

A.14.2.5 A.14.2.6 A.14.2.7

X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X
 System acceptance
System security testing testing Protection of test data

A.14.2.8 A.14.2.9 A.14.3.1

X

X
X
X
X
X

X
X

X
X

X
X
X
X

X
X
X
X
X
X

X
X
X

X
Information security Addressing security Information and
policy for supplier within supplier communication
relationships agreements technology supply chain

A.15.1.1 A.15.1.2 A.15.1.3

Monitoring and review Managing changes to Responsibilities and
of supplier services supplier services procedures

A.15.2.1 A.15.2.2 A.16.1.1

 Assessment and
Reporting information Reporting information
security events security weaknesses decision on information
security events

A.16.1.2 A.16.1.3 A.16.1.4

X X

X X

X X

X X

X X

X X

X X

X X
 Response to Learning from
information security information security Collection of evidence
incidents incidents

A.16.1.5 A.16.1.6 A.16.1.7

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
 Implementing Verify, review and
Planning information
security continuity information security evaluate information
continuity security continuity

A.17.1.1 A.17.1.2 A.17.1.3

 Availability of Identification of
applicable legislation Intellectual property
information processing and contractual rights (IPR)
facilities requirements

A.17.2.1 A.18.1.1 A.18.1.2

 Privacy and protection
Regulation of
Protection of records of personally cryptographic controls
identifiable information

A.18.1.3 A.18.1.4 A.18.1.5

X
X

X
X
X
X

X
X
 Compliance with
Independent review of Technical compliance
information security security policies and review
standards

A.18.2.1 A.18.2.2 A.18.2.3

X

X
X

X
X

X
X
X X
X X
X X

X X

X X

X X

X X

X X
 CIS Controls v7.1 mapped to ISO 27002:2005

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to ISO 27002:2005

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Review of the Management

Information security
policy document information security commitment to
policy information security

A.5.1.1 A.5.1.2 A.6.1.1

s, Routers and Switches
 Allocation of Authorization process
Information security co-
ordination information security for information
responsibilities processing facilities

A.6.1.2 A.6.1.3 A.6.1.4

Confidentiality Contact with Contact with special
agreements authorities interest groups

A.6.1.5 A.6.1.6 A.6.1.7

X

X
 Identification of risks Addressing security
Independent review of
information security related to external when dealing with
parties customers

A.6.1.8 A.6.2.1 A.6.2.2

X
X
X

X
 Addressing security in
third party agreements Inventory of assets Ownership of assets

A.6.2.3 A.7.1.1 A.7.1.2

X
X
X

X
Acceptable use of Information labelling
assets Classification guidelines and handling

A.7.1.3 A.7.2.1 A.7.2.2

 Roles and Terms and conditions of
responsibilities Screening employment

A.8.1.1 A.8.1.2 A.8.1.3

 Information security
Management
responsibilities awareness, education Disciplinary process
and training

A.8.2.1 A.8.2.2 A.8.2.3

X
X

X
X
X

X
X

X
 Termination Removal of access
responsibilities Return of assets rights

A.8.3.1 A.8.3.2 A.8.3.3

X
X
X
X
X
X

X
X
X
X
X
X
Physical security Securing offices, rooms
perimeter Physical entry controls and facilities

A.9.1.1 A.9.1.2 A.9.1.3

 Protecting against
Public access, delivery
external and Working in secure areas and loading areas
environmental threats

A.9.1.4 A.9.1.5 A.9.1.6

Equipment siting and
protection Supporting utilities Cabling security

A.9.2.1 A.9.2.2 A.9.2.3

 Equipment Security of equipment Secure disposal or re-
maintenance off- premises use of equipment

A.9.2.4 A.9.2.5 A.9.2.6

 Documented operating
Removal of property procedures Change management

A.9.2.7 A.10.1.1 A.10.1.2

 Separation of
Segregation of duties development, test and Service delivery
operational facilities

A.10.1.3 A.10.1.4 A.10.2.1

X
X

X
X
X
X
X
X

X
Monitoring and review Managing changes to
of third party services third party services Capacity management

A.10.2.2 A.10.2.3 A.10.3.1

 Controls against Controls against mobile
System acceptance malicious code code

A.10.3.2 A.10.4.1 A.10.4.2

X X

X X

X X

X X
X X
X X
X X
X X
 Security of network
Information back-up Network controls services

A.10.5.1 A.10.6.1 A.10.6.2

X X
X X
X X

X X

X X

X X

X X

X X
 X X
X X
X X
X X
X X

X
X
X

X X

X X

X X
X X
X X

X X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
 Management of Information handling
removable media Disposal of media procedures

A.10.7.1 A.10.7.2 A.10.7.3

X

X
X
X
X
X
X
X

X
X
X
X

X
X

X
X

X
X
Security of system Information exchange
documentation policies and procedures Exchange agreements

A.10.7.4 A.10.8.1 A.10.8.2

Physical media in Business information
transit Electronic messaging systems

A.10.8.3 A.10.8.4 A.10.8.5

X
X
X

X
 Publicly available
Electronic commerce On-line transactions information

A.10.9.1 A.10.9.2 A.10.9.3

 Protection of log
Audit logging Monitoring system use information

A.10.10.1 A.10.10.2 A.10.10.3

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
X

X
X X X

X X X

X X X
X X X

X X X

X X X

X X X

X X X
X X X
Administrator and
operator logs Fault logging Clock synchronization

A.10.10.4 A.10.10.5 A.10.10.6

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
Access control policy User registration Privilege management

A.11.1.1 A.11.2.1 A.11.2.2

X
X
X
X
X
X

X
X
X
X
X
X
User password Review of user access
management rights Password use

A.11.2.3 A.11.2.4 A.11.3.1

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
Unattended user Clear desk and clear Policy on use of
equipment screen policy network services

A.11.3.2 A.11.3.3 A.11.4.1

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Equipment Remote diagnostic and
User authentication for
external connections identification in configuration port
networks protection

A.11.4.2 A.11.4.3 A.11.4.4

X
X
X
X
X
X

X
Segregation in Network connection Network routing
networks control control

A.11.4.5 A.11.4.6 A.11.4.7

X
X
X

X
X X

X X

X X
X X
X X

X X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X X

X X

X X
X X

X X

X X

X X

X X
X X
Secure log-on User identification and Password management
procedures authentication system

A.11.5.1 A.11.5.2 A.11.5.3

X X X
X X X

X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X

X X X
X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Limitation of
Use of system utilities Session time-out connection time

A.11.5.4 A.11.5.5 A.11.5.6

Information access Sensitive system Mobile computing and
restriction isolation communications

A.11.6.1 A.11.6.2 A.11.7.1

X

X
X X

X X

X X
X X

X X

X X

X X

X X
X X
 Security requirements
Teleworking analysis and Input data validation
specification

A.11.7.2 A.12.1.1 A.12.2.1

X

X
X
X

X
X
X
X
X
X

X
Control of internal
processing Message integrity Output data validation

A.12.2.2 A.12.2.3 A.12.2.4

X
X

X
X
X
X
X
X

X
 Policy on the use of Control of operational
cryptographic controls Key management software

A.12.3.1 A.12.3.2 A.12.4.1

X X
X X

X X
X X
X X
X X

X X

X X
X X
Protection of system Access control to Change control
test data program source code procedures

A.12.4.2 A.12.4.3 A.12.5.1

Technical review of
applications after Restrictions on changes
operating system to software packages Information leakage
changes

A.12.5.2 A.12.5.3 A.12.5.4

X
X

X
X
X
X

X
X

X
X

X
X
X
X

X
X
X
X
X
X

X
Outsourced software Control of technical Reporting information
development vulnerabilities security events

A.12.5.5 A.12.6.1 A.13.1.1

X

X
X
X
X
X
X

X
X
X
X
X
X

X
 Learning from
Reporting security Responsibilities and
weaknesses procedures information security
incidents

A.13.1.2 A.13.2.1 A.13.2.2

X

X
X
X
X
X X

X X

X X

X X

X X

X X

X X

X X
 Including information
security in the business Business continuity and
Collection of evidence continuity management risk assessment
process

A.13.2.3 A.14.1.1 A.14.1.2

 Developing and
implementing Testing, maintaining
Business continuity and re- assessing
continuity plans planning framework business continuity
including information plans
security

A.14.1.3 A.14.1.4 A.14.1.5

 Identification of Intellectual property Protection of
applicable legislation rights (IPR) organizational records

A.15.1.1 A.15.1.2 A.15.1.3

Data protection and Prevention of misuse of
Regulation of
privacy of personal information processing cryptographic controls
information facilities

A.15.1.4 A.15.1.5 A.15.1.6

X
X

X
X
X
X

X
X
 Compliance with
Technical compliance Information systems
security policies and checking audit controls
standards

A.15.2.1 A.15.2.2 A.15.3.1

X

X
X
X
X
X

X
X

X
X

X
X
X X
X X
X X

X X

X X

X X

X X

X X
 Protection of
information systems
audit tools

A.15.3.2
 CIS Controls v7.1 mapped to IEC 62443-3-3:2013

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to IEC 62443-3-3:2013

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Human user Software process and

identification and device identification Account management
authentication and authentication

SR 1.1 SR 1.2 SR 1.3

X
X
X

X
X
X
X
X

X
X
, Routers and Switches
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Authenticator Wireless access
Identifier management management management

SR 1.4 SR 1.5 SR 1.6

 X
X
X
X

X
X
X

X
X

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Public key
Strength of password- Strength of public key
based authentication infrastructure (PKI) authentication
Certificates

SR 1.7 SR 1.8 SR 1.9

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Unsuccessful login
Authenticator feedback attempts System use notification

SR 1.10 SR 1.11 SR 1.12

X
X
X
X
X
X
X
X
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
Access via untrusted Authorisation
networks enforcement Wireless use control

SR 1.13 SR 2.1 SR 2.2

X

X
X

X
X

X
 X

X
X
X
X

X
X
X

X
X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
Use control for portable
and mobile devices Mobile code Session Lock

SR 2.3 SR 2.4 SR 2.5

X
X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
Remote session Concurrent session
termination control Auditable events

SR 2.6 SR 2.7 SR 2.8

X
X
X
X
X
X
X
X
 Response to audit
Audit storage capacity processing failures Timestamps

SR 2.9 SR 2.10 SR 2.11

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
 Communication Malicious code
Non-repudiation integrity protection

SR 2.12 SR 3.1 SR 3.2

X

X
X
X
X
X
X
X

X
X
X
X

X
X
Security functionality Software and
verification information integrity Input validation

SR 3.3 SR 3.4 SR 3.5

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X

X
X
X

X
Deterministic output Error handling Session integrity

SR 3.6 SR 3.7 SR 3.8

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
Protection of audit Information
information Confidentiality Information persistence

SR 3.9 SR 4.1 SR 4.2

X
X
X
X
X
X
X
X
X

X
X

X
X
 Zone boundary
Use of cryptography Network segmentation protection

SR 4.3 SR 5.1 SR 5.2

 X

X
X

X
X
X
X

X
X

X
X

X
X
General purpose
person-to-person
communication Application partitioning Audit log accessibility
restriction

SR 5.3 SR 5.4 SR 6.1

X
X
X
X
X
X
X
X
X

X
X

X
X
 Denial of service
Continuous monitoring protection Resource management

SR 6.2 SR 7.1 SR 7.2

X
X
X
X
X
X
X
X
 Control system
Control system backup recovery and Emergency power
reconsitution

SR 7.3 SR 7.4 SR 7.5

X X
X X
X X

X X

X X
Network and security Control system
configuration settings Least functionality component inventory

SR 7.6 SR 7.7 SR 7.8

X
X
X

X
X

X
X
X

X
X
X

X
X

X
X
 CIS Controls v7.1 mapped to NIST 800-171

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7
 System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5
 System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1
 System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1
 System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1
 Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8
 Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4
Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2
Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9
Critical Security Control #18: Application Software Security
Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5
Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to NIST 800-171

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
 Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
 Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.
 Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.
 Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.
 All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.
 Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

 Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
 Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.
 Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Limit information
system access to Use session lock with
authorized users, pattern-hiding displays Terminate
processes acting on to prevent (automatically) a user
behalf of authorized access/viewing of data session after a defined
users, or devices after period of condition.
(including other inactivity.
information systems).

3.1.1 3.1.10 3.1.11

, Routers and Switches
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Employ cryptographic
Monitor and control mechanisms to protect Route remote access
remote access sessions. the confidentiality of via managed access
remote access sessions. control points.

3.1.12 3.1.13 3.1.14

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X X X

X X X

X X X

X X X
 Authorize remote
execution of privileged Authorize wireless Protect wireless access
commands and remote access prior to allowing using authentication
access to security- such connections. and encryption.
relevant information.

3.1.15 3.1.16 3.1.17

X

X
X

X
X X
X X
X X
X X

X X
X X
X X

X X

X X
X X
 Limit information
system access to the
Control connection of Encrypt CUI on mobile types of transactions
mobile devices. devices. and functions that
authorized users are
permitted to execute.

3.1.18 3.1.19 3.1.2

X

X
X

X
X
X
X

X
X

X
X
X

X
 Limit use of
Verify and control/limit Control information
connections to and use organizational portable posted or processed on
of external information storage devices on publicly accessible
systems. external information information systems.
systems.

3.1.20 3.1.21 3.1.22

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X X X

X X X

X X X

X X X

X
X
X
X

X
X
 Separate the duties of Employ the principle of
Control the flow of CUI
in accordance with individuals to reduce least privilege, including
approved the risk of malevolent for specific security
authorizations. activity without functions and privileged
collusion. accounts.

3.1.3 3.1.4 3.1.5

X
X

X
X
X

X
X
X
X

X
X

X X

X X

X X
X X
X X

X X

X X

X X

X X
 Prevent non-privileged
Use non-privileged
accounts or roles when users from executing Limit unsuccessful
accessing nonsecurity privileged functions and logon attempts.
functions. audit the execution of
such functions.

3.1.6 3.1.7 3.1.8

X X
X X

X X
X X
X X

X X

X X
X X
X X
X
X
X
X
X
X

X
X
X
X
X
X
 Limit physical access to
organizational Protect and monitor
Provide privacy and
security notices information systems, the physical facility and
consistent with equipment, and the support infrastructure
applicable CUI rules. respective operating for those information
environments to systems.
authorized individuals.

3.1.9 3.10.1 3.10.2

 Escort visitors and Maintain audit logs of Control and manage
monitor visitor activity. physical access. physical access devices.

3.10.3 3.10.4 3.10.5

 Periodically assess the
risk to organizational
operations (including
mission, functions, Scan for vulnerabilities
image, or reputation), in the information
Enforce safeguarding organizational assets,
measures for CUI at and individuals, system and applications
alternate work sites resulting from the periodically and when
(e.g., telework sites). operation of new vulnerabilities
affecting the system are
organizational identified.
information systems
and the associated
processing, storage, or
transmission of CUI.

3.10.6 3.11.1 3.11.2

X

X
X
X
X
 Periodically assess the Develop and implement
security controls in plans of action designed
Remediate
vulnerabilities in organizational to correct deficiencies
accordance with information systems to and reduce or eliminate
assessments of risk. determine if the vulnerabilities in
controls are effective in organizational
their application. information systems.

3.11.3 3.12.1 3.12.2

X X

X X

X X

X X
X X
X X
X X
 Monitor, control, and
protect organizational
communications (i.e.,
Monitor information information Establish and manage
system security
controls on an ongoing transmitted or received cryptographic keys for
basis to ensure the by organizational cryptography employed
continued effectiveness information systems) at in the information
the external boundaries system;
of the controls. and key internal
boundaries of the
information systems.

3.12.3 3.13.1 3.13.10

X

X
X

X
 Prohibit remote
activation of
Employ FIPS-validated
cryptography when collaborative Control and monitor
used to protect the computing devices and the use of mobile code.
confidentiality of CUI. provide indication of
devices in use to users
present at the device.

3.13.11 3.13.12 3.13.13

X X

X X

X X

X X

X X

X X

X X

X X
X X

X X

X X

X X
 Control and monitor
the use of Voice over Protect the authenticity Protect the
Internet Protocol (VoIP) of communications confidentiality of CUI at
technologies. sessions. rest.

3.13.14 3.13.15 3.13.16

X

X
X

X
X
X
X

X
X
 Employ architectural
designs, software
development Separate user Prevent unauthorized
techniques, and
systems engineering functionality from and unintended
principles that promote information system information transfer via
effective information management shared system
functionality. resources.
security within
organizational
information systems.

3.13.2 3.13.3 3.13.4

X
X

X
X
X

X
X
X
X

X
X
X

X
 Prevent remote devices
Implement Deny network from simultaneously
subnetworks for communications traffic establishing non-
by default and allow remote connections
publicly accessible network with the information
system components communications traffic system and
that are physically or by exception (i.e., deny communicating via
logically separated from
internal networks. all, permit by some other connection
exception). to resources in external
networks.

3.13.5 3.13.6 3.13.7

X X

X X

X X

X X

X X

X X

X X

X X
 X X

X X

X X

X X

X X

X X

X X
X X
X X

X X

X X

X X

X X
 Implement
cryptographic Terminate network
mechanisms to prevent connections associated Identify, report, and
unauthorized disclosure with communications correct information and
of CUI during sessions at the end of information system
transmission unless the sessions or after a flaws in a timely
otherwise protected by defined period of manner.
alternative physical inactivity.
safeguards.

3.13.8 3.13.9 3.14.1

X

X
X
X
X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
Provide protection from Monitor information
Update malicious code
malicious code at system security alerts protection mechanisms
appropriate locations and advisories and take when new releases are
within organizational appropriate actions in available.
information systems. response.

3.14.2 3.14.3 3.14.4

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
Perform periodic scans Monitor the
of the information information system
including inbound and
system and real-time outbound Identify unauthorized
scans of files from communications traffic, use of the information
external sources as files to detect attacks and system.
are downloaded,
opened, or executed. indicators of potential
attacks.

3.14.5 3.14.6 3.14.7

X
 X
X
X
X
X
X
X

X X
X X

X X

X X
X X
X X
X X
X X
 Ensure that managers,
systems administrators,
and users of
organizational Ensure that
information systems organizational Provide security
are made aware of the personnel are awareness training on
security risks associated adequately trained to recognizing and
with their activities and carry out their assigned reporting potential
of the applicable information security- indicators of insider
policies, standards, and related duties and threat.
procedures related to responsibilities.
the security of
organizational
information systems.

3.2.1 3.2.2 3.2.3

X X
X X

X X

X X

X X
X X
X X

X X

X X
 Create, protect, and
retain information
system audit records to Ensure that the actions
the extent needed to of individual
information system
enable the monitoring, users can be uniquely Review and update
analysis, investigation, traced to those users so audited events.
and reporting of they can be held
unlawful, unauthorized,
or inappropriate accountable for their
information system actions.
activity.

3.3.1 3.3.2 3.3.3

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
 Use automated
mechanisms to
integrate and correlate
audit review, analysis, Provide audit reduction
Alert in the event of an and reporting processes and report generation
audit process failure. for investigation and to support on-demand
response to indications analysis and reporting.
of inappropriate,
suspicious, or unusual
activity.

3.3.4 3.3.5 3.3.6

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
Provide an information
system capability that Protect audit
compares and information and audit Limit management of
synchronizes internal tools from audit functionality to a
system clocks with an unauthorized access, subset of privileged
authoritative source to modification, and users.
generate time stamps deletion.
for audit records.

3.3.7 3.3.8 3.3.9

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
 Establish and maintain
baseline configurations
and inventories of Establish and enforce
organizational security configuration
Track, review,
information systems settings for information approve/disapprove,
(including hardware, technology products and audit changes to
software, firmware, and employed in information systems.
documentation) organizational
throughout the information systems.
respective system
development life cycles.

3.4.1 3.4.2 3.4.3

X X X

X X X

X X X

X X X

X X X
X X X
X X X

X X X
X X X
X X X

X X X

X X X
 Define, document,
approve, and enforce Employ the principle of
least functionality by
Analyze the security physical and logical configuring the
impact of changes prior access restrictions information system to
to implementation. associated with provide only essential
changes to the
information system. capabilities.

3.4.4 3.4.5 3.4.6

X X
X X

X X
X X
X X

X X

X X
X X
X X
 Apply deny-by-
exception (blacklist)
Restrict, disable, and policy to prevent the
prevent the use of use of unauthorized Control and monitor
nonessential programs, software or deny-all, user-installed software.
functions, ports, permit-by-exception
protocols, and services. (whitelisting) policy to
allow the execution of
authorized software.

