CIS20 Control

Posted Jul 16, 2020 Updated Oct 30, 2022

By Grace L

87 min read

[toc]

CIS20 Control

The CIS Controls™ are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks. The CIS Controls are developed by a community of IT experts who apply their first-hand experience as cyber defenders to create these globally accepted security best practices. The experts who develop the CIS Controls come from a wide range of sectors including retail, manufacturing, healthcare, education, government, defense, and others.

basic, Foundational, organizational

1 Inventory and Control of Hardware Assets

Actively manage (inventory, track, and correct) all hardware devices on the network so only authorized devices are given access, and unauthorized and unmanaged devices are found and prevented from gaining access.

Hardware Assets Inventory

1.1.1 Utilize an Active Discovery Tool

Devices
Identify
Utilize an active discovery tool to
- identify devices connected to the organization's network
- and update the hardware asset inventory.

1.1.2 Use a Passive Asset Discovery Tool

Devices
Identify
Utilize a passive discovery tool to
- identify devices connected to the organization's network
- and automatically update the organization's hardware asset inventory.

1.1.3 Use DHCP Logging to Update Asset Inventory

Devices
Identify
Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers
or IP address management tools to update the organization’s hardware asset inventory.

1.1.4 Maintain Detailed Asset Inventory

Devices
Identify
Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or process information.
This inventory shall include all hardware assets, whether connected to the organization’s network or not.

1.1.5 Maintain Asset Inventory Information

Devices
Identify
Ensure that the hardware asset inventory records
- the network address, hardware address, machine name, data asset owner, and department for each asset
- and whether the hardware asset has been approved to connect to the network.

1.1.6 Address Unauthorized Assets

Devices
Respond
Ensure that unauthorized assets are
- either removed from the network, quarantined,
- or the inventory is updated in a timely manner.

1.1.7 Deploy Port Level Access Control

Devices
Protect
Utilize port level access control,
- following 802.1x standards, to control which devices can authenticate to the network.
The authentication system shall be tied into the hardware asset inventory data to ensure only authorized devices can connect to the network.

1.1.8 Utilize Client Certificates to Authenticate Hardware Assets

Devices
Protect
Use client certificates to authenticate hardware assets connecting to the organization’s trusted network.

–

2 Inventory and Control of Software Assets

Actively manage (inventory, track, and correct) all software on the network so that only authorized software is installed and can execute, unauthorized and unmanaged software is found and prevented from installation or execution.

Software Assets Inventory

2.2.1 Maintain Inventory of Authorized Software

Applications
Identify
Maintain an up-to-date list of all authorized software that is required in the enterprise for any business purpose on any business system.

2.2.2 Ensure Software is Supported by Vendor

Applications
Identify
Ensure that only software app or os currently supported and receiving vendor updates are added to the organization’s authorized software inventory.
Unsupported software should be tagged as unsupported in the inventory system.

2.2.3 Utilize Software Inventory Tools

Applications
Identify
Utilize software inventory tools throughout the organization to automate the documentation of all software on business systems.

2.2.4 Track Software Inventory Information

Applications
Identify
The software inventory system should track the name, version, publisher, and install date for all software, including operating systems authorized by the organization.

2.2.5 Integrate Software and Hardware Asset Inventories

Applications
Identify
The software inventory system should be tied into the hardware asset inventory so all devices and associated software are tracked from a single location.

2.2.6 Address unapproved software

Applications
Respond
Ensure that unauthorized software is either removed or the inventory is updated in a timely manner

2.2.7 Utilize `Application` Whitelisting

Applications
Protect
Utilize application whitelisting technology on all assets to ensure that only authorized software executes and all unauthorized software is blocked from executing on assets.

2.2.8 Implement Application Whitelisting of `Libraries`

Applications
Protect
The organization’s application whitelisting software must ensure that only authorized software libraries (such as \*.dll, \*.ocx, \*.so, etc.) are allowed to load into a system process.

2.2.9 Implement Application Whitelisting of `Scripts`

Applications
Protect
The organization’s application whitelisting software must ensure that only authorized, digitally signed scripts (such as *.ps1, *.py, macros, etc.) are allowed to run on a system.

2.2.10 Physically or Logically Segregate High Risk Applications

Applications
Protect
Physically or logically segregated systems should be used to isolate and run software that is required for business operations but incurs higher risk for the organization.

3 Continuous Vulnerability Management

Continuously acquire, assess, and take action on new information in order to identify vulnerabilities, remediate, and minimize the window of opportunity for attackers.

3.3.1 Run `Automated Vulnerability Scanning Tools`

Applications
Detect
Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning tool to automatically scan all systems on the network on a weekly or more frequent basis to identify all potential vulnerabilities on the organization’s systems.

3.3.2 Perform `Authenticated Vulnerability Scanning`

Applications
Detect
Perform authenticated vulnerability scanning
- with agents running locally on each system
- or with remote scanners that are configured with elevated rights on the system being tested.

3.3.3 Protect `Dedicated Assessment Accounts`

Users
Protect
Use a dedicated account for authenticated vulnerability scans,
- should not be used for any other administrative activities
- should be tied to specific machines at specific IP addresses.

