CIS Controls v8

CIS 1 — Inventory of Enterprise Assets

Actively manage all hardware assets on the network so that only authorised devices are given access. Unauthorised assets are found and removed promptly.

CIS 2 — Inventory of Software Assets

Actively manage all software on the network — only authorised software is installed and can execute. Unsupported/unauthorised software is removed.

CIS 3 — Data Protection

Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.

CIS 4 — Secure Configuration

Establish and maintain secure configurations for all enterprise assets and software — using CIS Benchmarks as the baseline.

CIS 5 — Account Management

Use processes and tools to assign and manage authorisation to credentials for user accounts — including privileged and service accounts.

CIS 6 — Access Control Management

Use processes and tools to create, assign, manage, and revoke access credentials based on the principle of least privilege.

CIS 12 — Network Infrastructure Management

Establish, implement, and actively manage network devices to prevent attackers from exploiting vulnerable network services.

CIS 17 — Incident Response Management

Establish a programme to develop and maintain an incident response capability to prepare, detect, contain, and recover from incidents.