3.4.7 3.4.8 3.4.9

X X

X X

X X
X X
X X
X X
X X

X X

X X
X X
X
X
X
X
X
 Identify information Store and transmit only
system users, processes encrypted Obscure feedback of
acting on behalf of representation of authentication
users, or devices. passwords. information.

3.5.1 3.5.10 3.5.11

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
Authenticate (or verify) Use multifactor
the identities of those authentication for local Employ replay-resistant
authentication
users, processes, or and network access to mechanisms for
devices, as a privileged accounts and network access to
prerequisite to allowing for network access to privileged and non-
access to organizational non-privileged
information systems. accounts. privileged accounts.

3.5.2 3.5.3 3.5.4

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Enforce a minimum
Prevent reuse of Disable identifiers after password complexity
identifiers for a defined a defined period of and change of
period. inactivity. characters when new
passwords are created.

3.5.5 3.5.6 3.5.7

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Establish an operational
incident-handling
Allow temporary capability for
organizational
Prohibit password password use for information systems
reuse for a specified system logons with an that includes adequate
number of generations. immediate change to a preparation, detection,
permanent password.
analysis, containment,
recovery, and user
response activities.

3.5.8 3.5.9 3.6.1

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
X

X
X

X
 Track, document, and
report incidents to
appropriate officials Test the organizational Perform maintenance
and/or authorities both incident response on organizational
internal and external to capability. information systems.
the organization.

3.6.2 3.6.3 3.7.1

X
X

X
X
X

X
X
X
X X

X X

X X

X X

X X
X X

X X

X X
 Provide effective
controls on the tools, Check media containing
Ensure equipment diagnostic and test
techniques, removed for off-site programs for malicious
mechanisms, and maintenance is code before the media
personnel used to sanitized of any CUI. are used in the
conduct information
system maintenance. information system.

3.7.2 3.7.3 3.7.4

X
X

X
X
X

X
X
X
X
X

X
X
X
X
X
 Require multifactor
authentication to
establish nonlocal Supervise the Protect (i.e., physically
maintenance sessions maintenance activities control and securely
via external network of maintenance store) information
connections and personnel without system media
terminate such required access containing CUI, both
connections when authorization. paper and digital.
nonlocal maintenance
is complete.

3.7.5 3.7.6 3.8.1

X X
X X

X X
X X
X X

X X

X X
X X
X X
X X
X X

X X
X X
X X

X X

X X
 Sanitize or destroy
Limit access to CUI on Mark media with
information system information system necessary CUI markings
media to authorized media containing CUI and distribution
users. before disposal or limitations.
release for reuse.

3.8.2 3.8.3 3.8.4

X

X
X
X

X
 Implement
cryptographic
Control access to media mechanisms to protect
containing CUI and the confidentiality of Control the use of
maintain accountability CUI stored on digital removable media on
for media during media during transport information system
transport outside of unless otherwise components.
controlled areas. protected by
alternative physical
safeguards.

3.8.5 3.8.6 3.8.7

 X

X
X
X
X

X
X

X X

X X

X X
X X
X X

X X

X X

X X

X X
Prohibit the use of
Protect the Screen individuals prior
portable storage confidentiality of to authorizing access to
devices when such backup CUI at storage information systems
devices have no locations. containing CUI.
identifiable owner.

3.8.8 3.8.9 3.9.1

X
X
X

X
X

X
X
X
X

X
X
 Ensure that CUI and
information systems
containing CUI are
protected during and
after personnel actions
such as terminations
and transfers.

3.9.2
X
X
X
X
X
X

X
X
X
X
X
X
 CIS Controls v7.1 mapped to the NSA's MNT

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to the NSA's MNT

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Prepare to Document Map your Network Network Architecture

Milestone 1 Milestone 2 Milestone 3

X
X
X

X
s, Routers and Switches
X

X
X
X

X
X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X
X

X
X
X
X

X
X

X
X

X
 X

X
X
X
X

X
X
X

X
X
Device Accessibility User Access Patch Management

Milestone 4 Milestone 5 Milestone 6

 X

X
X
X
X

X
X

X
X
X

X
X
X

X
 X

X
X

X
X

X
X
X
X
X

X
X
X

X
 X

X
X

X
X
X
X

X
X

X X

X X

X X
X X

X X

X X

X X

X X
X X

X
X
X
X
X
X

X
X
X
X
X
X
 Document your
Baseline Management Network Backup Strategy

Milestone 7 Milestone 8
X X
X X
X X

X X

X X

X X

X X

X X

X
X
X
X
X

X
X

X
X

X
X
X

X
X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X

X X

X X

X X
X X
X X

X X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X X
X X
X X
X X

X X
X X
X X

X X

X X
X X

X
X
X
X
X
X

X
X
X
X
X
X
Incident Response and
Disaster Recovery Plans Security Policy Training
X
X

X
X
X

X
X

X
X
 X
X
X
X

X
 Virus Scanners and Host
Executable Content Personal Electronic
Restrictions Intrusion Prevention Device Management
Systems

X
X
X

X
X
X
X
X

X
X
X

X
X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
 Security Gateways,
Data-At-Rest Protection Network Access Control Proxies, and Firewalls

X
X
X

X
X

X
X

X
X

X
X

X
X
X
X
X

X
X
X

X
X

X
 X

X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X
 Network Security
Remote Access Security Monitoring Log Management

X
X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X X

X X

X X

X X
X X
X X
X X
X X
X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
 Configuration and
Change Management Audit Strategy

X
X
X
X
X

X
X

X
X
X
X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X

X
X
X
X
X

X
 CIS Controls v7.1 mapped to DHS Chemical Facility Anti-Terrorism
Standards

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4

System 4.5
 System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

 Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8
Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3
Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

Controls v7.1 mapped to DHS Chemical Facility Anti-Terrorism

Standards

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all hardware assets, whether connected to the
organization's network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported by the software's
vendor are added to the organization's authorized software inventory. Unsupported software should
be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1, *.py, macros, etc) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incur higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date SCAP-compliant vulnerability scanning tool to automatically scan all systems on
the network on a weekly or more frequent basis to identify all potential vulnerabilities on the
organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from back-to-back vulnerability scans to verify that vulnerabilities
have been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.
 Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading e-mail, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented, standard security configuration standards for all authorized operating
systems and software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as a event source, date, user, timestamp,
source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tool for log correlation
and analysis.
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether onsite or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.
Use DNS filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail(DKIM)
standards.
Block all e-mail attachments entering the organization's e-mail gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) or Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft Powershell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs, are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on regular basis.
Ensure that each of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one backup destination that is not continuously addressable
through operating system calls.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain standard, documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configuration against approved security configurations defined for each
network device in use and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading e-mail, composing
documents, or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
 Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries,.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located onsite or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved whole disk encryption software to encrypt the hard drive of all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation to workstation communication to limit an attacker's ability to move laterally
and compromise neighboring systems, through technologies such as Private VLANs or
microsegmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located onsite or at a remote service
provider and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (adhoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices (such as Bluetooth and NFC), unless such access is
required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
onsite or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed onsite or
by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor . Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams and impersonation calls.
Train workforce on how to identify and properly store, transfer, archive and destroy sensitive
information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train employees to be able to identify the most common indicators of an incident and be able to
report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.

For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.
Use only standardized and extensively reviewed encryption algorithms.
Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
 Maintain separate environments for production and nonproduction systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that defines roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and ISAC
partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real world threats.
Exercises should test communication channels, decision making, and incident responders technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.
Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, e-mails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Teams results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Security Policies, Plans,

and Procedures Cyber Security Officials Systems Boundaries

Metric 8.1.1 Metric 8.1.2 Metric 8.2.1

s, Routers and Switches
X

X
 Remote Access and
External Connections Least Privilege Rules of Behavior

Metric 8.2.2 Metric 8.2.3 Metric 8.2.4

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X

X
X

X
 Criticality Sensitivity
Password Management Review Unique Accounts

Metric 8.2.5 Metric 8.3.1 Metric 8.3.2

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Third-party Cyber
Separation of Duties Access Control Lists Support

Metric 8.3.3 Metric 8.3.4 Metric 8.3.5

X

X
X

X
 Physical Access to
Cyber Systems and
Information Storage Cyber Security Training Cyber Security Controls
Media

Metric 8.3.6 Metric 8.4.1 Metric 8.5.1

X

X
X
X
X
X
X
X

X
X
X

X
Network Monitoring Incident Response Incident Reporting

Metric 8.5.2 Metric 8.5.3 Metric 8.5.4

X

X
X X

X X

X X

X X

X X

X X

X X

X X
Safety Instrumented
Systems Post-Incident Measures Systems Life Cycle

Metric 8.5.5 Metric 8.6.1 Metric 8.7.1

X

X
X
X
X
X
 X

X
Documenting Business Cyber Asset Network/ System
Needs Identification Architecture

Metric 8.8.1 Metric 8.8.2 Metric 8.8.3

X
X
X

X
 Audits

Metric 8.9.1
X
X
X
X

X
 CIS Controls v7.1 mapped to the Australian Essential Eight

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

 Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to the Australian Essential Eight

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
 Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.
Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Disable untrusted
Application whitelisting Patch applications Microsoft Office macros

1 2 3

X
X
X
X
X

X
X

X
X
X
X
X

X
s, Routers and Switches
User application Restrict administrative Patch operating
hardening privileges systems

4 5 6
 X

X
X
X
X

X
X

X
X
 X

X
X
X

X
 Multi-factor Daily backup of
authentication important data

7 8
X
X

X
X
X

X
X
X
 X
X
X

X
X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
 CIS Controls v7.1 mapped to Australian DSD Top 35: 2014

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4
 System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3
 System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7
 System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6
 System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to Australian DSD Top 35: 2014

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
 The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
 Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

 On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
 Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Patch applications,eg, Java, Patch operating system

Application whitelisting of
PDF viewers, Flash, web vulnerabilities. Patch or
permitted/trusted programs,
browsers and Microsoft Office. mitigate systems with
to prevent execution of
Patch or mitigate systems with 'extreme risk' vulnerabilities
malicious or unapproved
'extreme risk' vulnerabilities within two days. Use the
programs including DLL files,
within two days. Use the latest suitable operating
scripts and installers.
latest version of applications. system. Avoid Windows XP.

1 2 3

X
X
X
X
X

X
X

X X

X X

X X

X X
X X
X X
X X
X X

X X

X X

X X

X X
X

X
X

X
X
 X X
X X
X X
X X
X X

s, Routers and Switches

X X

X X

X X
X X
X X

X X
X X
 Restrict administrative User application configuration Automated dynamic analysis
privileges to operating hardening, disabling the of email and web content run
systems and applications running of internet-based Java in a sandbox to detect
based on user duties. Such code, untrusted Microsoft suspicious behaviour including
users should use a separate Office macros, and undesired network traffic, new or
unprivileged account for email web browser and PDF viewer modified files, or
and web browsing. features. configuration changes.

4 5 6
X
X

X
X
X

X
X
X

X X

X X

X X

X X

X X
X

X
X

X
X
 Operating system generic
Disable local administrator
exploit mitigation Host-based Intrusion
accounts to prevent network
mechanisms, eg, Data Detection/Prevention System
propagation using
Execution Prevention (DEP), to identify anomalous
compromised local
Address Space Layout behaviour such as process
administration credentials
Randomisation (ASLR) and injection, keystroke logging,
that are shared by several
Enhanced Mitigation driver loading and persistence.
computers.
Experience Toolkit (EMET).

7 8 9
X
X

X
X
X

X
X
X
X

X
X
X
X
X
Network segmentation and Multi-factor authentication
Software-based application
segregation into security especially implemented for
firewall, blocking incoming
zones to protect sensitive remote access or when the
network traffic that is
information and critical user is about to perform a
malicious or otherwise
services such as user privileged action or access a
unauthorised, and denying
authentication by Microsoft sensitive information
network traffic by default.
Active Directory. repository.

10 11 12
X
X

X
X
X

X
X
X
 X
X
X
X
X

X
X
X

X
X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X
X
X
X
X
X

X
X
X
X
X
X
Software-based application Centralised and time-
Non-persistent virtualised
firewall, blocking outgoing synchronised logging of
sandboxed trusted operating
network traffic that is not successful and failed
environment, hosted outside
generated by whitelisted computer events with
the organisation's internal
applications, and denying automated immediate log
network, for risk activities
network traffic by default. analysis, storing logs for at
such as web browsing.
least 18 months.

13 14 15

X
X
X
X
X

X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
 Centralised and time- Web content filtering of
Email content filtering
synchronised logging of incoming and outgoing traffic,
allowing only business-related
allowed and blocked network whitelisting allowed types of
attachment types. Preferably
events with automated web content and using
analyse/convert/sanitise links,
immediate log analysis, behavioural analysis, cloud-
PDF and Microsoft Office
storing logs for at least based reputation ratings,
attachments.
18 months. heuristics and signatures.

16 17 18

X
X
X
X
X

X
X
X
X
X
X
X
X
X
X

X X

X X
X X

X X

X X

X X

X X

X X

X X
X X

X
X
X
X
X
X

X
 Block spoofed emails using Workstation and server
Web domain whitelisting for
Sender ID or Sender Policy configuration management
all domains, since this
Framework (SPF) to check based on a hardened Standard
approach is more proactive
incoming emails, and a 'hard Operating Environment with
and thorough than blacklisting
fail' SPF record to help prevent unrequired functionality
a tiny percentage of malicious
spoofing of your disabled e.g. IPv6, autorun
domains.
organisation's domain. and LanMan.

19 20 21
X

X
X X

X X
X X

X X

X X

X X

X X

X X

X X
X X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
 Antivirus software using Deny direct internet access Server application security
heuristics and automated from workstations by using an configuration hardening e.g.
internet-based reputation IPv6-capable firewall to force databases, web applications,
ratings to check a program's traffic through a split DNS customer relationship
prevalence and its digital server, an email server or an management, finance, human
signature's trustworthiness authenticated web proxy resources and other data
prior to execution. server. storage systems.

22 23 24
X

X
X
X
X
X
X

X
X
X

X
X
X
X
X
X

X
 Removable and portable
Enforce a strong passphrase
media control as part of a data Restrict access to Server
policy covering complexity,
loss prevention strategy, Message Block (SMB) and
length and expiry, and
including storage, handling, NetBIOS services running on
avoiding both passphrase re-
whitelisting allowed USB workstations and on servers
use and the use of a single
devices, encryption and where possible.
dictionary word.
destruction.

25 26 27
X
X

X
X
X

X
X
X
X

X
X
X
X
X

X
X
X
X
X
X
X

X
X
X
X

X
X

X
X

X
 X

X
X
X
X
X
X

X
X
X
X
X
X
User education, eg, internet Workstation inspection of Signature-based antivirus
threats and spear-phishing Microsoft Office files for software that primarily relies
socially-engineered emails. potentially malicious on up-to-date signatures to
Avoid weak passphrases, abnormalities, eg, using the identify malware. Use
passphrase re-use, exposing Microsoft Office File gateway and desktop antivirus
email addresses and Validation or Protected View software from different
unapproved USB devices. features. vendors.

28 29 30
X

X
X
X
X
X
X
X

X
X
X

X
TLS encryption between email Block attempts to access web Network-based Intrusion
servers to help prevent sites by their IP address Detection/Prevention System
legitimate emails being instead of by their domain using signatures and heuristics
intercepted and used for name, eg, implemented using to identify anomalous traffic
social engineering. Perform a web proxy server, to force both internally and crossing
content scanning after email cyber adversaries to obtain a network perimeter
traffic is decrypted. domain name. boundaries.

31 32 33
X

X
X

X
X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
 Capture network traffic
Gateway blacklisting to block
to/from internal critical-asset
access to known malicious
workstations and servers, as
domains and IP addresses,
well as traffic traversing the
including dynamic and other
network perimeter, to
domains provided free to
perform post-intrusion
anonymous internet users.
analysis.

34 35
X
X
X
X
X
X
X
X
X

X
 CIS Controls v7.1 mapped to the NSA's Top 10 Information Assurance
Mitigation Strategies

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10
Application 16.11
Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8
Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3
Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to the NSA's Top 10 Information Assurance

Mitigation Strategies

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.
Encrypt or hash with a salt all authentication credentials when stored.
Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.
Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
Automatically disable dormant accounts after a set period of inactivity.
Ensure that all accounts have an expiration date that is monitored and enforced.
Automatically lock workstation sessions after a standard period of inactivity.
 Monitor attempts to access deactivated accounts through audit logging.
Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
 Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.
Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Limit Workstation-to-
Control Administrative
Application Whitelisting Privileges Workstation
Communication

1 2 3

X
X
X
X
X

X
X

X
X

X
X
X

X
X
X
 X
X
X
X
X

s, Routers and Switches

 Implement Host
Use Anti-Virus File Enable Anti-
Reputation Services Exploitation Features Intrusion Prevention
System (HIPS) Rules

4 5 6
X X

X X

X X

X X
X X
X X
X X
X X
 Use Web Domain Name
Set a Secure Baseline Take Advantage of
Configuration System (DNS) Software Improvements
Reputation

7 8 9
X

X
X
X
X
X X

X X

X X

X X

X X
X X

X X
X X

X X

X X

X X

X X

X X

X X
X X
X

X
X
X

X
Segregate Networks
and Functions

10
X

X
X
X

X
X

X
X

X
X

X
X
 CIS Controls v7.1 mapped to Canadian Communications Security
Establishment Top 10 IT Security Actions

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10
Application 16.11
Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8
Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3
Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

S Controls v7.1 mapped to Canadian Communications Security

Establishment Top 10 IT Security Actions

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.
Encrypt or hash with a salt all authentication credentials when stored.
Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.
Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
Automatically disable dormant accounts after a set period of inactivity.
Ensure that all accounts have an expiration date that is monitored and enforced.
Automatically lock workstation sessions after a standard period of inactivity.
 Monitor attempts to access deactivated accounts through audit logging.
Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
 Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.
Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Consolidate, Monitor Patch Operating Enforce the

Management of
and Defend Internet Systems and Administrative
Gateways Applications Privileges

1 2 3
X

X
X
X
X

X
X

X
X
X

X
X
X
s, Routers and Switches
X

X
Harden Operating
Segment and Separate Provide Tailored
Systems and Information Awareness and Training
Applications

4 5 6
X

X
X

X
X

X
X
X
X

X
X

X
X

X
X
X
X

X
X
X

X
Protect Information at Apply Protection at the Isolate Web-Facing
the Enterprise Level Host Level Applications

7 8 9

X
X
X
X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
 X

X X
X X

X X
X X
X X
X X

X X

X X
X X

X X

X X

X X
X X

X X

X X

X X

X X
X X
Implement Application
Whitelisting

10

X
X
X
X
X

X
X
 CIS Controls v7.1 mapped to GCHQ's 10 Steps to CyberSecurity

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

IS Controls v7.1 mapped to GCHQ's 10 Steps to CyberSecurity

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Home & Mobile User Education &

Working Awareness Incident Management

1 2 3
s, Routers and Switches
X

X
X
X

X
X
X

X
X

X
 Information Risk Managing User Removable Media
Management Regime Privileges Controls

4 5 6
X

X
X
X
X
X
X
 X

X
X
X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
Monitoring Secure Configuration Malware Protection

7 8 9
X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
 X

X
X
X

X
X

X
X
X
X
X

X
X
X

X
X
Network Security

10
X
X
X
X
X

X
X
X

X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X
CIS Controls v7.1 mapped to the UK Government's Cyber Essentials Scheme

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

trols v7.1 mapped to the UK Government's Cyber Essentials Scheme

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Boundary firewalls and

internet gateways Secure configuration Access control

1 2 3
X
X

X
X
 X

X
X
X

X
X

X
X

X
X
s, Routers and Switches
X X

X X

X X
X X
X X

X X

X X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
Malware protection Patch management

4 5
X

X
X
X
X
X

X
 X

X
X

X
X

X
X
X
X
X

X
X
X

X
 CIS Controls v7.1 mapped to the UK's Information Commissioner's Office
(ICO) Protecting Personal Data in Online Services

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

 Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ntrols v7.1 mapped to the UK's Information Commissioner's Office

(ICO) Protecting Personal Data in Online Services

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
 Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Software updates SQL injection Unnecessary services

1 2 3
X

X
X
X
X
 X
X
X
X
X

s, Routers and Switches

X

X
X
X

X
Decommissioning of Configuration of SSL
software or services Password storage and TLS

4 5 6

X
X
X
X
X

X
X

X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X
X
X
X
X

X
Inappropriate locations
for processing data Default credentials

7 8
X
X
X

X
X
X

X
X
X

X
X
X
X

X
X
X

X
X

X
X

X
X

X
 CIS Controls v7.1 mapped to PCI DSS 3.1

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2
 System 2.3

System 2.4

System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2
 System 4.3

System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6
 System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5
 System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5
 Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12
Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7
Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7
Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4
Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to PCI DSS 3.1

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
 Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
 Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
 On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

 Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.
 Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.
 Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.
 Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.
 Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Build firewall and router

configurations that restrict Prohibit direct public access
Establish and implement
connections between between the Internet and any
firewall and router
untrusted networks and any system component in the
configuration standards.
system components in the cardholder data environment.
cardholder data environment.