3.3.4 Deploy `Automated Operating System Patch Management Tools`

Applications
Protect
Deploy automated software update tools to ensure that the operating systems are running the most recent security updates provided by the software vendor.

3.3.5 Deploy `Automated Software Patch Management Tools`

Applications
Protect
Deploy automated software update tools to ensure that third-party software on all systems is running the most recent security updates provided by the software vendor.

3.3.6 Compare Back-to-Back Vulnerability Scans

Applications
Respond
Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have been remediated in a timely manner.

3.3.7 Utilize a `Risk-Rating` Process

Applications
Respond
Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.

4. Controlled Use of Administrative Privileges

The processes and tools used to track/control/prevent/correct the use, assignment, and configuration of administrative privileges on computers, networks, and applications.

4.4.1 Maintain Inventory of Administrative Accounts

Users
Detect
Use automated tools to inventory all administrative accounts,
- including domain and local accounts,
- to ensure that only authorized individuals have elevated privileges.

4.4.2 Change Default Passwords

Users
Protect
Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts.

4.4.3 Ensure the Use of Dedicated Administrative Accounts

Users
Protect
Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities.

4.4.4 Use Unique Passwords

Users
Protect
Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system.

4.4.5 Use Multi-Factor Authentication for All Administrative Access

Users
Protect
Use multi-factor authentication and encrypted channels for all administrative account access.

4.4.6 Use `Dedicated Workstations For All Administrative Tasks`

Users
Protect
Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring administrative access.
This machine
- will be segmented from the organization's primary network
- and not be allowed Internet access.
- and will not be used for reading e-mail, composing documents, or browsing the Internet.

4.4.7 Limit Access to Script Tools

Users
Protect
Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or development users with the need to access those capabilities.

4.4.8 Log and Alert on Changes to Administrative Group Membership

Users
Detect
Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges.

Users
Detect
Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.

5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers

Establish, implement, and actively manage (track, report on, correct) the security configuration of mobile devices, laptops, servers, and workstations using a rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings.

5.5.1 Establish Secure Configurations

Applications
Protect
Maintain documented security configuration standards for all authorized operating systems and software.

5.5.2 Maintain `Secure Images`

Applications
Protect
Maintain secure images or templates for all systems in the enterprise based on the organization’s approved configuration standards.
Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates.

5.5.3 Securely Store Master Images

Applications
Protect
Store the master images and templates on securely configured servers, validated with integrity monitoring tools, to ensure that only authorized changes to the images are possible.

5.5.4 Deploy `System Configuration Management Tools`

Applications
Protect
Deploy system configuration management tools that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals.

5.5.5 Implement Automated Configuration Monitoring Systems

Applications
Detect
Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to verify all security configuration elements, catalog approved exceptions, and alert when unauthorized changes occur.

6 Maintenance, Monitoring and Analysis of Audit Logs

Collect, manage, and analyze audit logs of events that could help detect, understand, or recover from an attack.

6.6.1 Utilize `Three Synchronized Time Sources`

Network
Detect
Use at least three synchronized time sources from which all servers and network devices retrieve time information on a regular basis so that timestamps in logs are consistent.

6.6.2 Activate `Audit Logging`

Network
Detect
Ensure that local logging has been enabled on all systems and networking devices.

6.6.3 Enable Detailed Logging

Network
Detect
Enable system logging to include detailed information such as a event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.

6.6.4 Ensure `Adequate Storage for Logs`

Network
Detect
Ensure that all systems that store logs have adequate storage space for the logs generated.

6.6.5 `Central Log Management`

Network
Detect
Ensure that appropriate logs are being aggregated to a central log management system for analysis and review.

6.6.6 Deploy `SIEM or Log Analytic Tools`

Network
Detect
Deploy Security Information and Event Management (SIEM) or log analytic tool for log correlation and analysis.

6.6.7 Regularly `Review Logs`

Network
Detect
On a regular basis, review logs to identify anomalies or abnormal events.

6.6.8 Regularly `Tune SIEM`

Network
Detect
On a regular basis, tune your SIEM system to better identify actionable events and decrease event noise.

7 Email and Web Browser Protections

Minimize the attack surface and the opportunities for attackers to manipulate human behavior though their interaction with web browsers and email systems.

7.7.1 Ensure Use of Only Fully Supported Browsers and Email Clients

Applications
Protect
Ensure that only fully supported web browsers and email clients are allowed to execute in the organization,
ideally only using the latest version of the browsers and email clients provided by the vendor.

7.7.2 Disable Unnecessary or Unauthorized Browser or Email Client `Plugins`

Applications
Protect
Uninstall or disable any unauthorized browser or email client plugins or add-on applications.

7.7.3 Limit Use of Scripting Languages in Web Browsers and Email Clients

Applications
Protect
Ensure that only authorized scripting languages are able to run in all web browsers and email clients.

7.7.4 Maintain and Enforce `Network-Based URL Filters`

Network
Protect
Enforce network-based URL filters that limit a system’s ability to connect to websites not approved by the organization.
This filtering shall be enforced for each of the organization’s systems, whether they are physically at an organization’s facilities or not.

Network
Protect
Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent website category definitions available.
Uncategorized sites shall be blocked by default.