1.1 1.2 1.3

, Routers and Switches
X X

X X

X X
X X
X X
X X

X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X

X
X

X
X

X
 Install personal firewall
software on any mobile
and/or employee-owned Ensure that security policies Always change vendor-
devices that connect to the and operational procedures supplied defaults and remove
Internet when outside the for managing firewalls are or disable unnecessary default
network (for example, laptops documented, in use, and accounts before installing a
used by employees), and known to all affected parties. system on the network.
which are also used to access
the network.

1.4 1.5 2.1

X
X
X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
 Develop configuration Encrypt all non-console
standards for all system administrative access using
components. Assure that strong cryptography. Use
Maintain an inventory of
these standards address all technologies such as SSH,
system components that are
known security vulnerabilities VPN, or SSL/TLS for web-
in scope for PCI DSS.
and are consistent with based management and other
industry-accepted system non-console administrative
hardening standards. access.

2.2 2.3 2.4

X
X
X

X
X
X
X
X
X

X
X
X X

X X

X X

X X

X X
X X

X X
X X

X X

X X

X X

X X

X X

X X
X X
X

X
X
X
X

X
 Ensure that security policies
Keep cardholder data storage
and operational procedures Shared hosting providers must
to a minimum by
for managing vendor defaults protect each entity’s hosted
implementing data retention
and other security parameters environment and cardholder
and disposal policies,
are documented, in use, and data.
procedures and processes.
known to all affected parties.

2.5 2.6 3.1

 Do not store sensitive
Mask PAN when displayed
authentication data after
(the first six and last four
authorization (even if Render PAN unreadable
digits are the maximum
encrypted). If sensitive anywhere it is stored
number of digits to be
authentication data is (including on portable digital
displayed), such that only
received, render all data media, backup media, and in
personnel with a legitimate
unrecoverable upon logs).
business need can see the full
completion of the
PAN.
authorization process.

3.2 3.3 3.4

 Fully document and Ensure that security policies
Document and implement
implement all key- and operational procedures
procedures to protect keys
management processes and for protecting stored
used to secure stored
procedures for cryptographic cardholder data are
cardholder data against
keys used for encryption of documented, in use, and
disclosure and misuse.
cardholder data. known to all affected parties.

3.5 3.6 3.7

X

X
X
X
X

X
X
 Ensure that security policies
Use strong cryptography and Never send unprotected PANs
and operational procedures
security protocols to by end-user messaging
for encrypting transmissions
safeguard sensitive cardholder technologies (for example, e-
of cardholder data are
data during transmission over mail, instant messaging, chat,
documented, in use, and
open, public networks. etc.).
known to all affected parties.

4.1 4.2 4.3

X
X
X

X
X X X

X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X

X
X

X
X

X
X
X
X

X
X
X

X
X
 Ensure that anti-virus
mechanisms are actively
Deploy anti-virus software on
running and cannot be
all systems commonly affected
Ensure that all anti-virus disabled or altered by users,
by malicious software
mechanisms are maintained. unless specifically authorized
(particularly personal
by management on a case-by-
computers and servers).
case basis for a limited time
period.

5.1 5.2 5.3

X X X

X X X

X X X

X X X
X X X
X X X
X X X
X X X
 Establish a process to identify
Ensure that all system
security vulnerabilities, using
Ensure that security policies components and software are
reputable outside sources for
and operational procedures protected from known
security vulnerability
for protecting systems against vulnerabilities by installing
information, and assign a risk
malware are documented, in applicable vendor-supplied
ranking (for example, as
use, and known to all affected security patches. Install critical
“high,” “medium,” or “low”)
parties. security patches within one
to newly discovered security
month of release.
vulnerabilities.

5.4 6.1 6.2

X X

X X

X X

X X
X X
X X
X X
X

X
 X

X
X

X
X

X
X
X
X
X

X
X
X
X

X
 Train developers in secure
Develop internal and external
Follow change control coding techniques, including
software applications
processes and procedures for how to avoid common coding
(including web-based
all changes to system vulnerabilities, and
administrative access to
components. understanding how sensitive
applications) securely.
data is handled in memory.

6.3 6.4 6.5a

X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X
 For public-facing web Ensure that security policies
applications, address new and operational procedures
threats and vulnerabilities on for developing and
Develop applications based on
an ongoing basis and ensure maintaining secure systems
secure coding guidelines.
these applications are and applications are
protected against known documented, in use, and
attacks. known to all affected parties.

6.5b 6.6 6.7

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
 Establish an access control
Ensure that security policies
Limit access to system system for systems
and operational procedures
components and cardholder components that restricts
for restricting access to
data to only those individuals access based on a user’s need
cardholder data are
whose job requires such to know, and is set to “deny
documented, in use, and
access. all” unless specifically
known to all affected parties.
allowed.

7.1 7.2 7.3

X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X

X X X

X X X

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X
Define and implement policies
In addition to assigning a
and procedures to ensure Secure all individual non-
unique ID, ensure proper user-
proper user identification console administrative access
authentication management
management for non- and all remote access to the
for non-consumer users and
consumer users and CDE using multi-factor
administrators on all system
administrators on all system authentication.
components.
components.

8.1 8.2 8.3

X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X

X
 Where other authentication
mechanisms are used (for
Document and communicate Do not use group, shared, or example, physical or logical
authentication procedures and generic IDs, passwords, or security tokens, smart cards,
policies to all users. other authentication methods. certificates, etc.), use of these
mechanisms must be
assigned.

8.4 8.5 8.6

 All access to any database Ensure that security policies
Use appropriate facility entry
containing cardholder data and operational procedures
controls to limit and monitor
(including access by for identification and
physical access to systems in
applications, administrators, authentication are
the cardholder data
and all other users) is documented, in use, and
environment.
restricted. known to all affected parties.

8.7 8.8 9.1

X
X
X
X
X

X
X
X
X

X
X

X
X

X X
X X
X X
X X
X X
X X

X X
X X
X X
X X
X X
X X
X X
Develop procedures to easily Control physical access for
Implement procedures to
distinguish between onsite onsite personnel to the
identify and authorize visitors.
personnel and visitors. sensitive areas.

9.2 9.3 9.4

 Maintain strict control over
Maintain strict control over
the internal or external
Physically secure all media. the storage and accessibility of
distribution of any kind of
media.
media.

9.5 9.6 9.7

X X X
X X X
X X X

X X X

X X X
 Ensure that security policies
Protect devices that capture
and operational procedures
Destroy media when it is no payment card data via direct
for restricting physical access
longer needed for business or physical interaction with the
to cardholder data are
legal reasons. card from tampering and
documented, in use, and
substitution.
known to all affected parties.

9.8 9.9 9.10

 Implement audit trails to link Record at least the following
Implement automated audit
all access to system audit trail entries for all
trails for all system
components to each individual system components for each
components.
user. event.

10.1 10.2 10.3

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
 Using time-synchronization
technology, synchronize all Review logs and security
critical system clocks and events for all system
Secure audit trails so they
times and ensure that the components to identify
cannot be altered.
following is implemented for anomalies or suspicious
acquiring, distributing, and activity.
storing time.

10.4 10.5 10.6

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
Retain audit trail history for at Ensure that security policies
least one year, with a and operational procedures
Implement a process for the
minimum of three months for monitoring all access to
timely detection and reporting
immediately available for network resources and
of failures of critical security
analysis (for example, online, cardholder data are
control systems,
archived, or restorable from documented, in use, and
backup). known to all affected parties.

10.7 10.8 10.9

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
X

X
 Run internal and external
Implement processes to test network vulnerability scans at
for the presence of wireless least quarterly and after any
access points (802.11), and significant change in the
Implement a methodology for
detect and identify all network (such as new system
penetration testing.
authorized and unauthorized component installations,
wireless access points on a changes in network topology,
quarterly basis. firewall rule modifications,
product upgrades).

11.1 11.2 11.3

X

X
X
X
X
X
X
X
X

X
X
X

X
X
X
X
X

X
 Use intrusion-detection
Deploy a change-detection
and/or intrusion-prevention
mechanism (for example, file-
techniques to detect and/or
integrity monitoring tools) to
prevent intrusions into the Ensure that security policies
alert personnel to
network. Monitor all traffic at and operational procedures
unauthorized modification of
the perimeter of the for security monitoring and
critical system files,
cardholder data environment testing are documented, in
configuration files, or content
as well as at critical points in use, and known to all affected
files; and configure the
the cardholder data parties.
software to perform critical
environment, and alert
file comparisons at least
personnel to suspected
weekly.
compromises.

11.4 11.5 11.6

X

X
X

X
X

X
X
X

X
 Develop usage policies for
Establish, publish, maintain,
Implement a risk-assessment critical technologies and
and disseminate a security
process. define proper use of these
policy.
technologies.

12.1 12.2 12.3

Ensure that the security policy Implement a formal security
Assign to an individual or
and procedures clearly define awareness program to make
team the following
information security all personnel aware of the
information security
responsibilities for all importance of cardholder data
management responsibilities.
personnel. security.

12.4 12.5 12.6

X
X

X
X
X

X
 Service providers
acknowledge in writing to
Screen potential personnel customers that they are
Maintain and implement
prior to hire to minimize the responsible for the security of
policies and procedures to
risk of attacks from internal cardholder data the service
manage service providers with
sources. (Examples of provider possesses or
whom cardholder data is
background checks include otherwise stores, processes,
shared, or that could affect
previous employment history, or transmits on behalf of the
the security of cardholder
criminal record, credit history, customer, or to the extent
data.
and reference checks.) that they could impact the
security of the customer’s
cardholder data environment.

12.7 12.8 12.9

 Perform reviews at least
Implement an incident
quarterly to confirm
response plan. Be prepared to
personnel are following
respond immediately to a
security policies and
system breach.
operational procedures.

12.10 12.11
X

X
 CIS Controls v7.1 mapped to PCI DSS 3.1

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2
 System 2.3

System 2.4

System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2
 System 4.3

System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6
 System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5
 System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5
 Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12
Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7
Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7
Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4
Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to PCI DSS 3.1

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
 Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
 Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
 On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

 Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.
 Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.
 Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.
 Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.
 Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Build firewall and router

configurations that restrict Prohibit direct public access
Establish and implement
connections between between the Internet and any
firewall and router
untrusted networks and any system component in the
configuration standards.
system components in the cardholder data environment.
cardholder data environment.

1.1 1.2 1.3

, Routers and Switches
X X

X X

X X
X X
X X
X X

X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X

X
X

X
X

X
 Install personal firewall
software on any mobile
and/or employee-owned Ensure that security policies Always change vendor-
devices that connect to the and operational procedures supplied defaults and remove
Internet when outside the for managing firewalls are or disable unnecessary default
network (for example, laptops documented, in use, and accounts before installing a
used by employees), and known to all affected parties. system on the network.
which are also used to access
the network.

1.4 1.5 2.1

X
X
X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
 Develop configuration Encrypt all non-console
standards for all system administrative access using
components. Assure that strong cryptography. Use
Maintain an inventory of
these standards address all technologies such as SSH,
system components that are
known security vulnerabilities VPN, or SSL/TLS for web-
in scope for PCI DSS.
and are consistent with based management and other
industry-accepted system non-console administrative
hardening standards. access.

2.2 2.3 2.4

X
X
X

X
X
X
X
X
X

X
X
X X

X X

X X

X X

X X
X X

X X
X X

X X

X X

X X

X X

X X

X X
X X
X

X
X
X
X

X
 Ensure that security policies
Keep cardholder data storage
and operational procedures Shared hosting providers must
to a minimum by
for managing vendor defaults protect each entity’s hosted
implementing data retention
and other security parameters environment and cardholder
and disposal policies,
are documented, in use, and data.
procedures and processes.
known to all affected parties.

2.5 2.6 3.1

 Do not store sensitive
Mask PAN when displayed
authentication data after
(the first six and last four
authorization (even if Render PAN unreadable
digits are the maximum
encrypted). If sensitive anywhere it is stored
number of digits to be
authentication data is (including on portable digital
displayed), such that only
received, render all data media, backup media, and in
personnel with a legitimate
unrecoverable upon logs).
business need can see the full
completion of the
PAN.
authorization process.

3.2 3.3 3.4

 Fully document and Ensure that security policies
Document and implement
implement all key- and operational procedures
procedures to protect keys
management processes and for protecting stored
used to secure stored
procedures for cryptographic cardholder data are
cardholder data against
keys used for encryption of documented, in use, and
disclosure and misuse.
cardholder data. known to all affected parties.

3.5 3.6 3.7

X

X
X
X
X

X
X
 Use strong cryptography and
Ensure that security policies
security protocols (for Never send unprotected PANs
and operational procedures
example, TLS, IPSEC, SSH, etc.) by end-user messaging
for encrypting transmissions
to safeguard sensitive technologies (for example, e-
of cardholder data are
cardholder data during mail, instant messaging, chat,
documented, in use, and
transmission over open, public etc.).
known to all affected parties.
networks.

4.1 4.2 4.3

X
X
X

X
X X X

X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X

X
X

X
X

X
X
X
X

X
X
X

X
X
 Ensure that anti-virus
mechanisms are actively
Deploy anti-virus software on
running and cannot be
all systems commonly affected
Ensure that all anti-virus disabled or altered by users,
by malicious software
mechanisms are maintained. unless specifically authorized
(particularly personal
by management on a case-by-
computers and servers).
case basis for a limited time
period.

5.1 5.2 5.3

X X X

X X X

X X X

X X X
X X X
X X X
X X X
X X X
 Establish a process to identify
Ensure that all system
security vulnerabilities, using
Ensure that security policies components and software are
reputable outside sources for
and operational procedures protected from known
security vulnerability
for protecting systems against vulnerabilities by installing
information, and assign a risk
malware are documented, in applicable vendor-supplied
ranking (for example, as
use, and known to all affected security patches. Install critical
“high,” “medium,” or “low”)
parties. security patches within one
to newly discovered security
month of release.
vulnerabilities.

5.4 6.1 6.2

X X

X X

X X

X X
X X
X X
X X
X

X
 X

X
X

X
X

X
X
X
X
X

X
X
X
X

X
 Train developers in secure
Develop internal and external
Follow change control coding techniques, including
software applications
processes and procedures for how to avoid common coding
(including web-based
all changes to system vulnerabilities, and
administrative access to
components. understanding how sensitive
applications) securely.
data is handled in memory.

6.3 6.4 6.5a

X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X
 For public-facing web Ensure that security policies
applications, address new and operational procedures
threats and vulnerabilities on for developing and
Develop applications based on
an ongoing basis and ensure maintaining secure systems
secure coding guidelines.
these applications are and applications are
protected against known documented, in use, and
attacks. known to all affected parties.

6.5b 6.6 6.7

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
 Establish an access control
Ensure that security policies
Limit access to system system for systems
and operational procedures
components and cardholder components that restricts
for restricting access to
data to only those individuals access based on a user’s need
cardholder data are
whose job requires such to know, and is set to “deny
documented, in use, and
access. all” unless specifically
known to all affected parties.
allowed.

7.1 7.2 7.3

X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X

X X X

X X X

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X
 Incorporate two-factor
Define and implement policies authentication for remote
In addition to assigning a
and procedures to ensure network access originating
unique ID, ensure proper user-
proper user identification from outside the network by
authentication management
management for non- personnel (including users and
for non-consumer users and
consumer users and administrators) and all third
administrators on all system
administrators on all system parties, (including vendor
components.
components. access for support or
maintenance).

8.1 8.2 8.3

X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X

X
 Where other authentication
mechanisms are used (for
Document and communicate Do not use group, shared, or example, physical or logical
authentication procedures and generic IDs, passwords, or security tokens, smart cards,
policies to all users. other authentication methods. certificates, etc.), use of these
mechanisms must be
assigned.

8.4 8.5 8.6

 All access to any database Ensure that security policies
Use appropriate facility entry
containing cardholder data and operational procedures
controls to limit and monitor
(including access by for identification and
physical access to systems in
applications, administrators, authentication are
the cardholder data
and all other users) is documented, in use, and
environment.
restricted. known to all affected parties.

8.7 8.8 9.1

X
X
X
X
X

X
X
X
X

X
X

X
X

X X
X X
X X
X X
X X
X X

X X
X X
X X
X X
X X
X X
X X
Develop procedures to easily Control physical access for
Implement procedures to
distinguish between onsite onsite personnel to the
identify and authorize visitors.
personnel and visitors. sensitive areas.

9.2 9.3 9.4

 Maintain strict control over
Maintain strict control over
the internal or external
Physically secure all media. the storage and accessibility of
distribution of any kind of
media.
media.

9.5 9.6 9.7

X X X
X X X
X X X

X X X

X X X
 Ensure that security policies
Protect devices that capture
and operational procedures
Destroy media when it is no payment card data via direct
for restricting physical access
longer needed for business or physical interaction with the
to cardholder data are
legal reasons. card from tampering and
documented, in use, and
substitution.
known to all affected parties.

9.8 9.9 9.10

 Implement audit trails to link Record at least the following
Implement automated audit
all access to system audit trail entries for all
trails for all system
components to each individual system components for each
components.
user. event.

10.1 10.2 10.3

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
 Using time-synchronization
technology, synchronize all Review logs and security
critical system clocks and events for all system
Secure audit trails so they
times and ensure that the components to identify
cannot be altered.
following is implemented for anomalies or suspicious
acquiring, distributing, and activity.
storing time.

10.4 10.5 10.6

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
Retain audit trail history for at Ensure that security policies Implement processes to test
least one year, with a and operational procedures for the presence of wireless
minimum of three months for monitoring all access to access points (802.11), and
immediately available for network resources and detect and identify all
analysis (for example, online, cardholder data are authorized and unauthorized
archived, or restorable from documented, in use, and wireless access points on a
backup). known to all affected parties. quarterly basis.

10.7 10.8 11.1

X
X
X
X
X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
 Use intrusion-detection
and/or intrusion-prevention
Run internal and external
techniques to detect and/or
network vulnerability scans at
prevent intrusions into the
least quarterly and after any
network. Monitor all traffic at
significant change in the
Implement a methodology for the perimeter of the
network (such as new system
penetration testing. cardholder data environment
component installations,
as well as at critical points in
changes in network topology,
the cardholder data
firewall rule modifications,
environment, and alert
product upgrades).
personnel to suspected
compromises.

11.2 11.3 11.4

X

X
X
X
X
X

X
X
X
X

X
 Deploy a change-detection
mechanism (for example, file-
integrity monitoring tools) to
Ensure that security policies
alert personnel to
and operational procedures
unauthorized modification of Establish, publish, maintain,
for security monitoring and
critical system files, and disseminate a security
testing are documented, in
configuration files, or content policy.
use, and known to all affected
files; and configure the
parties.
software to perform critical
file comparisons at least
weekly.

11.5 11.6 12.1

X

X
X

X
X

X
X
 Ensure that the security policy
Develop usage policies for
and procedures clearly define
Implement a risk-assessment critical technologies and
information security
process. define proper use of these
responsibilities for all
technologies.
personnel.

12.2 12.3 12.4

 Screen potential personnel
prior to hire to minimize the
Implement a formal security
Assign to an individual or risk of attacks from internal
awareness program to make
team the following sources. (Examples of
all personnel aware of the
information security background checks include
importance of cardholder data
management responsibilities. previous employment history,
security.
criminal record, credit history,
and reference checks.)

12.5 12.6 12.7

X
X

X
X
X

X
 Service providers
acknowledge in writing to
customers that they are
Maintain and implement
responsible for the security of
policies and procedures to
cardholder data the service Implement an incident
manage service providers with
provider possesses or response plan. Be prepared to
whom cardholder data is
otherwise stores, processes, respond immediately to a
shared, or that could affect
or transmits on behalf of the system breach.
the security of cardholder
customer, or to the extent
data.
that they could impact the
security of the customer’s
cardholder data environment.

12.8 12.9 12.10

X

X
 CIS Controls v7.1 mapped to PCI DSS 3.0

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2
 System 2.3

System 2.4

System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2
 System 4.3

System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6
 System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5
 System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5
 Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12
Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7
Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7
Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4
Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to PCI DSS 3.0

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
 Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
 Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
 On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

 Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.
 Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.
 Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.
 Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.
 Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Build firewall and router

configurations that restrict Prohibit direct public access
Establish and implement
connections between between the Internet and any
firewall and router
untrusted networks and any system component in the
configuration standards.
system components in the cardholder data environment.
cardholder data environment.