7.7.6 `Log All URL requester`

Network
Detect
Log all URL requests from each of the organization’s systems, whether on-site or a mobile device, in order to identify potentially malicious activity and assist incident handlers with identifying potentially compromised systems.

7.7.7 Use of `DNS Filtering Services`

Network
Protect
Use Domain Name System (DNS) filtering services to help block access to known malicious domains.

7.7.8 `Implement DMARC and Enable Receiver-Side Verification` ???

Network
Protect
To lower the chance of spoofed or modified emails from valid domains, implement Domain-based Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail(DKIM) standards.

7.7.9 Block `Unnecessary File Types`

Network
Protect
Block all email attachments entering the organization’s email gateway if the file types are unnecessary for the organization’s business.

7.7.10 Sandbox All Email Attachments

Network
Protect
Use sandboxing to analyze and block inbound email attachments with malicious behavior.

8 Malware Defenses

Control the installation, spread, and execution of malicious code at multiple points in the enterprise, while optimizing the use of automation to enable rapid updating of defense, data gathering, and corrective action.

8.8.1 Utilize `Centrally Managed Anti-malware Software`

Devices
Protect
Utilize centrally managed anti-malware software to continuously monitor and defend each of the organization’s workstations and servers.

8.8.2 Ensure Anti-Malware Software and Signatures Are Updated

Devices
Protect
Ensure that the organization’s anti-malware software updates its scanning engine and signature database on a regular basis.

8.8.3 Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit Technologies ???

Devices
Protect
Enable anti-exploitation features such as Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that can be configured to apply protection to a broader set of applications and executables.

8.8.4 Configure `Anti-Malware Scanning of Removable Devices`

Devices
Detect
Configure devices so that they automatically conduct an anti-malware scan of removable media when inserted or connected.

8.8.5 Configure Devices to Not Auto-Run Content

Devices
Protect
Configure devices to not auto-run content from removable media.

8.8.6 `Centralize Anti-Malware Logging`

Devices
Detect
Send all malware detection events to enterprise anti-malware administration tools and event log servers for analysis and alerting.

8.8.7 Enable `DNS Query Logging`

Network
Detect
Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious domains.

8.8.8 Enable Command-Line Audit Logging

Devices
Detect
Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.

9 Limitation and Control of Network Ports, Protocols, and Services

Manage (track/control/correct) the ongoing operational use of ports, protocols, and services on networked devices in order to minimize windows of vulnerability available to attackers.

9.9.1 Associate Active Ports, Services, and Protocols to Asset Inventory

Devices
Identify
Associate active ports, services, and protocols to the hardware assets in the asset inventory.

9.9.2 Ensure Only Approved Ports, Protocols, and Services Are Running

Devices
Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system.

9.9.3 Perform `Regular Automated Port Scans`

Devices
Detect
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports are detected on a system.

9.9.4 Apply `Host-Based Firewalls or Port-Filtering`

Devices
Protect
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.

9.9.5 Implement `Application Firewalls`

Devices
Protect
Place application firewalls in front of any critical servers to verify and validate the traffic going to the server. Any unauthorized traffic should be blocked and logged.

10 Data Recovery Capabilities

The processes and tools used to properly back up critical information with a proven methodology for timely recovery of it.

10.10.1 Ensure `Regular Automated BackUps`

Data
Protect
Ensure that all system data is automatically backed up on a regular basis.

10.10.2 Perform `Complete System Backups`

Data
Protect
Ensure that all of the organization’s key systems are backed up as a complete system,
through processes such as imaging, to enable the quick recovery of an entire system.

10.10.3 Test Data on Backup Media

Data
Protect

10.10.4 Protect Backups

Data
Protect
Ensure that backups are properly protected via physical security or encryption when they are stored, as well as when they are moved across the network.
This includes remote backups and cloud services.

10.10.5 Ensure All Backups Have `at Least One Offline Backup Destination`

Data
Protect
Ensure that all backups have at least one offline (i.e., not accessible via a network connection) backup destination.

11 Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

Establish, implement, and actively manage (track, report on, correct) the security configuration of network infrastructure devices using a rigorous 严密的; 缜密的 configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings.

11.11.1 Maintain `Standard Security Configurations` for Network Devices

Network
Identify
Maintain documented security configuration standards for all authorized network devices.

11.11.2 Document `Traffic Configuration Rules`

Network
Identify
All configuration rules that allow traffic to flow through network devices should be documented in a configuration management system with a specific business reason for each rule, a specific individual’s name responsible for that business need, and an expected duration of the need.

11.11.3 Use `Automated Tools to Verify Standard Device Configurations and Detect Changes`

Network
Detect
Compare all network device configuration against approved security configurations defined for each network device in use, and alert when any deviations are discovered.

Network
Protect
Install the latest stable version of any security-related updates on all network devices.

11.11.5 Manage Network Devices Using `Multi-Factor Authentication and Encrypted Sessions`

Network
Protect
Manage all network devices using multi-factor authentication and encrypted sessions.

11.11.6 Use `Dedicated Machines` For All Network Administrative Tasks

Network
Protect
Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring elevated access.
This machine shall
- be segmented from the organization’s primary network
- and not be allowed Internet access.
- shall not be used for reading email, composing documents, or surfing the Internet.

11.11.7 Manage Network Infrastructure Through a `Dedicated Network`

Network
Protect
Manage the network infrastructure across network connections that are separated from the business use of that network, relying on separate VLANs or, preferably, on entirely different physical connectivity for management sessions for network devices.

12 Boundary Defense

Detect/prevent/correct the flow of information transferring networks of different trust levels with a focus on security-damaging data.

12.12.1 Maintain an Inventory of Network Boundaries

Network
Identify
Maintain an up-to-date inventory of all of the organization's network boundaries.

12.12.2 `Scan for Unauthorized Connections` Across Trusted Network Boundaries

Network
Detect
Perform regular scans from outside each trusted network boundary to detect any unauthorized connections which are accessible across the boundary.

12.12.3 Deny Communications With `Known Malicious IP Addresses`

Network
Protect
Deny communications with known malicious or unused Internet IP addresses and limit access only to trusted and necessary IP address ranges at each of the organization’s network boundaries,.

12.12.4 Deny Communication Over `Unauthorized Ports`

Network
Protect
Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only authorized protocols are allowed to cross the network boundary in or out of the network at each of the organization’s network boundaries.

12.12.5 Configure Monitoring Systems to Record Network Packets

Network
Detect
Configure monitoring systems to record network packets passing through the boundary at each of the organization’s network boundaries.

12.12.6 Deploy `Network-Based IDS Sensors`

Network
Detect
Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization’s network boundaries.

12.12.7 Deploy `Network-Based IPS`

Network
Protect
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each of the organization’s network boundaries.

12.12.8 Deploy `NetFlow Collection` on Networking Boundary Devices

Network
Detect
Enable the collection of NetFlow and logging data on all network boundary devices.

12.12.9 Deploy `Application Layer Filtering Proxy Server`

Network
Detect
Ensure that all network traffic to or from the Internet passes through an authenticated application layer proxy that is configured to filter unauthorized connections.

12.12.10 `Decrypt Network Traffic at Proxy`

Network
Detect
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content.
However, the organization may use whitelists of allowed sites that can be accessed through the proxy without decrypting the traffic.

Users
Protect
Require all remote login access to the organization’s network to encrypt data in transit and use multi-factor authentication.

12.12.12 Manage All Devices Remotely Logging into Internal Network

Devices
Protect
Scan all enterprise devices remotely logging into the organization’s network prior to accessing the network to ensure that each of the organization’s security policies has been enforced in the same manner as local network devices.

13 Data Protection

The processes and tools used to prevent data exfiltration, mitigate the effects of exfiltrated data, and ensure the privacy and integrity of sensitive information.

13.13.1 Maintain an `Inventory of Sensitive Information`

Data
Identify
Maintain an inventory of all sensitive information stored, processed, or transmitted by the organization’s technology systems, including those located on-site or at a remote service provider.

13.13.2 `Remove Sensitive Data or Systems Not Regularly Accessed by Organization`

Data
Protect
Remove sensitive data or systems not regularly accessed by the organization from the network.
These systems shall only be used as stand-alone systems (disconnected from the network) by the business unit needing to occasionally use the system or completely virtualized and powered off until needed.

13.13.3 Monitor and Block Unauthorized Network Traffic

Data
Detect
Deploy an automated tool on network perimeters that
- monitors for unauthorized transfer of sensitive information
- and blocks such transfers while alerting information security professionals.

13.13.4 Only Allow Access to Authorized Cloud Storage or Email Providers

Data
Protect
Only allow access to authorized cloud storage or email providers.

13.13.5 Monitor and Detect Any Unauthorized Use of Encryption

Data
Detect
Monitor all traffic leaving the organization
and detect any unauthorized use of encryption.

13.13.6 Encrypt Mobile Device Data

Data
Protect
Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.

13.13.7 Manage USB Devices

Data
Protect
If USB storage devices are required, enterprise software should be used that can configure systems to allow the use of specific devices.
An inventory of such devices should be maintained.

13.13.8 Manage System’s External Removable Media’s Read/Write Configurations

Data
Protect
Configure systems not to write data to external removable media, if there is no business need for supporting such devices.

13.13.9 Encrypt Data on USB Storage Devices

Data
Protect
If USB storage devices are required, all data stored on such devices must be encrypted while at rest.

14 Controlled Access Based on the Need to Know

The processes and tools used to track/control/prevent/correct secure access to critical assets (e.g., information, resources, systems) according to the formal determination of which persons, computers, and applications have a need and right to access these critical assets based on an approved classification.

14.14.1 `Segment the Network Based on Sensitivity`

Network
Protect
Segment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).

14.14.2 Enable `Firewall Filtering Between VLANs`

Network
Protect
Enable firewall filtering between VLANs to ensure that only authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities.

14.14.3 Disable Workstation to Workstation Communication

Network
Protect
Disable all workstation-to-workstation communication to limit an attacker’s ability to move laterally and compromise neighboring systems, through technologies such as Private VLANs or micro segmentation.

14.14.4 Encrypt All Sensitive Information in Transit

Data
Protect
Encrypt all sensitive information in transit.