1.1 1.2 1.3

s, Routers and Switches
X X

X X

X X
X X
X X
X X

X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X

X
X

X
X

X
 Install personal firewall
software on any mobile
and/or employee-owned Ensure that security policies Always change vendor-
devices that connect to the and operational procedures supplied defaults and remove
Internet when outside the for managing firewalls are or disable unnecessary default
network (for example, laptops documented, in use, and accounts before installing a
used by employees), and known to all affected parties. system on the network.
which are also used to access
the network.

1.4 1.5 2.1

X
X
X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
 Develop configuration Encrypt all non-console
standards for all system administrative access using
components. Assure that strong cryptography. Use
Maintain an inventory of
these standards address all technologies such as SSH,
system components that are
known security vulnerabilities VPN, or SSL/TLS for web-
in scope for PCI DSS.
and are consistent with based management and other
industry-accepted system non-console administrative
hardening standards. access.

2.2 2.3 2.4

X
X
X

X
X
X
X
X
X

X
X
X X

X X

X X

X X

X X
X X

X X
X X

X X

X X

X X

X X

X X

X X
X X
X

X
X
X
X

X
 Ensure that security policies
Keep cardholder data storage
and operational procedures Shared hosting providers must
to a minimum by
for managing vendor defaults protect each entity’s hosted
implementing data retention
and other security parameters environment and cardholder
and disposal policies,
are documented, in use, and data.
procedures and processes.
known to all affected parties.

2.5 2.6 3.1

 Do not store sensitive
Mask PAN when displayed
authentication data after
(the first six and last four
authorization (even if Render PAN unreadable
digits are the maximum
encrypted). If sensitive anywhere it is stored
number of digits to be
authentication data is (including on portable digital
displayed), such that only
received, render all data media, backup media, and in
personnel with a legitimate
unrecoverable upon logs).
business need can see the full
completion of the
PAN.
authorization process.

3.2 3.3 3.4

 Fully document and Ensure that security policies
Document and implement
implement all key- and operational procedures
procedures to protect keys
management processes and for protecting stored
used to secure stored
procedures for cryptographic cardholder data are
cardholder data against
keys used for encryption of documented, in use, and
disclosure and misuse.
cardholder data. known to all affected parties.

3.5 3.6 3.7

X

X
X
X
X

X
X
 Use strong cryptography and
Ensure that security policies
security protocols (for Never send unprotected PANs
and operational procedures
example, SSL/TLS, IPSEC, SSH, by end-user messaging
for encrypting transmissions
etc.) to safeguard sensitive technologies (for example, e-
of cardholder data are
cardholder data during mail, instant messaging, chat,
documented, in use, and
transmission over open, public etc.).
known to all affected parties.
networks.

4.1 4.2 4.3

X
X
X

X
X X X

X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X

X
X

X
X

X
X
X
X

X
X
X

X
X
 Ensure that anti-virus
mechanisms are actively
Deploy anti-virus software on
running and cannot be
all systems commonly affected
Ensure that all anti-virus disabled or altered by users,
by malicious software
mechanisms are maintained. unless specifically authorized
(particularly personal
by management on a case-by-
computers and servers).
case basis for a limited time
period.

5.1 5.2 5.3

X X X

X X X

X X X

X X X
X X X
X X X
X X X
X X X
 Establish a process to identify
Ensure that all system
security vulnerabilities, using
Ensure that security policies components and software are
reputable outside sources for
and operational procedures protected from known
security vulnerability
for protecting systems against vulnerabilities by installing
information, and assign a risk
malware are documented, in applicable vendor-supplied
ranking (for example, as
use, and known to all affected security patches. Install critical
“high,” “medium,” or “low”)
parties. security patches within one
to newly discovered security
month of release.
vulnerabilities.

5.4 6.1 6.2

X X

X X

X X

X X
X X
X X
X X
X

X
 X

X
X

X
X

X
X
X
X
X

X
X
X
X

X
 Train developers in secure
Develop internal and external
Follow change control coding techniques, including
software applications
processes and procedures for how to avoid common coding
(including web-based
all changes to system vulnerabilities, and
administrative access to
components. understanding how sensitive
applications) securely.
data is handled in memory.

6.3 6.4 6.5a

X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X
 For public-facing web Ensure that security policies
applications, address new and operational procedures
threats and vulnerabilities on for developing and
Develop applications based on
an ongoing basis and ensure maintaining secure systems
secure coding guidelines.
these applications are and applications are
protected against known documented, in use, and
attacks. known to all affected parties.

6.5b 6.6 6.7

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
 Establish an access control
Ensure that security policies
Limit access to system system for systems
and operational procedures
components and cardholder components that restricts
for restricting access to
data to only those individuals access based on a user’s need
cardholder data are
whose job requires such to know, and is set to “deny
documented, in use, and
access. all” unless specifically
known to all affected parties.
allowed.

7.1 7.2 7.3

X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X

X X X

X X X

X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X
 Incorporate two-factor
Define and implement policies authentication for remote
In addition to assigning a
and procedures to ensure network access originating
unique ID, ensure proper user-
proper user identification from outside the network by
authentication management
management for non- personnel (including users and
for non-consumer users and
consumer users and administrators) and all third
administrators on all system
administrators on all system parties, (including vendor
components.
components. access for support or
maintenance).

8.1 8.2 8.3

X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X

X
 Where other authentication
mechanisms are used (for
Document and communicate Do not use group, shared, or example, physical or logical
authentication procedures and generic IDs, passwords, or security tokens, smart cards,
policies to all users. other authentication methods. certificates, etc.), use of these
mechanisms must be
assigned.

8.4 8.5 8.6

 All access to any database Ensure that security policies
Use appropriate facility entry
containing cardholder data and operational procedures
controls to limit and monitor
(including access by for identification and
physical access to systems in
applications, administrators, authentication are
the cardholder data
and all other users) is documented, in use, and
environment.
restricted. known to all affected parties.

8.7 8.8 9.1

X
X
X
X
X

X
X
X
X

X
X

X
X

X X
X X
X X
X X
X X
X X

X X
X X
X X
X X
X X
X X
X X
Develop procedures to easily Control physical access for
Implement procedures to
distinguish between onsite onsite personnel to the
identify and authorize visitors.
personnel and visitors. sensitive areas.

9.2 9.3 9.4

 Maintain strict control over
Maintain strict control over
the internal or external
Physically secure all media. the storage and accessibility of
distribution of any kind of
media.
media.

9.5 9.6 9.7

X X X
X X X
X X X

X X X

X X X
 Ensure that security policies
Protect devices that capture
and operational procedures
Destroy media when it is no payment card data via direct
for restricting physical access
longer needed for business or physical interaction with the
to cardholder data are
legal reasons. card from tampering and
documented, in use, and
substitution.
known to all affected parties.

9.8 9.9 9.10

 Implement audit trails to link Record at least the following
Implement automated audit
all access to system audit trail entries for all
trails for all system
components to each individual system components for each
components.
user. event.

10.1 10.2 10.3

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
 Using time-synchronization
technology, synchronize all Review logs and security
critical system clocks and events for all system
Secure audit trails so they
times and ensure that the components to identify
cannot be altered.
following is implemented for anomalies or suspicious
acquiring, distributing, and activity.
storing time.

10.4 10.5 10.6

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
Retain audit trail history for at Ensure that security policies Implement processes to test
least one year, with a and operational procedures for the presence of wireless
minimum of three months for monitoring all access to access points (802.11), and
immediately available for network resources and detect and identify all
analysis (for example, online, cardholder data are authorized and unauthorized
archived, or restorable from documented, in use, and wireless access points on a
backup). known to all affected parties. quarterly basis.

10.7 10.8 11.1

X
X
X
X
X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
 Use intrusion-detection
and/or intrusion-prevention
Run internal and external
techniques to detect and/or
network vulnerability scans at
prevent intrusions into the
least quarterly and after any
network. Monitor all traffic at
significant change in the
Implement a methodology for the perimeter of the
network (such as new system
penetration testing. cardholder data environment
component installations,
as well as at critical points in
changes in network topology,
the cardholder data
firewall rule modifications,
environment, and alert
product upgrades).
personnel to suspected
compromises.

11.2 11.3 11.4

X

X
X
X
X
X

X
X
X
X

X
 Deploy a change-detection
mechanism (for example, file-
integrity monitoring tools) to
Ensure that security policies
alert personnel to
and operational procedures
unauthorized modification of Establish, publish, maintain,
for security monitoring and
critical system files, and disseminate a security
testing are documented, in
configuration files, or content policy.
use, and known to all affected
files; and configure the
parties.
software to perform critical
file comparisons at least
weekly.

11.5 11.6 12.1

X

X
X

X
X

X
X
 Ensure that the security policy
Develop usage policies for
and procedures clearly define
Implement a risk-assessment critical technologies and
information security
process. define proper use of these
responsibilities for all
technologies.
personnel.

12.2 12.3 12.4

 Screen potential personnel
prior to hire to minimize the
Implement a formal security
Assign to an individual or risk of attacks from internal
awareness program to make
team the following sources. (Examples of
all personnel aware of the
information security background checks include
importance of cardholder data
management responsibilities. previous employment history,
security.
criminal record, credit history,
and reference checks.)

12.5 12.6 12.7

X
X

X
X
X

X
 Service providers
acknowledge in writing to
customers that they are
Maintain and implement
responsible for the security of
policies and procedures to
cardholder data the service Implement an incident
manage service providers with
provider possesses or response plan. Be prepared to
whom cardholder data is
otherwise stores, processes, respond immediately to a
shared, or that could affect
or transmits on behalf of the system breach.
the security of cardholder
customer, or to the extent
data.
that they could impact the
security of the customer’s
cardholder data environment.

12.8 12.9 12.10

X

X
 CIS Controls v7.1 mapped to HIPAA

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to HIPAA

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Security Management Security Management

Security Management
Process - Risk Analysis R Process - Risk Process - Sanctions
Management R Policy R

164.308(a)(1) 164.308(a)(1) 164.308(a)(1)

s, Routers and Switches
 Security Management Workforce Security -
Process - Information Assigned Security
System Activity Review Responsibility - R Authorization and/or
R Supervision A

164.308(a)(1) 164.308(a)(2) 164.308(a)(3)

X
X
X
X
X
X
X
X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
 Information Access
Workforce Security - Workforce Security - Management - Isolating
Workforce Clearance Termination Procedures Health care
Procedure A A Clearinghouse Function
R

164.308(a)(3) 164.308(a)(3) 164.308(a)(4)

X

X
X
X
X
X

X
X

X
X

X
 Information Access Information Access Security Awareness and
Management - Access
Management - Access Establishment and Training - Security
Authorization A Modification A Reminders A

164.308(a)(4) 164.308(a)(4) 164.308(a)(5)

X

X
X

X
X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X

X
X

X
X
X

X
Security Awareness and Security Awareness and Security Awareness and
Training - Protection
from Malicious Training - Log-in Training - Password
Software A Monitoring A Management A

164.308(a)(5) 164.308(a)(5) 164.308(a)(5)

X
X
X
X
X
X
X
X
X

X
X
X
X
X
X
X
X
X
X
X

X
X
X
X
X
 X

X X X
X X X

X X X

X X X

X X X
X X X
X X X

X X X

X X X
 Security Incident Contingency Plan -
Contingency Plan - Data
Procedures - Response Backup Plan R Disaster Recovery Plan
and Reporting R R

164.308(a)(6) 164.308(a)(7) 164.308(a)(7)

X X
X X
X X

X X

X X
X

X
Contingency Plan - Contingency Plan - Contingency Plan -
Emergency Mode Testing and Revision Applications and Data
Operation Plan R Procedure A Criticality Analysis A

164.308(a)(7) 164.308(a)(7) 164.308(a)(7)

X
X
X

X
 Business Associate
Contracts and Other Facility Access Controls
Evaluation R Arrangement - Written - Contingency
Contract or Other Operations A
Arrangement R

164.308(a)(8) 164.308(b)(1) 164.310(a)(1)

 Facility Access Controls Facility Access Controls
Facility Access Controls
- Facility Security Plan A - Access Control and - Maintenance Records
Validation Procedures A A

164.310(a)(1) 164.310(a)(1) 164.310(a)(1)

 Workstation Security - Device and Media
Workstation Use - R R Controls - Disposal R

164.310(b) 164.310(c) 164.310(d)(1)

X X
X X
X X

X X

X X

X X

X X

X X

X X

X X

X X
X X
X X
X X
X X

X X

X X
X X

X X

X X

X X

X X
X X
X X
X X

X X
X X

X X
X X
X X

X X

X X
X X
X X

X X

X X

X X

X X

X X
X X

X X
X X

X X

X X

X X

X X

X X

X X
X X

X X

X X

X X

X X
X X
X X
X X
X X

X X
X X
X X
X X
X X
 Device and Media Device and Media Device and Media
Controls - Media Re-use Controls - Controls - Data Backup
R Accountability A and Storage A

164.310(d)(1) 164.310(d)(1) 164.310(d)(1)

X

X
X
X
X
X

X
X
X

X
X

X
X
X
X
X

X
X
 Access Control -
Access Control - Unique Access Control -
User Identification R Emergency Access Automatic Logoff A
Procedure R

164.312(a)(1) 164.312(a)(1) 164.312(a)(1)

X

X
X

X
X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
Access Control - Integrity - Mechanism
to Authenticate
Encryption and Audit Controls - R Electronic Protected
Decryption A Health Information A

164.312(a)(1) 164.312(b) 164.312(c)(1)

X

X
X
X
X
X

X
X

X X

X X

X X
X X

X X

X X

X X

X X

X X
 Person or Entity Transmission Security - Transmission Security -
Authentication - R Integrity Controls A Encryption A

164.312(d) 164.312(e)(1) 164.312(e)(1)

X X

X X
 X X
X X
X X
X X

X X

X X
X X

X X X

X X X

X X X
X X X

X X X

X X X

X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
CIS Controls v7.1 mapped to the FFIEC's Information Security Booklet 2016

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

trols v7.1 mapped to the FFIEC's Information Security Booklet 2016

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Policies, Standards, and

Procedures Technology Design Control Types

II.C.1 II.C.2 II.C.3

, Routers and Switches
 Inventory and Mitigating
Control Implementation Classification of Assets Interconnectivity Risk

II.C.4 II.C.5 II.C.6

X
X
X

X
X

X
User Security Controls Physical Security Network Controls

II.C.7 II.C.8 II.C.9

X
X
X
X
X

X
X
X

X
X

X
 X

X
X
X
X

X
X

X X

X X

X X
X X

X X

X X

X X

X X
X X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
Change Management
End-of-Life
Within the IT Management Malware Mitigation
Environment

II.C.10 II.C.11 II.C.12

X

X
X
X
X
X
X
X

X
X
X
X
X
X

X
Control of Information Supply Chain Logical Security

II.C.13 II.C.14 II.C.15

X X

X X

X X
X X

X X

X X

X X

X X
X X
Customer Remote
Access to Financial Application Security Database Security
Services

II.C.16 II.C.17 II.C.18

X

X
X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X
 Oversight of Third-Party Business Continuity
Encryption Service Providers Considerations

II.C.19 II.C.20 II.C.21

X
X
X

X
X

X
X

X
X
X
X

X
X
X
X
X
X

X
Log Management

II.C.22
X
X
X
X
X
X
X
X
 CIS Controls v7.1 mapped to the FFIEC Examination Handbook (2006)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to the FFIEC Examination Handbook (2006)

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Authentication and
Access Controls Network Security Host Security

A B C
X
X
X

X
X
X
 X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X

X
X

X
X

X
X
X
X
 X

X
X
X
X
X

s, Routers and Switches

X

X
X
X

X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X
X
X
X

X
 User Equipment
Security (Workstation, Physical Security Personnel Security
Laptop, Handheld)

D E F
X
X
X

X
X
X
X
X

X
X

X
X
X
X
X

X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X

X
 Software Development Business Continuity -
Application Security & Acquisition Security

G H I
X
X

X
X
X
X
X
X

X
 Service Provider
Oversight - Security Encryption Data Security

J K L
X
X
X

X
X X
X X

X X
X X
X X
X X

X X

X X
X X

X X

X X

X X
X X

X X

X X

X X

X X
X X

X X
X X
X X
X X

X X
X X
X X

X X

X X
X X
Security Monitoring

M
X
X
X
X
X
X
X
X
X

X
 CIS Controls v7.1 mapped to the FFIEC's Cybersecurity Assessment Tool
(CAT)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to the FFIEC's Cybersecurity Assessment Tool

(CAT)

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Domain 1: Cyber Risk Domain 1: Cyber Risk Domain 1: Cyber Risk

Management &
Management & Oversight - Risk Management &
Oversight - Governance Management Oversight - Resources
s, Routers and Switches
 Domain 2: Threat
Domain 1: Cyber Risk Domain 2: Threat Intelligence &
Management & Intelligence &
Oversight - Training and Collaboration - Threat Collaboration -
Culture Intelligence Monitoring and
Analyzing
X
X
X
X
X
X
X
X
X

X
X
X
X
X
X

X
X
X

X
X
X

X
 Domain 2: Threat Domain 3: Domain 3:
Intelligence &
Collaboration - Cybersecurity Controls - Cybersecurity Controls -
Information Sharing Preventative Controls Detective Controls

X X
X X
X X

X X

X X

X X

X X

X X

X X

X X

X X
X X
X X
X X
X X

X X

X X
X X

X X

X X

X X

X X
X X
X X
X X

X X
X X

X X
X X
X X

X X

X X
X X
X X

X X

X X

X X

X X

X X

X
X
X
X
X
X
X
X
X X

X X
X X

X X

X X

X X

X X

X X

X X
X X

X X

X X

X X

X X
X X
X X
X X
X X

X X
X X
X X
X X
X X

X
X
X

X X

X X

X X
X X
X X

X X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X X

X X
X X
X X
X X

X X

X X
X X

X X

X X

X X
X X

X X

X X

X X

X X
X X

X X
X X
X X
X X

X X
X X
X X

X X

X X
X X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X

X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X

X
 Domain 4: External
Domain 3: Domain 4: External Dependency
Dependency
Cybersecurity Controls - Management - Management -
Corrective Controls Connections Relationship
Management
 Domain 5: Cyber Domain 5: Cyber Domain 5: Cyber
Incident Management Incident Management Incident Management
and Resilience - and Resilience - and Resilience -
Incident Resilience Detection, Response, Escalation and
Planning and Strategy and Mitigation Reporting
X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
 CIS Controls v7.1 mapped to COBIT 5

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to COBIT 5

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation

Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Ensure Governance
Ensure Benefits Ensure Risk
Framework Setting and Delivery Optimisation
Maintenance

EDM01 EDM02 EDM03

s, Routers and Switches
 Manage the IT
Ensure Resource Ensure Stakeholder
Optimisation Transparency Management
Framework

EDM04 EDM05 APO01

 Manage Enterprise
Manage Strategy Architecture Manage Innovation

APO02 APO03 APO04

 Manage Budget and Manage Human
Manage Portfolio Costs Resources

APO05 APO06 APO07

 Manage Service
Manage Relationships Agreements Manage Suppliers

APO08 APO09 APO10

Manage Quality Manage Risk Manage Security

APO11 APO12 APO13

X
X
X

X
X
X
X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
X

X
X

X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X

X
Manage Programmes Manage Requirements Manage Solutions
and Projects Definition Identification and Build

BAI01 BAI02 BAI03

Manage Availability and Manage Organisational
Capacity Change Enablement Manage Changes

BAI04 BAI05 BAI06

Manage Change
Acceptance and Manage Knowledge Manage Assets
Transitioning

BAI07 BAI08 BAI09

X
X
X

X
 Manage Service
Manage Configuration Manage Operations Requests and Incidents

BAI10 DSS01 DSS02

X

X
X
X
X
X

X
X

X
X

X
X
X

X
X
X

X
X
X

X
 Manage Security
Manage Problems Manage Continuity Services

DSS03 DSS04 DSS05

X
X
X

X
X
X
X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
X

X
X

X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X

X
 Monitor, Evaluate and Monitor, Evaluate and
Manage Business
Process Controls Assess Performance Assess the System of
and Conformance Internal Control

DSS06 MEA01 MEA02

X
X
X

X
 Monitor, Evaluate and
Assess Compliance with
External Requirements

MEA03
 CIS Controls v7.1 mapped to the AICPA's Trust Services Criteria (2017) for
SOC2 & SOC3 Assessments