14.14.5 Utilize an `Active Discovery Tool to Identify Sensitive Data`

Data
Detect
Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted by the organization’s technology systems, including those located on-site or at a remote service provider, and update the organization’s sensitive information inventory.

14.14.6 Protect Information Through `Access Control Lists`

Data
Protect
Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists.
These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities.

14.14.7 `Enforce Access Control to Data` Through Automated Tools

Data
Protect
Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data even when data is copied off a system.

14.14.8 Encrypt Sensitive Information at Rest

Data
Protect
Encrypt all sensitive information at rest using a tool that requires a secondary authentication mechanism not integrated into the operating system, in order to access the information.

14.14.9 Enforce Detail Logging for `Access or Changes to Sensitive Data`

Data
Detect
Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools such as File Integrity Monitoring or Security Information and Event Monitoring).

15 wireless Access Control

The processes and tools used to track/control/prevent/correct the security use of wireless local area networks (WLANs), access points, and wireless client systems.

15.15.1 Maintain an `Inventory of Authorized Wireless Access Points`

Network
Identify
Maintain an inventory of authorized wireless access points connected to the wired network.

15.15.2 Detect `Wireless Access Points` Connected to the Wired Network

Network
Detect
Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access points connected to the wired network.

15.15.3 Use a `Wireless IDS`

Network
Detect
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless access points connected to the network.

15.15.4 `Disable Wireless Access on Devices` if Not Required

Devices
Protect
Disable wireless access on devices that do not have a business purpose for wireless access.

15.15.5 `Limit Wireless Access on Client Devices`

Devices
Protect
Configure wireless access on client machines that do have an essential wireless business purpose, to allow access only to authorized wireless networks and to restrict access to other wireless networks.

15.15.6 Disable Peer-to-Peer Wireless Network Capabilities on Wireless Clients

Devices
Protect
Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.

15.15.7 Leverage the `Advanced Encryption Standard (AES) to Encrypt Wireless Data`

Network
Protect
Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.

15.15.8 Use `Wireless Authentication Protocols That Require Mutual, Multi-Factor Authentication`

Network
Protect
Ensure that wireless networks use authentication protocols such as Extensible Authentication Protocol-Transport Layer Security (EAP/TLS), which requires mutual, multi-factor authentication.

15.15.9 Disable Wireless Peripheral Access of Devices

Devices
Protect
Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication (NFC)], unless such access is required for a business purpose.

15.15.10 Create `Separate Wireless Network for Personal and Untrusted Devices`

Network
Protect
Create a separate wireless network for personal or untrusted devices. Enterprise access from this network should be treated as untrusted and filtered and audited accordingly.

16 Account Monitoring and Control

Actively manage the life cycle of system and application accounts - their creation, use, dormancy, deletion - in order to minimize opportunities for attackers to leverage them.

16.16.1 Maintain an `Inventory of Authentication Systems`

Users
Identify
Maintain an inventory of each of the organization’s authentication systems,
including those located on-site or at a remote service provider.

16.16.2 Configure `Centralized Point of Authentication`

Users
Protect
Configure access for all accounts through as few centralized points of authentication as possible,
including network, security, and cloud systems.

16.16.3 Require `Multi-Factor Authentication`

Users
Protect
Require multi-factor authentication for all user accounts, on all systems,
whether managed on-site or by a third-party provider.

16.16.4 `Encrypt or Hash all Authentication Credentials`

Users
Protect
Encrypt or hash with a salt all authentication credentials when stored.

16.16.5 Encrypt Transmittal of Username and Authentication Credentials

Users
Protect
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.

16.16.6 Maintain an `Inventory of Accounts`

Users
Identify
Maintain an inventory of all accounts organized by authentication system.

16.16.7 Establish `Process for Revoking Access`

Users
Protect
Establish and follow an automated process for revoking system access by disabling accounts immediately upon termination or change of responsibilities of an employee or contractor.
Disabling these accounts, instead of deleting accounts, allows preservation of audit trails.

16.16.8 Disable Any `Unassociated Accounts`

Users
Respond
Disable any account that cannot be associated with a business process or business owner.

16.16.9 Disable `Dormant 休眠的 Accounts`

Users
Respond
Automatically disable dormant accounts after a set period of inactivity.

16.16.10 Ensure All Accounts Have An `Expiration Date`

Users
Protect
Ensure that all accounts have an expiration date that is monitored and enforced.

16.16.11 `Lock Workstation Sessions After Inactivity`

Users
Protect
Automatically lock workstation sessions after a standard period of inactivity.

16.16.12 Monitor `Attempts to Access Deactivated Accounts`

Users
Detect
Monitor attempts to access deactivated accounts through audit logging.

Users
Detect
Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and duration.

17 Implement a Security Awareness and Training Program

For all functional roles in the organization (prioritizing those mission-critical to the business and its security), identify the specific knowledge, skills, and abilities needed to support defense of the enterprise; develop and execute an integrated plan to assess, identify gaps, and remediate through policy, organizational planning, training, and awareness programs.

17.17.1 Perform a `Skills Gap Analysis`

Asset Type: N/A
Security Function: N/A
Perform a skills gap analysis
- to understand the skills and behaviors workforce members are not adhering to,
- using this information to build a baseline education roadmap.