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ntrols v7.1 mapped to the AICPA's Trust Services Criteria (2017) for
SOC2 & SOC3 Assessments

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Control Environment

CC 1.1 CC 1.2 CC 1.3

, Routers and Switches
onment Comunication and Informa

CC 1.4 CC 1.5 CC 2.1

Comunication and Information Risk Assessment

CC 2.2 CC 2.3 CC 3.1

Risk Assessment Monitoring Activities

CC 3.2 CC 3.3 CC 4.1

Monitoring Activities Control Activities

CC 4.2 CC 5.1 CC 5.2

vities

CC 5.3 CC 6.1 CC 6.2

X
X
X

X
X
X
X
X

X
X

X X
X X

X X
X X
X X

X X

X X
X X
X X
X

X
X

X
X
X
X

X
X

X X

X X

X X
X X

X X

X X

X X

X X
X X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Logical and Physical Access Controls

CC 6.3 CC 6.4 CC 6.5

X
X

X
X
X

X
X
X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
ols

CC 6.6 CC 6.7 CC 6.8

X
X
X
 X
X

X
X

X X
X X

X X
X X
X X

X X

X X
X X
X X
X

X
X
X
X
X
X X

X X

X X
X X

X X

X X

X X

X X
X X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 System Operations

CC 7.1 CC 7.2 CC 7.3

X

X
X
X
X
X

X
ations Change Management

CC 7.4 CC 7.5 CC 8.1

X X

X X

X X

X X

X X

X X

X X

X X
 Risk Mitigation Additional Criteria for Availa

CC 9.1 CC 9.2 A 1.1

Additional Criteria for Availability Additional Criteria for Confidentiality

A 1.2 A 1.3 C 1.1

l Criteria for Confidentiality Additional Criteria for Processin

C 1.2 PI 1.1 PI 1.2

Additional Criteria for Processing Integrity

PI 1.3 PI 1.4 PI 1.5

 Additional Cri

P 1.0 P 2.0 P 3.0

Additional Criteria for Privacy

P 4.0 P 5.0 P 6.0

P 7.0 P 8.0
 CIS Controls v7.1 mapped to the AICPA's Trust Services Principles and
Criteria for SOC2 & SOC3 Assessments

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to the AICPA's Trust Services Principles and

Criteria for SOC2 & SOC3 Assessments

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Common Criteria Related to Organization and Management

CC 1.1 CC 1.2 CC 1.3

, Routers and Switches
Management Common Criteria Rela

CC 1.4 CC 2.1 CC 2.2

X X
X X

X X

X X

X X
X X
X X

X X

X X
Common Criteria Related to Communications

CC 2.3 CC 2.4 CC 2.5

X X X
X X X

X X X

X X X

X X X
X X X
X X X

X X X

X X X
 Common Criteria Related to Risk Management and Design and
Implementation of Controls

CC 2.6 CC 3.1 CC 3.2

X
X

X
X
X

X
 Common Criteria
Management and Design and
of Controls Related to Monitoring
of Controls

CC 3.3 CC 4.1 CC 5.1

X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X
X
X
X
X
 Common Criteria Related to Logical and Physical Access

CC 5.2 CC 5.3 CC 5.4

X X X
X X X

X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
ed to Logical and Physical Access Controls

CC 5.5 CC 5.6 CC 5.7

X X
X X

X X
X X
X X

X X

X X
X X
X X
X

X
X

X
X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Common Criteria Related to System Operations

CC 5.8 CC 6.1 CC 6.2

X

X
X
X
X
X

X
X
X
X
X
X

X
 Common Criteria Related to Change Management

CC 7.1 CC 7.2 CC 7.3

nagement Additional Criteria for Availability

CC 7.4 A 1.1 A 1.2

X
X
X

X
or Availability Additional Criteria fo

A 1.3 PI 1.1 PI 1.2

Additional Criteria for Processing Integrity

PI 1.3 PI 1.4 PI 1.5

 Additional Criteri

PI 1.6 C 1.1 C 1.2

X

X
X

X
Additional Criteria for Confidentiality

C 1.3 C 1.4 C 1.5

X

X
X

X
C 1.6
 CIS Controls v7.1 mapped to the AICPA's Generally Accepted Privacy
Policies (GAPP)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

Controls v7.1 mapped to the AICPA's Generally Accepted Privacy

Policies (GAPP)

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Responsibility and
Communication to
Privacy Policies Internal Personnel Accountability for
Policies

1.1.0 1.1.1 1.1.2

, Routers and Switches
 Consistency of Privacy Personal Information
Policies and Procedures
Review and Approval With Laws and Identification and
Regulations Classification

1.2.1 1.2.2 1.2.3

 Consistency of
Commitments With Infrastructure and
Risk Assessment Privacy Policies and Systems Management
Procedures

1.2.4 1.2.5 1.2.6

Privacy Incident and Qualifications of
Breach Management Supporting Resources Internal Personnel

1.2.7 1.2.8 1.2.9

X
X

X
X
X

X
 Changes in Regulatory
Privacy Awareness and
Training and Business Privacy Policies
Requirements

1.2.10 1.2.11 2.1.0

X
X

X
X
X

X
Communication to Entities and Activities
Individuals Provision of Notice Covered

2.1.1 2.2.1 2.2.2

 Communication to
Clear and Conspicuous Privacy Policies Individuals

2.2.3 3.1.0 3.1.1

 Consequences of
Implicit or Explicit Consent for New
Denying or Consent Purposes and Uses
Withdrawing Consent

3.1.2 3.2.1 3.2.2

 Consent for Online Data
Transfers To or From an
Explicit Consent for
Sensitive Information Individual’s Computer Privacy Policies
or Other Similar
Electronic Devices

3.2.3 3.2.4 4.1.0

 Types of Personal
Communication to Information Collected Collection Limited to
Individuals and Methods of Identified Purpose
Collection

4.1.1 4.1.2 4.1.3

Collection by Fair and Collection From Third Information Developed
Lawful Means Parties about Individuals

4.1.4 4.1.5 4.1.6

 Communication to Use of Personal
Privacy Policies Individuals Information

5.1.0 5.1.1 5.2.1

 Disposal, Destruction
Retention of Personal
Information and Redaction of Privacy Policies
Personal Information

5.2.2 5.2.3 6.1.0

 Access by Individuals to
Communication to Confirmation of an
Individuals Their Personal Individual’s Identity
Information

6.1.1 6.2.1 6.2.2

 Understandable
Updating or Correcting
Personal Information, Denial of Access Personal Information
Time Frame, and Cost

6.2.3 6.2.4 6.2.5

Statement of Communication to
Disagreement Privacy Policies Individuals

6.2.6 7.1.0 7.1.1

Communication to Disclosure of Personal Protection of Personal
Third Parties Information Information

7.1.2 7.2.1 7.2.2

X
X
X

X
X
X
X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
X

X
X

X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X

X
 Misuse of Personal
New Purposes and Uses Information by a Third Privacy Policies
Party

7.2.3 7.2.4 8.1.0

Communication to Information Security
Individuals Program Logical Access Controls

8.1.1 8.2.1 8.2.2

X X
X X
X X

X X

X X

X X

X X

X X

X
X
X
X
X

X
X

X
X
X
X

X X
X X

X X
X X
X X

X X

X X
X X
X X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
X

X
X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X X

X X
X X
X X
X X

X X

X X
X X

X X

X X

X X
X X

X X

X X

X X

X X
X X

X X
X X
X X
X X

X X
X X
X X

X X

X X
X X

X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X

X
 Environmental Transmitted Personal
Physical Access Controls Safeguards Information

8.2.3 8.2.4 8.2.5

Personal Information Testing Security
on Portable Media Safeguards Privacy Policies

8.2.6 8.2.7 9.1.0

X
X

X
X
X
X

X
X

X
X

X
X
X
X
X

X
 Accuracy and
Communication to Relevance of Personal
Individuals Completeness of Information
Personal Information

9.1.1 9.2.1 9.2.2

 Communication to Inquiry, Complaint, and
Privacy Policies Individuals Dispute Process

10.1.0 10.1.1 10.2.1

Dispute Resolution and Instances of
Recourse Compliance Review Noncompliance

10.2.2 10.2.3 10.2.4

Ongoing Monitoring

10.2.5
 CIS Controls v7.1 mapped to the US Internal Revenue Service (IRS)
Publication 1075

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

Controls v7.1 mapped to the US Internal Revenue Service (IRS)

Publication 1075

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Record Keeping Secure Storage Restricting Access

3.0 4.0 5.0

s, Routers and Switches
X X

X X

X X
X X

X X

X X

X X

X X
X X
 Reporting
Other SafeGuards Requirements Disposing of FTI

6.1 7.0 8.0

X

X
X

X
X
X
X

X
X
X

X
 Audit and
Access Control Awareness and Training Accountability

9.3.1 9.3.2 9.3.3

X
X
X
X
X
X
X
X
X

X
X

X
X
X
X

X
X
X

X
X
X
X

X
Security Assessment Configuration
and Authorization Management Contingency Planning

9.3.4 9.3.5 9.3.6

X

X
X
X
X
X

X
 X
X
X

X
X
X

X
X
Identification and
Authentication Incident Response Maintenance

9.3.7 9.3.8 9.3.9

X
X

X
X
X

X
X
X
X

X
X
X

X
X
X
X
X
X
X
X

X
X
X
X
X
X
X

X
 Physical and
Media Protection Environmental Planning
Protection

9.3.10 9.3.11 9.3.12

X
X

X
X
X
X

X
X
 System and Service
Personnel Security Risk Assessment Acquisition

9.3.13 9.3.14 9.3.15

X
X
X
X
X
X

X
X
X
X
X
X
 System and
System and Information
Communication Integrity Program Management
Protection

9.3.16 9.3.17 9.3.18

X

X
X

X
X

X
X
X
X
X
X

X
X

X
X

X
X
Cloud Computing
Environments Data Warehouse Email Communications

9.4.1 9.4.2 9.4.3

X

X
X

X
X
 Integrated Voice
Fax Equipment Response Systems Live Data Testing

9.4.4 9.4.5 9.4.6

 Multi-Functional
Media Sanitization Mobile Devices Devices

9.4.7 9.4.8 9.4.9

 System Component
Network Protections Storage Area Networks Inventory

9.4.10 9.4.11 9.4.12

X
X
X

X
X
X
X
X

X
X
X

X
X
X

X
X

X
X

X
X
X
X

X
X

X
X

X
X
Virtual Desktop Virtualization
Infrastructure Environments VoIP Systems

9.4.13 9.4.14 9.4.15

Web-Based Systems Web Browser Wireless Networks

9.4.16 9.4.17 9.4.18

X X

X X
X X

X X

X X

X X

X X

X X

X X
X X
X
X
X
X

X
X
X

X
X
Reporting Improper
Disclosure to Other Return Information in
Inspections or Persons Statistical Reports
Disclosurers

10.0 11.0 12.0

CIS Controls v7.1 mapped to SWIFT Customer Security Controls Framework

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

trols v7.1 mapped to SWIFT Customer Security Controls Framework

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Overall design goals for

SWIFT Environment implementing Scope of the secure
Protection environment zone
segregation

1.1 1.1a 1.1b

s, Routers and Switches
X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X X X

X X X

X X X
X X X

X X X

X X X

X X X

X X X
X X X
 Communication
Protection of the secure between components
zone Boundary Protection
in the secure zone

1.1c 1.1c.1 1.1c.2

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X X X

X X X

X X X
X X X

X X X

X X X

X X X

X X X
X X X
 Local Operator (end Remote Operator
Access to the secure user and administrator) Access (teleworking,
zone systems “on-call” duties, or
access remote administration)

1.1d 1.1d.1 1.1d.2

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X X X

X X X

X X X
X X X

X X X

X X X

X X X

X X X
X X X
 Segregation from
Restriction of Internet General Enterprise IT
access Virtualisation
Services

1.1e 1.1f 1.1g

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
X X X

X X X

X X X
X X X

X X X

X X X

X X X

X X X
X X X
 Systems within the
secure zone implement Operating System
application whitelisting, Privileged Account Internal Data Flow
allowing only trusted Security
applications to be Control
executed
1.1-opt 1.2 2.1

X
X
X
X
X

X
X

X
X

X
X
X

X
X
X
X

X
X

X
X
 Back-office Data Flow
Security Updates System Hardening Security

2.2 2.3 2.4a

X

X
X
X
X
X

X
X

X
X

X
X
 Operator Session
External Transmission Confidentiality and
Data Protection Vulnerability Scanning
Integrity

2.5a 2.6a 2.7a

 X

X
X
X
X

X
X

X
X
X

X
X
X
X

X
X

X
X
Critical Activity Transaction Business
Outsourcing Controls Physical Security

2.8a 2.9a 3.1

 Multi-factor
Password Policy Authentication Logical Access Control

4.1 4.2 5.1

X

X
X

X
 X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Personnel Vetting Physical and Logical
Token Management Process Password Storage

5.2 5.3a 5.4a

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
Malware Protection Software Integrity Database Integrity

6.1 6.2 6.3

X

X
X
X
X
X
X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X
 Cyber Incident
Logging and Monitoring Intrusion Detection Response Planning

6.4 6.5a 7.1

X
X
X
X
X
X
X
X
X

X
X

X
Security Training and Scenario Risk
Awareness Penetration Testing Assessment

7.2 7.3a 7.4a

X
X

X
X
X

X
 X

X
X
X

X
 CIS Controls v7.1 mapped to Monetary Authority of Singapore's (MAS)
Technology Risk Management (TRM) Guidance

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to Monetary Authority of Singapore's (MAS)

Technology Risk Management (TRM) Guidance

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Oversight of Technology Risk

Technology Risks by Management of IT
Board of Directors and Management Outsourcing Risks
Senior Management Framework

3 4 5
s, Routers and Switches
 Acquisition and Systems Reliability,
Development of IT Service Management Availability, and
Information Systems Recoverability

6 7 8
X
X
X

X
X
X
X
X

X
X
X
X
X

X
X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X

X
 Operational
Data Centres Protection
Infrastructure Security and Controls Access Controls
Management

9 10 11
X

X
X
X
X

X
X

X
X
 X

X
X
X

X
X
X
X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X
X

X
X

X X

X X

X X
X X

X X

X X

X X

X X
X X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
X
X

X
Online Financial
Services Payment Card Security IT Audit

12 13 14
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
 CIS Controls v7.1 mapped to Saudi Arabian Monetary Authority Cyber
Security Framework (v1.0)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to Saudi Arabian Monetary Authority Cyber

Security Framework (v1.0)

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Cyber Security
Governance Cyber Security Strategy Cyber Security Policy

3.1.1 3.1.2 3.1.3

s, Routers and Switches
Cyber Security Roles Cyber Security in Cyber Security
and Responsibilities Project Management Awareness

3.1.4 3.1.5 3.1.6

X
X

X
X
X

X
 Cyber Security Risk
Cyber Security Training Management Regulatory Compliance

3.1.7 3.2.1 3.2.2

X
X

X
X
X

X
 Compliance with
(inter)national industry Cyber Security Review Cyber Security Audits
standards

3.2.3 3.2.4 3.2.5

X X
X X
X X

X X

X X

X X

X X

X X
Human Resources Physical Security Asset Management

3.3.1 3.3.2 3.3.3

X
X
X

X
X
X
X
X

X
X
Cyber Security Identity and Access
Architecture Management Application Security

3.3.4 3.3.5 3.3.6

X
X

X
X
X

X
X
X

X
X

X
X

X
X
X

X
X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X
X
X
X

X
Change Management Infrastructure Security Cryptography

3.3.7 3.3.8 3.3.9

X

X
X

X
X

X
X
X
X
X

X
X
X

X
X
X

X
X
X
X

X
X
Bring Your Own Device Secure Disposal of
(BYOD) Information Assets Payment Systems

3.3.10 3.3.11 3.3.12

X

X
Electronic Banking Cyber Security Event Cyber Security Incident
Services Management Management

3.3.13 3.3.14 3.3.15

X
X
X
X
X
X
X
X
X

X
 Vulnerability Contract and Vendor
Threat Management Management Management

3.3.16 3.3.17 3.4.1

X

X
X
X
X
X

X
X
X
X
X
Outsourcing Cloud Computing

3.4.2 3.4.3
 CIS Controls v7.1 mapped to NERC CIP v7

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3
 System 2.4

System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2
 System 4.3

System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6
 System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5
 System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5
 Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12
Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7
Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7
Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4
Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to NERC CIP v7

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
 The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
 Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
 On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

 Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.
 Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.
 Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.
 Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.
 Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Attachment 1 CIP-002-5
Incorporates the Cyber Security Policies
"Bright Line Criteria" to BES Cyber System Lists approved for Medium
classify BES Assets as must be reviewed and and High Impact BES
Low, Medium, or High. approved every 15 Cyber Systems by CIP
Called BES Cyber calendar months Senior Manager every
Systems consolidating 15 calendar months.
CAs and CCAs

CIP-002-5.1 R1 CIP-002-5.1 R2 CIP-003-7 R1

X X
X X
X X

X X

X X

X X

X X

X X
s, Routers and Switches
Cyber Security Policies Identify a CIP Senior
approved for Low Manager and document CIP Senior Manager
Impact Assets by CIP any change within 30 must document any
Senior Manager every calendar days of the delegates
15 Calendar Months change

CIP-003-7 R2 CIP-003-7 R3 CIP-003-7 R4

Security Awareness Personnel Risk
Program Training Program Assessment (PRA)
Program

CIP-004-6 R1 CIP-004-6 R2 CIP-004-6 R3

X X
X X

X X

X X

X X
X X
X X

X X

X X
Access Management Access Revocation Electronic Security
Program Program Perimeters

CIP-004-6 R4 CIP-004-6 R5 CIP-005-5 R1

X X
X X
X X
X X
X X

X X

X X
X X
X X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
Interactive Remote
Access Management Physical Security Plan Visitor Control Plan

CIP-005-5 R2 CIP-006-6 R1 CIP-006-6 R2

X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
Maintenance and Security Patch
Testing Program Ports and Services Management

CIP-006-6 R3 CIP-007-6 R1 CIP-007-6 R2

X

X
X
X
X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X
X

X
Malicious Code Security Event
Prevention Monitoring System Access Controls

CIP-007-6 R3 CIP-007-6 R4 CIP-007-6 R5

X
X
 X
X
X

X
X
X

X
X
X
X
X
X
 X
X

X
X
X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
 Implementation and Cyber Security Incident
Cyber Security Incident testing of Cyber Response Plan Review,
Response Plan Security Incident Update and
Response Plans Communication

CIP-008-5 R1 CIP-008-5 R2 CIP-008-5 R3

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
Recovery Plan Recovery Plan Recovery Plan Review,
Specifications Implementation and Udpate, and
Testing Communication

CIP-009-6 R1 CIP-009-6 R2 CIP-009-6 R3

X
X
X

X
Configuration Change Configuration Vulnerability
Management Process Monitoring Assessments

CIP-010-3 R1 CIP-010-3 R2 CIP-010-3 R3

X
X
X
X
X

X
X

X
X
X
X
X

X
X

X
X

X
X
 X
X
X
X
X

X
X
X
X

X
Information Protection BES Cyber Asset Reuse Supply Chain Risk
Process and Disposal Management Plan

CIP-011-2 R1 CIP-011-2 R2 CIP-013-1 R1

X

X
X
X
X

X
X

X
X

X
X

X
Supply Chain Risk Approval of Supply Physical Security Risk
Management Plan Chain Management Assessments
Plan

CIP-013-1 R2 CIP-013-1 R3 CIP-014-2 R1

 Third Party Validation Physical Vulnerability
of Physical Security Risk Notification of Control and Threat Assessment
Assessment

CIP-014-2 R2 CIP-014-2 R3 CIP-014-2 R4

 Third Party Validation
Physical Security Plan of Physical Security Plan

CIP-014-2 R5 CIP-014-2 R6
 CIS Controls v7.1 mapped to NERC CIP v6

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3
 System 2.4

System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2
 System 4.3

System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6
 System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5
 System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5
 Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12
Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7
Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7
Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4
Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to NERC CIP v6

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
 The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
 Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
 On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

 Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.
 Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.
 Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.
 Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.
 Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Attachment 1 CIP-002-5
Incorporates the Cyber Security Policies
"Bright Line Criteria" to BES Cyber System Lists approved for Medium
classify BES Assets as must be reviewed and and High Impact BES
Low, Medium, or High. approved every 15 Cyber Systems by CIP
Called BES Cyber calendar months Senior Manager every
Systems consolidating 15 calendar months.
CAs and CCAs