17.17.2 Deliver Training to Fill the Skills Gap

Asset Type: N/A
Security Function: N/A
Deliver training to address the skills gap identified to positively impact workforce members’ security behavior.

17.17.3 Implement a `Security Awareness Program`

Asset Type: N/A
Security Function: N/A
Create a security awareness program for all workforce members to complete on a regular basis to ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of the organization.
The organization’s security awareness program should be communicated in a continuous and engaging manner.

17.17.4 `Update Awareness Content Frequently`

Asset Type: N/A
Security Function: N/A
Ensure that the organization’s security awareness program is updated frequently (at least annually) to address new technologies, threats, standards, and business requirements.

17.17.5 Train Workforce on `Secure Authentication`

Asset Type: N/A
Security Function: N/A
Train workforce members on the importance of enabling and utilizing secure authentication.

Asset Type: N/A
Security Function: N/A
Train the workforce on how to identify different forms of social engineering attacks, such as phishing, phone scams, and impersonation calls.

17.17.7 Train Workforce on `Sensitive Data Handling`

Asset Type: N/A
Security Function: N/A
Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive information.

17.17.8 Train Workforce on Causes of `Unintentional Data Exposure`

Asset Type: N/A
N/Security Function: A
Train workforce members to be aware of causes for unintentional data exposures,
such as losing their mobile devices or emailing the wrong person due to autocomplete in email.

17.17.9 Train Workforce Members on `Identifying and Reporting Incidents`

Asset Type: N/A
Security Function: N/A
Train workforce members to be able to
- identify the most common indicators of an incident
- and how to report such an incident.

18 Application Software Security

Manage the security life cycle of all in-house developed and acquired software in order to prevent, detect, and correct security weaknesses.

18.18.1 Establish `Secure Coding` Practices

Asset Type: N/A
Security Function: N/A
Establish secure coding practices appropriate to the programming language and development environment being used.

18.18.2 Ensure That `Explicit Error Checking` is Performed for All In-House Developed Software ????

Asset Type: N/A
Security Function: N/A
For in-house developed software, ensure that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats.

18.18.3 Verify That `Acquired Software is Still Supported`

Asset Type: N/A
Security Function: N/A
Verify that the version of all software acquired from outside your organization is still supported by the developer or appropriately hardened based on developer security recommendations.

18.18.4 Only Use `Up-to-Date and Trusted Third-Party Components`

Asset Type: N/A
Security Function: N/A
Only use up-to-date and trusted third-party components for the software developed by the organization.

18.18.5 Use Only Standardized and Extensively `Reviewed Encryption Algorithms` ??

Asset Type: N/A
Security Function: N/A
Use only standardized, currently accepted, and extensively reviewed encryption algorithms.

18.18.6 Ensure Software Development Personnel are `Trained in Secure Coding`

Asset Type: N/A
Security Function: N/A
Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities.

18.18.7 Apply `Static and Dynamic Code Analysis Tools`

Asset Type: N/A
Security Function: N/A
Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to for internally developed software.

18.18.8 Establish a Process to `Accept and Address Reports of Software Vulnerabilities`

Asset Type: N/A
Security Function: N/A
Establish a process to accept and address reports of software vulnerabilities, including providing a means for external entities to contact your security group.

18.18.9 `Separate Production and Non-Production Systems`

Asset Type: N/A
Security Function: N/A
Maintain separate environments for production and non-production systems. Developers should not have unmonitored access to production environments.

18.18.10 Deploy `Web Application Firewalls`

Asset Type: N/A
Security Function: N/A
Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic flowing to the web application for common web application attacks.
For applications that are not web-based, specific application firewalls should be deployed if such tools are available for the given application type.
If the traffic is encrypted, the device should either sit behind the encryption or be capable of decrypting the traffic prior to analysis.
If neither option is appropriate, a host-based web application firewall should be deployed.

18.18.11 Use Standard Hardening Configuration Templates for Databases

Asset Type: N/A
N/Security Function: A
For applications that rely on a database, use standard hardening configuration templates. All systems that are part of critical business processes should also be tested.

19 Incident Response and Management

Protect the organization’s information, as well as its reputation, by developing and implementing an incident response infrastructure (e.g., plans, defined roles, training, communications, management oversight) for quickly discovering an attack and then effectively containing the damage, eradicating the attacker's presence, and restoring the integrity of the network and systems.

19.19.1 `Document` Incident Response Procedures

Asset Type: N/A
Security Function: N/A
Ensure that there are written incident response plans that define roles of personnel as well as phases of incident handling/management.

19.19.2 `Assign Job Titles and Duties for Incident Response`

Asset Type: N/A
Security Function: N/A
Assign job titles and duties for handling computer and network incidents to specific individuals, and ensure tracking and documentation throughout the incident through resolution.

19.19.3 Designate `Management Personnel to Support Incident Handling`

Asset Type: N/A
Security Function: N/A
Designate management personnel, as well as backups, who will support the incident handling process by acting in key decision-making roles.

19.19.4 Devise `Organization-wide Standards for Reporting Incidents`

Asset Type: N/A
Security Function: N/A
Devise organization-wide standards for the time required for system administrators and other workforce members to report anomalous events to the incident handling team, the mechanisms for such reporting, and the kind of information that should be included in the incident notification.

19.19.5 Maintain `Contact Information` For Reporting Security Incidents

Asset Type: N/A
Security Function: N/A
Assemble and maintain information on third-party contact information to be used to report a security incident,
such as Law Enforcement, relevant government departments, vendors, and Information Sharing and Analysis Center (ISAC) partners.

19.19.6 Publish Information Regarding `Reporting Computer Anomalies and Incidents`

Asset Type: N/A
Security Function: N/A
Publish information for all workforce members, regarding reporting computer anomalies and incidents, to the incident handling team. Such information should be included in routine employee awareness activities.

19.19.7 Conduct `Periodic Incident Scenario Sessions for Personnel`

Asset Type: N/A
Security Function: N/A
Plan and conduct routine incident, response exercises and scenarios for the workforce involved in the incident response to maintain awareness and comfort in responding to real-world threats.
Exercises should test communication channels, decision making, and incident responders technical capabilities using tools and data available to them.

19.19.8 Create `Incident Scoring and Prioritization Schema`

Asset Type: N/A
Security Function: N/A
Create incident scoring and prioritization schema based on known or potential impact to your organization.
Utilize score to define frequency of status updates and escalation procedures.

20 Penetration Tests and Red Team Exercises

Test the overall strength of an organization’s defense (the technology, the processes, and the people) by simulating the objectives and actions of an attacker.

20.20.1 Establish a `Penetration Testing Program`

Asset Type: N/A
Security Function: N/A
Establish a program for penetration tests that includes a full scope of blended attacks,
such as wireless, client-based, and web application attacks.

20.20.2 Conduct Regular `External and Internal Penetration Tests`

Asset Type: N/A
Security Function: N/A
Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors that can be used to exploit enterprise systems successfully.

20.20.3 Perform Periodic `Red Team Exercises`

Asset Type: N/A
Security Function: N/A
Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or to respond quickly and effectively.

20.20.4 Include Tests for Presence of Unprotected System Information and Artifacts

Asset Type: N/A
NSecurity Function: /A
Include tests for the presence of unprotected system information and artifacts that would be useful to attackers, including network diagrams, configuration files, older penetration test reports, e-mails or documents containing passwords or other information critical to system operation.

20.20.5 Create Test Bed for Elements Not Typically Tested in Production

Asset Type: N/A
Security Function: N/A
Create a test bed that mimics a production environment for specific penetration tests and Red Team attacks against elements that are not typically tested in production,
such as attacks against supervisory control and data acquisition and other control systems.

20.20.6 Use Vulnerability Scanning and Penetration Testing Tools in Concert

Asset Type: N/A
Security Function: N/A
Use vulnerability scanning and penetration testing tools in concert.
The results of vulnerability scanning assessments should be used as a starting point to guide and focus penetration testing efforts.

20.20.7 Ensure Results from Penetration Test are `Documented Using Open, Machine-readable Standards` ???

Asset Type: N/A
Security Function: N/A
Wherever possible, ensure that Red Team results are documented using open, machine-readable standards (e.g., SCAP).
Devise a scoring method for determining the results of Red Team exercises so that results can be compared over time.

Inputs

Enterprise red team policy
Latest red team result documentation

Operations

Examine the enterprise red team policy for the following properties:
Red team documentation is machine-readable
Red team documentation is based on open specification
Red team results must be scored to support ongoing comparison
Examine the latest red team results documentation to verify
Documentation is machine-readable
Documentation is based on open specification
Current score was compared to previous score

Measures

M1 = (Boolean) 1 if the Policy demands machine-readable red team results documentation; 0 otherwise
M2 = (Boolean) 1 if the Policy demands open specification for machine-readable results; 0 otherwise
M3 = (Boolean) 1 if the Policy demands results to be scored to support ongoing comparison; 0 otherwise
M4 = (Boolean) 1 if the Last red team results are machine-readable; 0 otherwise
M5 = (Boolean) 1 if the Last red team results are based on an open specification; 0 otherwise
M6 = (Boolean) 1 if the Last red team results includes current and previous score for comparison. In the event the current score is the result of the enterprise’s first red team exercise, this can be set to 1; 0 otherwise

Metrics

Policy Conformance
- Metric
- Is the enterprise’s Red Team policy specified to produce results using open, machine readable standards, and is scoring designed to facilitate ongoing comparison?
- Calculation: M1 AND M2 AND M3
Operational Conformance
- Metric
- Is the enterprise’s Red Team policy being practiced operationally?
- Calculation M4 AND M5 AND M6

20.20.8 Control and Monitor Accounts Associated with Penetration Testing

Asset Type: N/A
NSecurity Function: /A
Any user or system accounts used to perform penetration testing should be controlled and monitored to make sure they are only being used for legitimate purposes, and are removed or restored to normal function after testing is over.