CIP-002-5.1 R1 CIP-002-5.1 R2 CIP-003-6 R1

X X
X X
X X

X X

X X

X X

X X

X X
s, Routers and Switches
Cyber Security Policies Identify a CIP Senior
approved for Low Manager and document CIP Senior Manager
Impact Assets by CIP any change within 30 must document any
Senior Manager every calendar days of the delegates
15 Calendar Months change

CIP-003-6 R2 CIP-003-6 R3 CIP-003-6 R4

Security Awareness Personnel Risk
Program Training Program Assessment (PRA)
Program

CIP-004-6 R1 CIP-004-6 R2 CIP-004-6 R3

X X
X X

X X

X X

X X
X X
X X

X X

X X
Access Management Access Revocation Electronic Security
Program Program Perimeters

CIP-004-6 R4 CIP-004-6 R5 CIP-005-5 R1

X X
X X
X X
X X
X X

X X

X X
X X
X X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
Interactive Remote
Access Management Physical Security Plan Visitor Control Plan

CIP-005-5 R2 CIP-006-6 R1 CIP-006-6 R2

X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
Maintenance and Security Patch
Testing Program Ports and Services Management

CIP-006-6 R3 CIP-007-6 R1 CIP-007-6 R2

X

X
X
X
X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X
X

X
Malicious Code Security Event
Prevention Monitoring System Access Controls

CIP-007-6 R3 CIP-007-6 R4 CIP-007-6 R5

X
X
 X
X
X

X
X
X

X
X
X
X
X
X
 X
X

X
X
X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
 Implementation and Cyber Security Incident
Cyber Security Incident testing of Cyber Response Plan Review,
Response Plan Security Incident Update and
Response Plans Communication

CIP-008-5 R1 CIP-008-5 R2 CIP-008-5 R3

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
Recovery Plan Recovery Plan Recovery Plan Review,
Specifications Implementation and Udpate, and
Testing Communication

CIP-009-6 R1 CIP-009-6 R2 CIP-009-6 R3

X
X
X

X
Configuration Change Configuration Vulnerability
Management Process Monitoring Assessments

CIP-010-2 R1 CIP-010-2 R2 CIP-010-2 R3

X
X
X
X
X

X
X

X
X
X
X
X

X
X

X
X

X
X
 X
X
X
X
X

X
X
X
X

X
Information Protection BES Cyber Asset Reuse
Process and Disposal

CIP-011-2 R1 CIP-011-2 R2
X

X
X
X
X

X
X

X
X

X
X

X
 CIS Controls v7.1 mapped to NERC CIP v5

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3
 System 2.4

System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2
 System 4.3

System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6
 System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5
 System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5
 Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12
Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7
Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7
Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4
Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to NERC CIP v5

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
 The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
 Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
 On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

 Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.
 Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.
 Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.
 Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.
 Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Attachment 1 CIP-002-5
Incorporates the Cyber Security Policies
"Bright Line Criteria" to BES Cyber System Lists approved for Medium
classify BES Assets as must be reviewed and and High Impact BES
Low, Medium, or High. approved every 15 Cyber Systems by CIP
Called BES Cyber calendar months Senior Manager every
Systems consolidating 15 calendar months.
CAs and CCAs

CIP-002-5.1 R1 CIP-002-5.1 R2 CIP-003-5 R1

X X
X X
X X

X X

X X

X X

X X

X X
s, Routers and Switches
Cyber Security Policies Identify a CIP Senior
approved for Low Manager and document CIP Senior Manager
Impact Assets by CIP any change within 30 must document any
Senior Manager every calendar days of the delegates
15 Calendar Months change

CIP-003-5 R2 CIP-003-5 R3 CIP-003-5 R4

Security Awareness Personnel Risk
Program Training Program Assessment (PRA)
Program

CIP-004-5 R1 CIP-004-5 R2 CIP-004-5 R3

X X
X X

X X

X X

X X
X X
X X

X X

X X
Access Management Access Revocation Electronic Security
Program Program Perimeters

CIP-004-5 R4 CIP-004-5 R5 CIP-005-5 R1

X X
X X
X X
X X
X X

X X

X X
X X
X X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
Interactive Remote
Access Management Physical Security Plan Visitor Control Plan

CIP-005-5 R2 CIP-006-5 R1 CIP-006-5 R2

X

X
X

X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
Maintenance and Security Patch
Testing Program Ports and Services Management

CIP-006-5 R3 CIP-007-5 R1 CIP-007-5 R2

X

X
X
X
X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X
X

X
Malicious Code Security Event
Prevention Monitoring System Access Controls

CIP-007-5 R3 CIP-007-5 R4 CIP-007-5 R5

X
X
 X
X
X

X
X
X

X
X
X
X
X
X
 X
X

X
X
X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
X
 Implementation and Cyber Security Incident
Cyber Security Incident testing of Cyber Response Plan Review,
Response Plan Security Incident Update and
Response Plans Communication

CIP-008-5 R1 CIP-008-5 R2 CIP-008-5 R3

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
Recovery Plan Recovery Plan Recovery Plan Review,
Specifications Implementation and Udpate, and
Testing Communication

CIP-009-5 R1 CIP-009-5 R2 CIP-009-5 R3

X
X
X

X
Configuration Change Configuration Vulnerability
Management Process Monitoring Assessments

CIP-010-1 R1 CIP-010-1 R2 CIP-010-1 R3

X
X
X
X
X

X
X

X
X
X
X
X

X
X

X
X

X
X
 X
X
X
X
X

X
X
X
X

X
Information Protection BES Cyber Asset Reuse
Process and Disposal

CIP-011-1 R1 CIP-011-1 R2
X

X
X
X
X

X
X

X
X

X
X

X
 CIS Controls v7.1 mapped to NERC CIP v4

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to NERC CIP v4

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Risk-Based Assessment Annual Approval of

Identify Critical Cyber
Methodology (RBAM) Assets (CCA) RBAM, CA list, and CCA
to ID Critical Assets (CA) List

CIP-002-4 R1 CIP-002-4 R2 CIP-002-4 R3

X X X
X X X
X X X

X X X

X X X

X X X

X X X

X X X
s, Routers and Switches
 CIP Senior Manager Exceptions to the Cyber
Cyber Security Policy Identification Security Policy

CIP-003-4 R1 CIP-003-4 R2 CIP-003-4 R3

 Change Control and
Information Protection
Program Access Control Configuration
Management

CIP-003-4 R4 CIP-003-4 R5 CIP-003-4 R6

X
X
X

X
X
X

X
X
X

X
X
X

X
X

X
X

X
X
X

X
X
X

X
X
X

X
X

X
X
Awareness: Security Training: Cyber Security Personnel Risk
Awareness Program Training Program Assessment

CIP-004-4 R1 CIP-004-4 R2 CIP-004-4 R3

X X
X X

X X

X X

X X
X X
X X

X X

X X
X X

X X

X X

X X

X X

X X

X X

X X
 Electronic Security
Perimeters: All CCAs Electronic Access
Access must reside within an Controls
ESP

CIP-004-4 R4 CIP-005-4 R1 CIP-005-4 R2

X X
X X
X X

X X

X X

X X

X X

X X
X X
X X

X X
X X
X X

X X

X X
X X
X X
X X

X X

X X
X X
X X

X X
X X
X X

X X

X X
X X

X X

X X

X X

X X
X X
Monitoring Electronic Cyber Vulnerability Documentation Review
Access Assessment and Maintenance

CIP-005-4 R3 CIP-005-4 R4 CIP-005-4 R5

 X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
 Protection of Physical Protection of Electronic
Physical Security Plan Access Control Systems Access Control Systems

CIP-006-4 R1 CIP-006-4 R2 CIP-006-4 R3

X
X
X

X
X
X

X
X
X

X
X
X
X

X
X
X

X
X
X

X
X

X
X
 Monitoring Physical
Physical Access Controls Access Logging Physical Access

CIP-006-4 R4 CIP-006-4 R5 CIP-006-4 R6

 Maintenance and
Access Log Retention Testing Test Procedures

CIP-006-4 R7 CIP-006-4 R8 CIP-007-4 R1

 Security Patch Malicious Software
Ports and Services Management Prevention

CIP-007-4 R2 CIP-007-4 R3 CIP-007-4 R4

X

X
X
X
X

X
X

X
X
X

X
X
X

X
X

X
X

X
X

X
X
X
X
 X

X
X
X
X
X

X
X
X

X
X
 Security Status Disposal or
Account Management Monitoring Redeployment

CIP-007-4 R5 CIP-007-4 R6 CIP-007-4 R7

X
X
X
X
X
X
X
X
X

X
 X
X
X
X

X
X
X

X
X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
Cyber Vulnerabiliity Documentation Review Cyber Security Incident
Assessment and Maintenance Response Plan

CIP-007-4 R8 CIP-007-4 R9 CIP-008-4 R1

X

X
X
X
X
Cyber Security Incident
Documentation Recovery Plans Exercises

CIP-008-4 R2 CIP-009-4 R1 CIP-009-4 R2

Change Control Backup and Restore Testing Back Up Media

CIP-009-4 R3 CIP-009-4 R4 CIP-009-4 R5

X X
X X
X X

X X

X X
 CIS Controls v7.1 mapped to NERC CIP v3

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to NERC CIP v3

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Risk-Based Assessment
Apply RBAM to ID Identify Critical Cyber
Methodology (RBAM) Critical Assets Assets (CCA)
to ID Critical Assets (CA)

CIP-002-3 R1 CIP-002-3 R2 CIP-002-3 R3

X X X
X X X
X X X

X X X

X X X

X X X

X X X

X X X
s, Routers and Switches
 Annual Approval of
CIP Senior Manager
RBAM, CA list, and CCA Cyber Security Policy Identification
List

CIP-002-3 R4 CIP-003-3 R1 CIP-003-3 R2

X
X
X

X
Exceptions to the Cyber Information Protection
Security Policy Program Access Control

CIP-003-3 R3 CIP-003-3 R4 CIP-003-3 R5

X
X
X

X
X
X

X
X
X

X
X
X
X

X
X

X
X
Change Control and
Awareness: Security Training: Cyber Security
Configuration Awareness Program Training Program
Management

CIP-003-3 R6 CIP-004-3 R1 CIP-004-3 R2

X

X
X

X
X

X
X
X

X
X
X

X
X
X X
X X

X X

X X

X X
X X
X X

X X

X X
 Electronic Security
Personnel Risk Perimeters: All CCAs
Assessment Access must reside within an
ESP

CIP-004-3 R3 CIP-004-3 R4 CIP-005-3 R1

X
X
X

X
X
X

X
X
X

X
X
X
X

X
X
X

X
X
X

X
X

X
X
Electronic Access Monitoring Electronic Cyber Vulnerability
Controls Access Assessment

CIP-005-3 R2 CIP-005-3 R3 CIP-005-3 R4

X
X
X

X
 X

X
X
X
X

X X
X X

X X
X X
X X

X X

X X
X X
X X

X
X
X
X
X
X
X
X
X

X
X
X

X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X
Documentation Review Protection of Physical
and Maintenance Physical Security Plan Access Control Systems

CIP-005-3 R5 CIP-006-3 R1 CIP-006-3 R2

Protection of Electronic Monitoring Physical
Access Control Systems Physical Access Controls Access

CIP-006-3 R3 CIP-006-3 R4 CIP-006-3 R5

X
X
X

X
X
X

X
X
X

X
X
X
X

X
X
X

X
X
X

X
X

X
X
 Maintenance and
Logging Physical Access Access Log Retention Testing

CIP-006-3 R6 CIP-006-3 R7 CIP-006-3 R8

 Security Patch
Test Procedures Ports and Services Management

CIP-007-3 R1 CIP-007-3 R2 CIP-007-3 R3

X

X
X
X
X

X
X

X
X
X

X
X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X

X
X
Malicious Software Security Status
Prevention Account Management Monitoring

CIP-007-3 R4 CIP-007-3 R5 CIP-007-3 R6

X
X
X
X
X
X
X
X
X

X
X
X
X
X
X

X
 X
X
X
X

X
X
X

X
X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Disposal or Cyber Vulnerabiliity Documentation Review
Redeployment Assessment and Maintenance

CIP-007-3 R7 CIP-007-3 R8 CIP-007-3 R9

X

X
X
X
X
Cyber Security Incident Cyber Security Incident
Response Plan Documentation Recovery Plans

CIP-008-3 R1 CIP-008-3 R2 CIP-009-3 R1

X X

X X

X X

X X

X X

X X

X X

X X
 Exercises Change Control Backup and Restore

CIP-009-3 R2 CIP-009-3 R3 CIP-009-3 R4

X
X
X

X
Testing Back Up Media

CIP-009-3 R5
X
X
X

X
 CIS Controls v7.1 mapped to the Cloud Security Alliance (CSA) Cloud
Control Matrix (CCM) ver.3

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4
 System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3
 System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7
 System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6
 System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

Controls v7.1 mapped to the Cloud Security Alliance (CSA) Cloud

Control Matrix (CCM) ver.3

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
 The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
 Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

 On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
 Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Application & Interface Application & Interface

Application & Interface
Security - Application Security - Customer Security - Data Integrity
Security Access Requirements

AIS-01 AIS-02 AIS-03

s, Routers and Switches
X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X
Application & Interface Audit Assurance & Audit Assurance &
Security - Data Compliance - Audit Compliance -
Security / Integrity Planning Independent Audits

AIS-04 AAC-01 AAC-02

X
X

X
X
X
X
X
X

X
 Business Continuity Business Continuity
Audit Assurance & Management & Management &
Compliance -
Information System Operational Resilience - Operational Resilience -
Regulatory Mapping Business Continuity Business Continuity
Planning Testing

AAC-03 BCR-01 BCR-02

 Business Continuity
Management & Business Continuity Business Continuity
Operational Resilience - Management & Management &
Datacenter Utilities / Operational Resilience - Operational Resilience -
Environmental Documentation Environmental Risks
Conditions

BCR-03 BCR-04 BCR-05

 Business Continuity Business Continuity
Business Continuity Management & Management &
Management &
Operational Resilience - Operational Resilience - Operational Resilience -
Equipment Location Equipment Equipment Power
Maintenance Failures

BCR-06 BCR-07 BCR-08

 Business Continuity Business Continuity Business Continuity
Management & Management & Management &
Operational Resilience - Operational Resilience - Operational Resilience -
Impact Analysis Management Program Policy

BCR-09 BCR-10 BCR-11

 Change Control & Change Control &
Business Continuity Configuration Configuration
Management &
Operational Resilience - Management - New Management -
Retention Policy Development / Outsourced
Acquisition Development

BCR-12 CCC-01 CCC-02

X X
X X

X X

X X
X X
X X
X X
X X
X X

X X

X X
 Change Control &
Change Control & Configuration Change Control &
Configuration Configuration
Management - Quality Management - Management -
Testing Unauthorized Software Production Changes
Installations

CCC-03 CCC-04 CCC-05

X
X
X
X
X

X
X
X
X

X
X
X
X
X
X

X
 Data Security & Data Security & Data Security &
Information Lifecycle Information Lifecycle Information Lifecycle
Management - Management - Data Management -
Classification Inventory / Flows Commerce Transactions

DSI-01 DSI-02 DSI-03

X
X
X
X
X

X
X
X

X
X

X
X

X
X
X
X

X
X

X
X

X
X
 Data Security &
Information Lifecycle Data Security & Data Security &
Information Lifecycle Information Lifecycle
Management - Handling Management - Management - Non-
/ Labeling / Security Information Leakage Production Data
Policy

DSI-04 DSI-05 DSI-06

X
X

X
X
X
X

X
X
 Data Security &
Information Lifecycle Data Security &
Information Lifecycle Datacenter Security -
Management - Management - Secure Asset Management
Ownership / Disposal
Stewardship

DSI-07 DSI-08 DCS-01

X
X
X

X
Datacenter Security - Datacenter Security -
Datacenter Security -
Controlled Access Equipment Off-Site Authorization
Points Identification

DCS-02 DCS-03 DCS-04

 Datacenter Security -
Datacenter Security - Datacenter Security -
Off-Site Equipment Policy Secure Area
Authorization

DCS-05 DCS-06 DCS-07

Datacenter Security - Encryption & Key
Datacenter Security -
Unauthorized Persons User Access Management -
Entry Entitlement

DCS-08 DCS-09 EKM-01

X
X

X
X
X
X

X
X
Encryption & Key Encryption & Key Encryption & Key
Management - Key Management - Sensitive Management - Storage
Generation Data Protection and Access

EKM-02 EKM-03 EKM-04

X X X
X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X
 Governance and Risk Governance and Risk Governance and Risk
Management - Baseline Management - Data Management -
Requirements Focus Risk Assessments Management Oversight

GRM-01 GRM-02 GRM-03

Governance and Risk Governance and Risk
Management - Governance and Risk
Management - Management Management - Policy
Management Program Support/Involvement

GRM-04 GRM-05 GRM-06

Governance and Risk Governance and Risk Governance and Risk
Management - Policy
Management - Policy Impact on Risk Management - Policy
Enforcement Assessments Reviews

GRM-07 GRM-08 GRM-09

Governance and Risk Governance and Risk Governance and Risk
Management - Risk
Management - Risk Management Management - Risk
Assessments Framework Mitigation / Acceptance

GRM-10 GRM-11 GRM-12

 Human Resources -
Human Resources - Human Resources -
Asset Returns Background Screening Employment
Agreements

HRS-01 HRS-02 HRS-03

Human Resources - Human Resources - Human Resources -
Employment Industry Knowledge / Mobile Device
Termination Benchmarking Management

HRS-04 HRS-05 HRS-06

Human Resources - Human Resources -
Human Resources -
Non-Disclosure Roles / Responsibilities Technology Acceptable
Agreements Use

HRS-07 HRS-08 HRS-09

 Human Resources - Human Resources - Human Resources -
Training / Awareness User Responsibility Workspace

HRS-10 HRS-11 HRS-12

X
X

X
X
X

X
 Identity & Access
Identity & Access Identity & Access Management -
Management -
Management - Audit Credential Lifecycle / Diagnostic /
Tools Access Provision Management Configuration Ports
Access

IAM-01 IAM-02 IAM-03

X

X
X
X

X
X
X
X
X
X
X
X

X
X
X
X
X
X
 Identity & Access Identity & Access Identity & Access
Management - Policies Management - Management - Source
and Procedures Segregation of Duties Code Access Restriction

IAM-04 IAM-05 IAM-06

 Identity & Access Identity & Access Identity & Access
Management - Third Management - Trusted Management - User
Party Access Sources Access Authorization

IAM-07 IAM-08 IAM-09

X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X
X
X
X
X
 Identity & Access Identity & Access Identity & Access
Management - User Management - User Management - User ID
Access Reviews Access Revocation Credentials

IAM-10 IAM-11 IAM-12

X X X
X X X

X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Identity & Access Infrastructure & Infrastructure &
Virtualization Security -
Management - Utility Audit Logging / Virtualization Security -
Programs Access Intrusion Detection Change Detection

IAM-13 IVS-01 IVS-02

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
 Infrastructure &
Infrastructure & Infrastructure & Virtualization Security -
Virtualization Security -
Virtualization Security - Information System Management -
Clock Synchronization Documentation Vulnerability
Management

IVS-03 IVS-04 IVS-05

X

X
X
X
X
X
X
X
X
X
X
X
X
 Infrastructure &
Infrastructure & Infrastructure & Virtualization Security -
Virtualization Security -
Virtualization Security - OS Hardening and Base Production / Non-
Network Security Controls Production
Environments

IVS-06 IVS-07 IVS-08

X

X
X

X
X

X
X
X
X
X
X
X

X
X
X

X
X

X
X
X
X
X

X
X
X

X
X
X
X

X
X
X
X
X
X

X
 Infrastructure & Infrastructure & Infrastructure &
Virtualization Security - Virtualization Security -
Virtualization Security - VM Security - vMotion VMM Security -
Segmentation Data Protection Hypervisor Hardening

IVS-09 IVS-10 IVS-11

X

X
X
X

X
X

X
X

X
X

X
X
 Infrastructure & Interoperability &
Interoperability &
Virtualization Security - Portability - APIs Portability - Data
Wireless Security Request

IVS-12 IPY-01 IPY-02

X
X
X
X

X
X
X

X
X
 Interoperability & Interoperability & Interoperability &
Portability -
Portability - Policy & Standardized Network Portability -
Legal Protocols Virtualization

IPY-03 IPY-04 IPY-05

X
X
X
X
X
Mobile Security - Anti- Mobile Security - Mobile Security -
Malware Application Stores Approved Applications

MOS-01 MOS-02 MOS-03

X
X
X
X
X

X
X
X

X
X
X
X
X
 Mobile Security -
Mobile Security - Mobile Security - Cloud
Approved Software for Awareness and Training Based Services
BYOD

MOS-04 MOS-05 MOS-06

X
X
X
X
X

X
X
X
X

X
X
X

X
Mobile Security - Mobile Security - Device Mobile Security - Device
Compatibility Eligibility Inventory

MOS-07 MOS-08 MOS-09

X
X
X

X
 Mobile Security -
Mobile Security - Device Mobile Security -
Management Encryption Jailbreaking and
Rooting

MOS-10 MOS-11 MOS-12

X
X
X

X
X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X
 Mobile Security - Mobile Security -
Mobile Security - Legal Lockout Screen Operating Systems

MOS-13 MOS-14 MOS-15

X
X
X

X
X
X
X
X

X
X

X
X
X
X
X

X
X

X
X

X
X

X
X
X
X
X
X
X
X
X
X
X

X
X
X
X
X
X
Mobile Security - Mobile Security -
Passwords Mobile Security - Policy Remote Wipe

MOS-16 MOS-17 MOS-18

X
X

X
X
X

X
X
X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
 Security Incident
Management, E-
Mobile Security -
Security Patches Mobile Security - Users Discovery & Cloud
Forensics - Contact /
Authority Maintenance

MOS-19 MOS-20 SEF-01

X

X
X
X
X

X
X

X
 X
X

X
X
X

X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X

X
X
X
X
X
X
X

X
 Security Incident Security Incident Security Incident
Management, E- Management, E- Management, E-
Discovery & Cloud
Discovery & Cloud Discovery & Cloud Forensics - Incident
Forensics - Incident Forensics - Incident Response Legal
Management Reporting Preparation

SEF-02 SEF-03 SEF-04

X X X

X X X

X X X

X X X

X X X

X X X

X X X

X X X
 Security Incident Supply Chain Supply Chain
Management, E- Management, Management,
Discovery & Cloud Transparency and Transparency and
Forensics - Incident Accountability - Data Accountability -
Response Metrics Quality and Integrity Incident Reporting

SEF-05 STA-01 STA-02

X

X
 Supply Chain Supply Chain Supply Chain
Management, Management, Management,
Transparency and Transparency and
Accountability - Accountability - Transparency and
Network / Provider Internal Accountability - Supply
Infrastructure Services Assessments Chain Agreements

STA-03 STA-04 STA-05

 Supply Chain Supply Chain Supply Chain
Management, Management, Management,
Transparency and
Accountability - Supply Transparency and Transparency and
Chain Governance Accountability - Supply Accountability - Third
Reviews Chain Metrics Party Assessment

STA-06 STA-07 STA-08

 Supply Chain Threat and Threat and
Management, Vulnerability Vulnerability
Transparency and Management - Anti- Management -
Accountability - Third Virus / Malicious Vulnerability / Patch
Party Audits Software Management

STA-09 TVM-01 TVM-02

X

X
X
X
X
X

X
 X

X
X

X
X

X
X
X
X
X

X
X
X

X
X
Threat and Vulnerbility
Management - Mobile
Code

TVM-03
X

X
X
X
X
X
 CIS Controls v7.1 mapped to the Amazon Web Services – OCIE
Cybersecurity Audit Guide (Oct 2015)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

 Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10
Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

IS Controls v7.1 mapped to the Amazon Web Services – OCIE

Cybersecurity Audit Guide (Oct 2015)

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
 Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.
Encrypt or hash with a salt all authentication credentials when stored.
Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.
Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
Automatically disable dormant accounts after a set period of inactivity.
Ensure that all accounts have an expiration date that is monitored and enforced.
Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
 Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Network Configuration Asset Configuration and

Governance and Management Management

1 2 3
X

X
, Routers and Switches
X

X
X
X

X
X

X
 Security Logging and
Logical Access Control Data Encryption Monitoring

4 5 6
X
X
X
X
X
X
X
X
X

X
 X
X
X
X

X
X

X
X

X
Security Incident
Response Disaster Recovery Inherited Controls

7 8 9
X
X
X

X
X

X
 CIS Controls v7.1 mapped to the FY15 CIO Annual FISMA Metrics

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

S Controls v7.1 mapped to the FY15 CIO Annual FISMA Metrics

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.
Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Identity Credential and

System Inventory Continuous Monitoring Access Management

1 2 3
X X
X X
X X

X X

X X

X X

X X

X X

X X

X X

X X
X X
X X
X X
X X

X X

X X
X X

X
X
X
X

X
X

X
X
 X

X
X
X

X
X

X
X

X
X
, Routers and Switches
X

X
X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
Anti-Phishing and
Malware Defense Data Protection Network Defense

4 5 6
X

X
X
X
X
X
 X

X
X

X
X
X
X

X
X
Boundary Protection Training and Education Incident Response

7 8 9
X

X
X
X

X
X
X

X
X

X
 CIS Controls v7.1 mapped to ITIL 2011 KPIs

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6
 Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8
Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5
Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1
Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to ITIL 2011 KPIs

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.
 Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
 Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
 Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Service Portfolio
Management and Business Relationship
Strategy Management Financial Management Management
for IT Services

KPI 1 KPI 2 KPI 3

, Routers and Switches
Service Level Availability
Management Management Capacity Management

KPI 4 KPI 5 KPI 6

IT Service Continuity Information Security
Management Management Supplier Management

KPI 7 KPI 8 KPI 9

X
X
X

X
X
X
X
X

X
X

X
X
X
X

X
X

X
X
X

X
X
X

X
X
X
X
X
X
X
X
X

X
X

X
X

X
X
X
X
X

X
X
X
X
X

X
X
X

X
X
X

X
X

X
X

X
X
X
X

X
X

X
X

X
X

X
X
X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X

X
X

X
X
X
X
X
X

X
X
X

X
 Release and
Change Management Project Management Deployment
Management

KPI 10 KPI 11 KPI 12

 Service Asset and
Service Validation and
Testing Configuration Incident Management
Management

KPI 13 KPI 14 KPI 15

X

X
Problem Management Service Review Process Evaluation

KPI 16 KPI 17 KPI 18

 Definition of
Improvement Initiatives

KPI 19
 CIS Controls v7.1 mapped to the State of Nevada Gaming Control Board
Minimum Internal Control Standards (MICS) v7 2015

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

 Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ntrols v7.1 mapped to the State of Nevada Gaming Control Board

Minimum Internal Control Standards (MICS) v7 2015

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
 Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Physical Access and

Maintenance Controls System Parameters User Accounts

1 2 3
X
X
X
X
X
X
X
X
, Routers and Switches
X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Service & Default
Generic User Accounts Accounts Backups

4 5 6
X
X
X

X
X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Electronic Storage of Creation of Wagering
Recordkeeping Documentation Instruments Database

7 8 9
Network Security and Changes to Production
Data Protection Remote Access Environment

10 11 12
X
X
X
X
X

X
X
X

X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X
X
X
X
X

X
X

X
X

X
X
X
X

X
X
X

X
X
Information Technology In-House Software Purchased Software
Department Development Programs

13 14 15
X X
X X

X X

X X
X X
X X
X X
X X
X X
X X

X X
 CIS Controls v7.1 mapped to Commonwealth of Massachusetts 201 CMR
17.00

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7
 System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7
Critical Security Control #12: Boundary Defense
Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1
 Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8
Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6
Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2
Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ntrols v7.1 mapped to Commonwealth of Massachusetts 201 CMR

17.00

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.

Configure devices to not auto-run content from removable media.

Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.
 Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.
 Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.
 Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

 Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
 Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

DSC is responsible for

Designated Data DSC is responsible for
Security Coordinator implementation of the training employees
WISP

IV IV-a IV-b
, Routers and Switches
X
X

X
X
X

X
 DSC is responsible for
DSC is responsible for DSC is responsible for
testing the WISP evaluate third parties review security
measures

IV-c IV-d IV-e

DSC is responsible for Internal Threats - Internal Threats -
performing annual Distribution of WISP to Employee Awareness
training Employees Training

IV-f V-01 V-02

X X
X X

X X

X X

X X
X X
X X

X X

X X
 Internal Threats - Internal Threats -
Internal Threats - Limit
Employment Contract Data Collected Access Based on Need
Provisions to Know

V-03 V-04 V-05

X X

X X

X X
X X

X X

X X

X X

X X
X X

X
X
X
X
X
X

X
X
X
X
X
X
Internal Threats - Block Internal Threats - Internal Threats -
Employee Termination
Unauthorized Access to Annual Security Procedures (Return of
Data Measure Review Data)

V-06 V-07 V-08

X

X
X

X
X

X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
 Internal Threats - Internal Threats - Internal Threats -
Employee Termination
Procedures (Access Passwords Changed Access Provided to
Revoked) Regularly Active Users Only

V-09 V-10 V-11

X X X
X X X
X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Internal Threats - Internal Threats - Do
Internal Threats -
Reporting Suspicious Incident Handling Not Leave Data
Behavior Unattended

V-12 V-13 V-14

X

X
Internal Threats - Close Internal Threats - Internal Threats -
Data at Conclusion of Restrict Physical Access Unique User IDs
Work Day to Data Required

V-15 V-16 V-17

X
X
X
X
X
X

X
X
X
X
X
X
 Internal Threats -
Internal Threats - External Threats -
Restrict Visitor Physical Disposal of Media Firewall and OS Patches
Access

V-18 V-19 VI-01

X

X
X
X
X
 X

X
X

X
X
X
X

X
X
 External Threats -
External Threats - External Threats -
Endpoint Protection Encryption of sensitive Monitoring
data

VI-02 VI-03 VI-04

X
X
X
X
X

X
X
X
X
X
X
X
X
X
X
X

X
X
X
X
X
 X

X
X

X
X
X
X

X
X

X
X

X
X
External Threats -
Authentication

VI-05
X

X
X
X
X
X
X
X

X
X
X
X
X
X
 CIS Controls v7.1 mapped to New York State Department of Financial
Services 23 NYCRR 500

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

 Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ontrols v7.1 mapped to New York State Department of Financial

Services 23 NYCRR 500

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.

Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
 Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Chief Information
Cybersecurity Program Cybersecurity Policy Security Officer

Section 500.02 Section 500.03 Section 500.04

, Routers and Switches
Penetration Testing and
Vulnerability Audit Trail Access Privileges
Assessments

Section 500.05 Section 500.06 Section 500.07

X

X
X
X
X
X
X
X
X
X
X
X
X
X

X
X

X
X X
X X
X X
X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
X
X
X

X
X

X
 Cybersecurity Personnel
Application Security Risk Assessment and Intelligence

Section 500.08 Section 500.09 Section 500.10

 X
X

X
X
X

X
X

X
X
X
X
X
X
X

X
Third Party Information Multi-Factor Limitations on Data
Security Policy Authentication Retention

Section 500.11 Section 500.12 Section 500.13

X
X

X
X
X

X
X
X
X

X
X
X

X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X
 Training and Encryption of Nonpublic
Monitoring Information Incident Response Plan

Section 500.14 Section 500.15 Section 500.16

X

X
X
X
X
X

X
X

X
X

X
X
X

X
X
X

X
X

X
 CIS Controls v7.1 mapped to the Victorian Protective Data Security
Framework (v1.0)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4
 System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8
Critical Security Control #9: Limitation and Control of Network Ports
System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1
 Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12
Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

Controls v7.1 mapped to the Victorian Protective Data Security

Framework (v1.0)

urity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
urity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
urity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

urity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.
 Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
urity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
urity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
urity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
urity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
urity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
urity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
urity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
urity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.
 Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
urity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

urity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
urity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
urity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

 Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
urity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
urity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
urity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
urity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Security Management Security Risk Security Policies and

Framework Management Procedures

Standard 1 Standard 2 Standard 3

, Routers and Switches
 Security Training and
Information Access Security Obligations Awareness

Standard 4 Standard 5 Standard 6

X
X

X
X
X

X
X
X
X

X
X
X
X
X

X
X

X
X

X
X
X
X
X
X
X

X
X
X
X
X
X

X
X

X
X
X

X
Security Incident Business Continuity Contracted Service
Management Management Providers

Standard 7 Standard 8 Standard 9

X X

X X

X X

X X

X X

X X

X X

X X
Government Services Security Plans Compliance

Standard 10 Standard 11 Standard 12

 Information
Information Value Management Information Sharing

Standard 13 Standard 14 Standard 15

 Information
Communications
Personnel Lifecycle Technology (ICT) Physical Lifecycle
Lifecycle

Standard 16 Standard 17 Standard 18

 CIS Controls v7.1 mapped to ANSSI's 40 Essential Measures for a Healthy
Network
(www.ssi.gouv.fr/systemesindustriels)

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1
 System 2.2

System 2.3

System 2.4

System 2.5

System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

 System 4.1

System 4.2

System 4.3

System 4.4

System 4.5

System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4
 System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3
 System 8.4

System 8.5

System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4
 Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1

Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11
 Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2

Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6
Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1

Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6
Application 16.7

Application 16.8

Application 16.9

Application 16.10

Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2
Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9

Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6
Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4

Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

ntrols v7.1 mapped to ANSSI's 40 Essential Measures for a Healthy

Network
(www.ssi.gouv.fr/systemesindustriels)

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all assets, whether connected to the organization's
network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.
 Ensure that only software applications or operating systems currently supported and receiving
vendor updates are added to the organization's authorized software inventory. Unsupported
software should be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.

Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1,*.py, macros, etc.) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incurs higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning
tool to automatically scan all systems on the network on a weekly or more frequent basis to identify
all potential vulnerabilities on the organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have
been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

 Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not Internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading email, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.

Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented security configuration standards for all authorized operating systems and
software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as an event source, date, user,
timestamp, source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
 Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tools for log correlation
and analysis

On a regular basis, review logs to identify anomalies or abnormal events.

On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.

Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM)
standards.
Block all email attachments entering the organization's email gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) and Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
 Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.
curity Control #9: Limitation and Control of Network Ports
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on a regular basis.
Ensure that all of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one offline (i.e., not accessible via a network connection)
backup destination.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configurations against approved security configurations defined for
each network device in use, and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
 Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading email, composing documents,
or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.

Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
 Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located on-site or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.

Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.

Only allow access to authorized cloud storage or email providers.

Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally

and compromise neighboring systems, through technologies such as private VLANs or micro
segmentation.

Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located on-site or at a remote service
provider, and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
 Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when the data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.

Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication
(NFC)], unless such access is required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
on-site or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed on-site
or by a third-party provider.

Encrypt or hash with a salt all authentication credentials when stored.

Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.

Maintain an inventory of all accounts organized by authentication system.

 Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor. Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.

Automatically disable dormant accounts after a set period of inactivity.

Ensure that all accounts have an expiration date that is monitored and enforced.

Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and
duration.
curity Control #17: Implement a Security Awareness and Training Program
Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards, and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams, and impersonation calls.
Train workforce members on how to identify and properly store, transfer, archive, and destroy
sensitive information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train workforce members to be able to identify the most common indicators of an incident and be
able to report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.
 Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.

Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and non-production systems. Developers should not
have unmonitored access to production environments.

Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that define roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals, and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and
Information Sharing and Analysis Center (ISAC) partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents, to the incident handling team. Such information should be included in routine employee
awareness activities.
 Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responder’s technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, emails
or documents containing passwords or other information critical to system operation.

Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Team results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)

Create and apply

Have an accurate map Keep an exhaustive procedures for the
of IT installations and inventory of privileged arrival and departure of
accounts and ensure
keep it updated. this is updated. users (personnel,
interns, etc.).

1 2 3
X
X
X

X
X
X

X
X
X

X
X
X
s, Routers and Switches
 Know how all software
Limit the number of components are
Internet access points Prohibit the connection updated and keep up to
for the company to of personal devices to date on the
the organisation's
those that are strictly information system. vulnerabilities of these
necessary. components and their
required updates.

4 5 6
X

X
X
X
X
X X

X X

X X

X X

X X

X X

X X

X X

X X

X X

X X
X X
 Identify each individual
Define and strictly accessing the system by Set rules for the choice
apply an update policy. and size of passwords.
name.

7 8 9
X X
X X

X X
X X
X X

X X

X X
X X
X X
X X

X X

X X
X X
X X

X X

X X
X X
X X
X X
X X
X X
X X
X X

X X
X X
X X
X X
X X
X X
 Systematically renew
default authentication
Set in place technical Do not store passwords settings (password,
methods to enable in plain sight in files on certificates) on devices
authentication rules to
be followed. information systems. (network switches,
routers, servers,
printers).

10 11 12
X X X
X X X

X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X

X X X

X X X
X X X
X X X

X X X

X X X
X X X
X X X
X X X
X X X
X X X
X X X
X X X

X X X
X X X
X X X
X X X
X X X
X X X
 Technically prevent the
connection of portable
Opt, where possible, for Implement a uniform media except where
strong, smart card level of security across strictly necessary;
deactivate the
authentication. the entire IT stock. execution of the
autorun functions from
these types of media.

13 14 15
X
X

X
X
X

X
X
X
X

X
X
X

X
X

X
X
X
X

X
X
X
X
X
X
X
X
X

X
X
X
X
X
X
 Use an IT stock Manage portable
management tool that machines with a Wherever possible,
enables the security policy that is at prohibit remote
deployment of security connections to client
policies and updates to least as stringent as for machines.
machines. fixed machines.

16 17 18
X X

X X

X X

X X
X X
X X
X X
X X X

X X X

X X X

X X X

X X X
 Set in place
compartmentalised
Frequently audit (or networks. For machines
have audited) the or servers containing
Encrypt sensitive data, configuration of the information that is of
especially on mobile central directory (Active strategic importance to
machines and media
that may get lost. Directory in Windows the company, create a
environments or LDAP sub-network protected
directory for example). by a specific
interconnection
gateway.

19 20 21
X

X
X

X
X
X
X

X
X

X
X

X
X

X
 Avoid the use of
wireless (Wifi)
infrastructures. If the
use of these Systematically use Secure Internet
technologies cannot be secure applications and interconnection
avoided,
compartmentalise the protocols. gateways.
Wifi access network
from the rest of the
information system.

22 23 24
X

X
X

X
X
X
X
X
X

X
X
X

X
X
Ensure that there are
no machines on the
network with an Clearly define the
administration objectives of system Define event log
and network analysis methods.
interface that is monitoring.
accessible via the
Internet.

25 26 27
X X
X X
X X
X X
X X
X X
X X
X X
X

X
X
 Use a dedicated
network for the
Prohibit all access to administration of Do not grant
the Internet from machines or at least a administration
administration privileges to users.
accounts. network that is logically Make no exceptions.
separated from the
user network.

28 29 30
X X X
X X X

X X X
X X X
X X X

X X X

X X X
X X X
X X X
 Only authorise remote
access to the company
network, even for
network
administration, from
company machines that Robust control Keys to access the
use strong mechanisms for premises and alarm
premises access must codes must be
authentication imperatively be used. scrupulously protected.
mechanisms and
protect the integrity
and confidentiality of
traffic using robust
means.

31 32 33
X

X
X
 Develop a plan for IT
recovery and continuity
Do not leave access of activity, even if only
sockets to the internal Define rules for the use in outline, that is
network accessible in of printers and regularly updated,
locations that are open photocopiers. setting out how to
to the public. safeguard the
company's essential
data.

34 35 36
X
X
X

X
X
X
X

X
 Never simply deal with
the infection of a
machine without
Implement an alert and attempting to establish
reaction chain that all how the malware came Make users aware of
parties involved are to be installed on that the basic IT rules.
familiar with. machine, whether it has
spread elsewhere on
the network and what
data has been accessed.

37 38 39
X
X

X
X
X

X
X X

X X

X X

X X

X X

X X
X X

X X
Periodically carry out a
security audit (at least
annually). Each audit
must be accompanied
by an action plan, the
implementation of
which should be
monitored at the
highest level.

40
 CIS Controls v7.1 mapped to ?????

Critical Security Control #1: Inventory of Authorized and Unauthorized Devices

System 1.1

System 1.2

System 1.3

System 1.4

System 1.5

System 1.6

System 1.7

System 1.8

Critical Security Control #2: Inventory of Authorized and Unauthorized Software

System 2.1

System 2.2

System 2.3

System 2.4

System 2.5
 System 2.6

System 2.7

System 2.8

System 2.9

System 2.10

Critical Security Control #3: Continuous Vulnerability Assessment and Remediation

System 3.1

System 3.2

System 3.3

System 3.4

System 3.5

System 3.6

System 3.7

Critical Security Control #4: Controlled Use of Administrative Privileges

System 4.1

System 4.2

System 4.3

System 4.4

System 4.5
 System 4.6

System 4.7

System 4.8

System 4.9

Critical Security Control #5: Secure Configurations for Hardware and Software
System 5.1

System 5.2

System 5.3

System 5.4

System 5.5

Critical Security Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
System 6.1

System 6.2

System 6.3

System 6.4

System 6.5

System 6.6

System 6.7

System 6.8

Critical Security Control #7: Email and Web Browser Protections

 System 7.1

System 7.2

System 7.3

System 7.4

System 7.5

System 7.6

System 7.7

System 7.8

System 7.9

System 7.10

Critical Security Control #8: Malware Defenses

System 8.1

System 8.2

System 8.3

System 8.4

System 8.5

System 8.6

System 8.7

System 8.8

Critical Security Control #9: Limitation and Control of Network Ports

 System 9.1

System 9.2

System 9.3

System 9.4

System 9.5

Critical Security Control #10: Data Recovery Capabilities

System 10.1

System 10.2

System 10.3

System 10.4

System 10.5

Critical Security Control #11: Secure Configuration for Network Devices, such as Firewalls, Router
Network 11.1

Network 11.2

Network 11.3

Network 11.4

Network 11.5

Network 11.6

Network 11.7

Critical Security Control #12: Boundary Defense

Network 12.1
 Network 12.2

Network 12.3

Network 12.4

Network 12.5

Network 12.6

Network 12.7

Network 12.8

Network 12.9

Network 12.10

Network 12.11

Network 12.12

Critical Security Control #13: Data Protection

Network 13.1

Network 13.2
 Network 13.3

Network 13.4

Network 13.5

Network 13.6

Network 13.7

Network 13.8

Network 13.9

Critical Security Control #14: Controlled Access Based on the Need to Know

Application 14.1

Application 14.2

Application 14.3

Application 14.4

Application 14.5

Application 14.6

Application 14.7

Application 14.8

Application 14.9

Critical Security Control #15: Wireless Access Control

Network 15.1
 Network 15.2

Network 15.3

Network 15.4

Network 15.5

Network 15.6

Network 15.7

Network 15.8

Network 15.9

Network 15.10

Critical Security Control #16: Account Monitoring and Control

Application 16.1

Application 16.2

Application 16.3

Application 16.4

Application 16.5

Application 16.6

Application 16.7

Application 16.8

Application 16.9
Application 16.10
Application 16.11

Application 16.12

Application 16.13

Critical Security Control #17: Implement a Security Awareness and Training Program
Application 17.1

Application 17.2

Application 17.3

Application 17.4

Application 17.5

Application 17.6

Application 17.7

Application 17.8

Application 17.9

Critical Security Control #18: Application Software Security

Application 18.1

Application 18.2

Application 18.3

Application 18.4

Application 18.5

Application 18.6

Application 18.7

Application 18.8

Application 18.9
Application 18.10

Application 18.11

Critical Security Control #19: Incident Response and Management

Application 19.1

Application 19.2

Application 19.3

Application 19.4

Application 19.5

Application 19.6

Application 19.7

Application 19.8

Critical Security Control #20: Penetration Tests and Red Team Exercises
Application 20.1

Application 20.2

Application 20.3

Application 20.4
Application 20.5

Application 20.6

Application 20.7

Application 20.8
 CIS Controls

CIS Controls v7.1 mapped to ?????

curity Control #1: Inventory of Authorized and Unauthorized Devices

Utilize an active discovery tool to identify devices connected to the organization's network and
update the hardware asset inventory.
Utilize a passive discovery tool to identify devices connected to the organization's network and
automatically update the organization's hardware asset inventory.
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address
management tools to update the organization's hardware asset inventory.

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or
process information. This inventory shall include all hardware assets, whether connected to the
organization's network or not.

Ensure that the hardware asset inventory records the network address, hardware address, machine
name, data asset owner, and department for each asset and whether the hardware asset has been
approved to connect to the network.
Ensure that unauthorized assets are either removed from the network, quarantined or the inventory
is updated in a timely manner.

Utilize port level access control, following 802.1x standards, to control which devices can
authenticate to the network. The authentication system shall be tied into the hardware asset
inventory data to ensure only authorized devices can connect to the network.
Use client certificates to authenticate hardware assets connecting to the organization's trusted
network.
curity Control #2: Inventory of Authorized and Unauthorized Software
Maintain an up-to-date list of all authorized software that is required in the enterprise for any
business purpose on any business system.

Ensure that only software applications or operating systems currently supported by the software's
vendor are added to the organization's authorized software inventory. Unsupported software should
be tagged as unsupported in the inventory system.
Utilize software inventory tools throughout the organization to automate the documentation of all
software on business systems.
The software inventory system should track the name, version, publisher, and install date for all
software, including operating systems authorized by the organization.
The software inventory system should be tied into the hardware asset inventory so all devices and
associated software are tracked from a single location.
 Ensure that unauthorized software is either removed or the inventory is updated in a timely manner.
Utilize application whitelisting technology on all assets to ensure that only authorized software
executes and all unauthorized software is blocked from executing on assets.

The organization's application whitelisting software must ensure that only authorized software
libraries (such as *.dll, *.ocx, *.so, etc) are allowed to load into a system process.
The organization's application whitelisting software must ensure that only authorized, digitally
signed scripts (such as *.ps1, *.py, macros, etc) are allowed to run on a system.
Physically or logically segregated systems should be used to isolate and run software that is required
for business operations but incur higher risk for the organization.
curity Control #3: Continuous Vulnerability Assessment and Remediation
Utilize an up-to-date SCAP-compliant vulnerability scanning tool to automatically scan all systems on
the network on a weekly or more frequent basis to identify all potential vulnerabilities on the
organization's systems.

Perform authenticated vulnerability scanning with agents running locally on each system or with
remote scanners that are configured with elevated rights on the system being tested.

Use a dedicated account for authenticated vulnerability scans, which should not be used for any
other administrative activities and should be tied to specific machines at specific IP addresses.

Deploy automated software update tools in order to ensure that the operating systems are running
the most recent security updates provided by the software vendor.
Deploy automated software update tools in order to ensure that third-party software on all systems
is running the most recent security updates provided by the software vendor.
Regularly compare the results from back-to-back vulnerability scans to verify that vulnerabilities
have been remediated in a timely manner.

Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

curity Control #4: Controlled Use of Administrative Privileges

Use automated tools to inventory all administrative accounts, including domain and local accounts,
to ensure that only authorized individuals have elevated privileges.
Before deploying any new asset, change all default passwords to have values consistent with
administrative level accounts.
Ensure that all users with administrative account access use a dedicated or secondary account for
elevated activities. This account should only be used for administrative activities and not internet
browsing, email, or similar activities.
Where multi-factor authentication is not supported (such as local administrator, root, or service
accounts), accounts will use passwords that are unique to that system.

Use multi-factor authentication and encrypted channels for all administrative account access.
 Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring
administrative access. This machine will be segmented from the organization's primary network and
not be allowed Internet access. This machine will not be used for reading e-mail, composing
documents, or browsing the Internet.

Limit access to scripting tools (such as Microsoft PowerShell and Python) to only administrative or
development users with the need to access those capabilities.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.
Configure systems to issue a log entry and alert when an account is added to or removed from any
group assigned administrative privileges.
curity Control #5: Secure Configurations for Hardware and Software
Maintain documented, standard security configuration standards for all authorized operating
systems and software.

Maintain secure images or templates for all systems in the enterprise based on the organization's
approved configuration standards. Any new system deployment or existing system that becomes
compromised should be imaged using one of those images or templates.

Store the master images and templates on securely configured servers, validated with integrity
monitoring tools, to ensure that only authorized changes to the images are possible.
Deploy system configuration management tools that will automatically enforce and redeploy
configuration settings to systems at regularly scheduled intervals.

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to
verify all security configuration elements, catalog approved exceptions, and alert when unauthorized
changes occur.
curity Control #6: Maintenance, Monitoring, and Analysis of Audit Logs
Use at least three synchronized time sources from which all servers and network devices retrieve
time information on a regular basis so that timestamps in logs are consistent.

Ensure that local logging has been enabled on all systems and networking devices.
Enable system logging to include detailed information such as a event source, date, user, timestamp,
source addresses, destination addresses, and other useful elements.

Ensure that all systems that store logs have adequate storage space for the logs generated.
Ensure that appropriate logs are being aggregated to a central log management system for analysis
and review.
Deploy Security Information and Event Management (SIEM) or log analytic tool for log correlation
and analysis.
On a regular basis, review logs to identify anomalies or abnormal events.
On a regular basis, tune your SIEM system to better identify actionable events and decrease event
noise.
curity Control #7: Email and Web Browser Protections
 Ensure that only fully supported web browsers and email clients are allowed to execute in the
organization, ideally only using the latest version of the browsers and email clients provided by the
vendor.

Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

Enforce network-based URL filters that limit a system's ability to connect to websites not approved
by the organization. This filtering shall be enforced for each of the organization's systems, whether
they are physically at an organization's facilities or not.

Subscribe to URL categorization services to ensure that they are up-to-date with the most recent
website category definitions available. Uncategorized sites shall be blocked by default.

Log all URL requests from each of the organization's systems, whether onsite or a mobile device, in
order to identify potentially malicious activity and assist incident handlers with identifying
potentially compromised systems.
Use DNS filtering services to help block access to known malicious domains.

To lower the chance of spoofed or modified emails from valid domains, implement Domain-based
Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by
implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail(DKIM)
standards.
Block all e-mail attachments entering the organization's e-mail gateway if the file types are
unnecessary for the organization's business.

Use sandboxing to analyze and block inbound email attachments with malicious behavior.
curity Control #8: Malware Defenses
Utilize centrally managed anti-malware software to continuously monitor and defend each of the
organization's workstations and servers.

Ensure that the organization's anti-malware software updates its scanning engine and signature
database on a regular basis.

Enable anti-exploitation features such as Data Execution Prevention (DEP) or Address Space Layout
Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that
can be configured to apply protection to a broader set of applications and executables.
Configure devices so that they automatically conduct an anti-malware scan of removable media
when inserted or connected.
Configure devices to not auto-run content from removable media.
Send all malware detection events to enterprise anti-malware administration tools and event log
servers for analysis and alerting.
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious
domains.

Enable command-line audit logging for command shells, such as Microsoft Powershell and Bash.
curity Control #9: Limitation and Control of Network Ports
 Associate active ports, services and protocols to the hardware assets in the asset inventory.

Ensure that only network ports, protocols, and services listening on a system with validated business
needs, are running on each system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports
are detected on a system.
Apply host-based firewalls or port filtering tools on end systems, with a default-deny rule that drops
all traffic except those services and ports that are explicitly allowed.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the
server. Any unauthorized traffic should be blocked and logged.
curity Control #10: Data Recovery Capabilities
Ensure that all system data is automatically backed up on regular basis.
Ensure that each of the organization's key systems are backed up as a complete system, through
processes such as imaging, to enable the quick recovery of an entire system.
Test data integrity on backup media on a regular basis by performing a data restoration process to
ensure that the backup is properly working.

Ensure that backups are properly protected via physical security or encryption when they are stored,
as well as when they are moved across the network. This includes remote backups and cloud
services.

Ensure that all backups have at least one backup destination that is not continuously addressable
through operating system calls.
curity Control #11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Maintain standard, documented security configuration standards for all authorized network devices.

All configuration rules that allow traffic to flow through network devices should be documented in a
configuration management system with a specific business reason for each rule, a specific
individual’s name responsible for that business need, and an expected duration of the need.
Compare all network device configuration against approved security configurations defined for each
network device in use and alert when any deviations are discovered.

Install the latest stable version of any security-related updates on all network devices.
Manage all network devices using multi-factor authentication and encrypted sessions.

Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring
elevated access. This machine shall be segmented from the organization's primary network and not
be allowed Internet access. This machine shall not be used for reading e-mail, composing
documents, or surfing the Internet.

Manage the network infrastructure across network connections that are separated from the
business use of that network, relying on separate VLANs or, preferably, on entirely different physical
connectivity for management sessions for network devices.
curity Control #12: Boundary Defense
Maintain an up-to-date inventory of all of the organization's network boundaries.
 Perform regular scans from outside each trusted network boundary to detect any unauthorized
connections which are accessible across the boundary.

Deny communications with known malicious or unused Internet IP addresses and limit access only to
trusted and necessary IP address ranges at each of the organization's network boundaries,.

Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only
authorized protocols are allowed to cross the network boundary in or out of the network at each of
the organization's network boundaries.

Configure monitoring systems to record network packets passing through the boundary at each of
the organization's network boundaries.

Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack
mechanisms and detect compromise of these systems at each of the organization's network
boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each
of the organization's network boundaries.

Enable the collection of NetFlow and logging data on all network boundary devices.

Ensure that all network traffic to or from the Internet passes through an authenticated application
layer proxy that is configured to filter unauthorized connections.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However,
the organization may use whitelists of allowed sites that can be accessed through the proxy without
decrypting the traffic.
Require all remote login access to the organization's network to encrypt data in transit and use
multi-factor authentication.
Scan all enterprise devices remotely logging into the organization's network prior to accessing the
network to ensure that each of the organization's security policies has been enforced in the same
manner as local network devices.
curity Control #13: Data Protection

Maintain an inventory of all sensitive information stored, processed, or transmitted by the

organization's technology systems, including those located onsite or at a remote service provider.

Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand alone systems (disconnected from the network) by the
business unit needing to occasionally use the system or completely virtualized and powered off until
needed.
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of
sensitive information and blocks such transfers while alerting information security professionals.
Only allow access to authorized cloud storage or email providers.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.

Utilize approved whole disk encryption software to encrypt the hard drive of all mobile devices.

If USB storage devices are required, enterprise software should be used that can configure systems
to allow the use of specific devices. An inventory of such devices should be maintained.

Configure systems not to write data to external removable media, if there is no business need for
supporting such devices.

If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

curity Control #14: Controlled Access Based on the Need to Know

Segment the network based on the label or classification level of the information stored on the
servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).
Enable firewall filtering between VLANs to ensure that only authorized systems are able to
communicate with other systems necessary to fulfill their specific responsibilities.

Disable all workstation to workstation communication to limit an attacker's ability to move laterally
and compromise neighboring systems, through technologies such as Private VLANs or
microsegmentation.
Encrypt all sensitive information in transit.

Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted
by the organization's technology systems, including those located onsite or at a remote service
provider and update the organization's sensitive information inventory.

Protect all information stored on systems with file system, network share, claims, application, or
database specific access control lists. These controls will enforce the principle that only authorized
individuals should have access to the information based on their need to access the information as a
part of their responsibilities.
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data
even when data is copied off a system.

Encrypt all sensitive information at rest using a tool that requires a secondary authentication
mechanism not integrated into the operating system, in order to access the information.

Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools
such as File Integrity Monitoring or Security Information and Event Monitoring).
curity Control #15: Wireless Access Control
Maintain an inventory of authorized wireless access points connected to the wired network.
 Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access
points connected to the wired network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless
access points connected to the network.

Disable wireless access on devices that do not have a business purpose for wireless access.

Configure wireless access on client machines that do have an essential wireless business purpose, to
allow access only to authorized wireless networks and to restrict access to other wireless networks.

Disable peer-to-peer (adhoc) wireless network capabilities on wireless clients.

Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

Ensure that wireless networks use authentication protocols such as Extensible Authentication
Protocol-Transport Layer Security (EAP/TLS), that requires mutual, multi-factor authentication.

Disable wireless peripheral access of devices (such as Bluetooth and NFC), unless such access is
required for a business purpose.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this
network should be treated as untrusted and filtered and audited accordingly.
curity Control #16: Account Monitoring and Control
Maintain an inventory of each of the organization's authentication systems, including those located
onsite or at a remote service provider.
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.
Require multi-factor authentication for all user accounts, on all systems, whether managed onsite or
by a third-party provider.
Encrypt or hash with a salt all authentication credentials when stored.
Ensure that all account usernames and authentication credentials are transmitted across networks
using encrypted channels.
Maintain an inventory of all accounts organized by authentication system.

Establish and follow an automated process for revoking system access by disabling accounts
immediately upon termination or change of responsibilities of an employee or contractor . Disabling
these accounts, instead of deleting accounts, allows preservation of audit trails.

Disable any account that cannot be associated with a business process or business owner.
Automatically disable dormant accounts after a set period of inactivity.
Ensure that all accounts have an expiration date that is monitored and enforced.
Automatically lock workstation sessions after a standard period of inactivity.

Monitor attempts to access deactivated accounts through audit logging.

Alert when users deviate from normal login behavior, such as time-of-day, workstation location and
duration.
curity Control #17: Implement a Security Awareness and Training Program
 Perform a skills gap analysis to understand the skills and behaviors workforce members are not
adhering to, using this information to build a baseline education roadmap.
Deliver training to address the skills gap identified to positively impact workforce members' security
behavior.

Create a security awareness program for all workforce members to complete on a regular basis to
ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of
the organization. The organization's security awareness program should be communicated in a
continuous and engaging manner.

Ensure that the organization's security awareness program is updated frequently (at least annually)
to address new technologies, threats, standards and business requirements.

Train workforce members on the importance of enabling and utilizing secure authentication.
Train the workforce on how to identify different forms of social engineering attacks, such as
phishing, phone scams and impersonation calls.
Train workforce on how to identify and properly store, transfer, archive and destroy sensitive
information.

Train workforce members to be aware of causes for unintentional data exposures, such as losing
their mobile devices or emailing the wrong person due to autocomplete in email.
Train employees to be able to identify the most common indicators of an incident and be able to
report such an incident.
curity Control #18: Application Software Security
Establish secure coding practices appropriate to the programming language and development
environment being used.
For in-house developed software, ensure that explicit error checking is performed and documented
for all input, including for size, data type, and acceptable ranges or formats.

Verify that the version of all software acquired from outside your organization is still supported by
the developer or appropriately hardened based on developer security recommendations.

Only use up-to-date and trusted third-party components for the software developed by the
organization.
Use only standardized and extensively reviewed encryption algorithms.
Ensure that all software development personnel receive training in writing secure code for their
specific development environment and responsibilities.
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to
for internally developed software.
Establish a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to contact your security group.
Maintain separate environments for production and nonproduction systems. Developers should not
have unmonitored access to production environments.
 Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic
flowing to the web application for common web application attacks. For applications that are not
web-based, specific application firewalls should be deployed if such tools are available for the given
application type. If the traffic is encrypted, the device should either sit behind the encryption or be
capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web
application firewall should be deployed.

For applications that rely on a database, use standard hardening configuration templates. All
systems that are part of critical business processes should also be tested.
curity Control #19: Incident Response and Management
Ensure that there are written incident response plans that defines roles of personnel as well as
phases of incident handling/management.

Assign job titles and duties for handling computer and network incidents to specific individuals and
ensure tracking and documentation throughout the incident through resolution.
Designate management personnel, as well as backups, who will support the incident handling
process by acting in key decision-making roles.

Devise organization-wide standards for the time required for system administrators and other
workforce members to report anomalous events to the incident handling team, the mechanisms for
such reporting, and the kind of information that should be included in the incident notification.

Assemble and maintain information on third-party contact information to be used to report a

security incident, such as Law Enforcement, relevant government departments, vendors, and ISAC
partners.

Publish information for all workforce members, regarding reporting computer anomalies and
incidents to the incident handling team. Such information should be included in routine employee
awareness activities.

Plan and conduct routine incident response exercises and scenarios for the workforce involved in
the incident response to maintain awareness and comfort in responding to real world threats.
Exercises should test communication channels, decision making, and incident responders technical
capabilities using tools and data available to them.

Create incident scoring and prioritization schema based on known or potential impact to your
organization. Utilize score to define frequency of status updates and escalation procedures.
curity Control #20: Penetration Tests and Red Team Exercises
Establish a program for penetration tests that includes a full scope of blended attacks, such as
wireless, client-based, and web application attacks.
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors
that can be used to exploit enterprise systems successfully.
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or
to respond quickly and effectively.

Include tests for the presence of unprotected system information and artifacts that would be useful
to attackers, including network diagrams, configuration files, older penetration test reports, e-mails
or documents containing passwords or other information critical to system operation.
Create a test bed that mimics a production environment for specific penetration tests and Red Team
attacks against elements that are not typically tested in production, such as attacks against
supervisory control and data acquisition and other control systems.

Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability
scanning assessments should be used as a starting point to guide and focus penetration testing
efforts.

Wherever possible, ensure that Red Teams results are documented using open, machine-readable
standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so
that results can be compared over time.

Any user or system accounts used to perform penetration testing should be controlled and
monitored to make sure they are only being used for legitimate purposes, and are removed or
restored to normal function after testing is over.
Master Mappings Tool (v7.1c)
s, Routers and Switches