diagram

| CIS Control | CIS Sub-Control | Asset Type   | Security Function | Title                                                                                                                                                                                                                                                                                                                                                                                         | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Implementation Group 1 | Implementation Group 2 | Implementation Group 3 |
| ----------- | --------------- | ------------ | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------- | ---------------------- |
| 1           |                 |              |                   | Inventory and Control of Hardware Assets                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Actively manage (inventory, track, and correct) all hardware devices on the network so that only authorized devices are given access, and unauthorized and unmanaged devices are found and prevented from gaining access.                                                                                                                                                                     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 1           | 1.1             | Devices      | Identify          | Utilize an Active Discovery Tool                                                                                                                                                                                                                                                                                                                                                              | Utilize an active discovery tool to identify devices connected to the organization's network and update the hardware asset inventory.                                                                                                                                                                                                                                                                                                                                                                                                                            |                        | X                      | X                      |
| 1           | 1.2             | Devices      | Identify          | Use a Passive Asset Discovery Tool                                                                                                                                                                                                                                                                                                                                                            | Utilize a passive discovery tool to identify devices connected to the organization's network and automatically update the organization's hardware asset inventory.                                                                                                                                                                                                                                                                                                                                                                                               |                        |                        | X                      |
| 1           | 1.3             | Devices      | Identify          | Use DHCP Logging to Update Asset Inventory                                                                                                                                                                                                                                                                                                                                                    | Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address management tools to update the organization's hardware asset inventory.                                                                                                                                                                                                                                                                                                                                                                                                 |                        | X                      | X                      |
| 1           | 1.4             | Devices      | Identify          | Maintain Detailed Asset Inventory                                                                                                                                                                                                                                                                                                                                                             | Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or process information. This inventory shall include all hardware assets, whether connected to the organization's network or not.                                                                                                                                                                                                                                                                                                                             | X                      | X                      | X                      |
| 1           | 1.5             | Devices      | Identify          | Maintain Asset Inventory Information                                                                                                                                                                                                                                                                                                                                                          | Ensure that the hardware asset inventory records the network address, hardware address, machine name, data asset owner, and department for each asset and whether the hardware asset has been approved to connect to the network.                                                                                                                                                                                                                                                                                                                                |                        | X                      | X                      |
| 1           | 1.6             | Devices      | Respond           | Address Unauthorized Assets                                                                                                                                                                                                                                                                                                                                                                   | Ensure that unauthorized assets are either removed from the network, quarantined, or the inventory is updated in a timely manner.                                                                                                                                                                                                                                                                                                                                                                                                                                | X                      | X                      | X                      |
| 1           | 1.7             | Devices      | Protect           | Deploy Port Level Access Control                                                                                                                                                                                                                                                                                                                                                              | Utilize port level access control, following 802.1x standards, to control which devices can authenticate to the network. The authentication system shall be tied into the hardware asset inventory data to ensure only authorized devices can connect to the network.                                                                                                                                                                                                                                                                                            |                        | X                      | X                      |
| 1           | 1.8             | Devices      | Protect           | Utilize Client Certificates to Authenticate Hardware Assets                                                                                                                                                                                                                                                                                                                                   | Use client certificates to authenticate hardware assets connecting to the organization's trusted network.                                                                                                                                                                                                                                                                                                                                                                                                                                                        |                        |                        | X                      |
| 2           |                 |              |                   | Inventory and Control of Software Assets                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Actively manage (inventory, track, and correct) all software on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.                                                                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 2           | 2.1             | Applications | Identify          | Maintain Inventory of Authorized Software                                                                                                                                                                                                                                                                                                                                                     | Maintain an up-to-date list of all authorized software that is required in the enterprise for any business purpose on any business system.                                                                                                                                                                                                                                                                                                                                                                                                                       | X                      | X                      | X                      |
| 2           | 2.2             | Applications | Identify          | Ensure Software is Supported by Vendor                                                                                                                                                                                                                                                                                                                                                        | Ensure that only software applications or operating systems currently supported and receiving vendor updates are added to the organization's authorized software inventory. Unsupported software should be tagged as unsupported in the inventory system.                                                                                                                                                                                                                                                                                                        | X                      | X                      | X                      |
| 2           | 2.3             | Applications | Identify          | Utilize Software Inventory Tools                                                                                                                                                                                                                                                                                                                                                              | Utilize software inventory tools throughout the organization to automate the documentation of all software on business systems.                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        | X                      | X                      |
| 2           | 2.4             | Applications | Identify          | Track Software Inventory Information                                                                                                                                                                                                                                                                                                                                                          | The software inventory system should track the name, version, publisher, and install date for all software, including operating systems authorized by the organization.                                                                                                                                                                                                                                                                                                                                                                                          |                        | X                      | X                      |
| 2           | 2.5             | Applications | Identify          | Integrate Software and Hardware Asset Inventories                                                                                                                                                                                                                                                                                                                                             | The software inventory system should be tied into the hardware asset inventory so all devices and associated software are tracked from a single location.                                                                                                                                                                                                                                                                                                                                                                                                        |                        |                        | X                      |
| 2           | 2.6             | Applications | Respond           | Address unapproved software                                                                                                                                                                                                                                                                                                                                                                   | Ensure that unauthorized software is either removed or the inventory is updated in a timely manner                                                                                                                                                                                                                                                                                                                                                                                                                                                               | X                      | X                      | X                      |
| 2           | 2.7             | Applications | Protect           | Utilize Application Whitelisting                                                                                                                                                                                                                                                                                                                                                              | Utilize application whitelisting technology on all assets to ensure that only authorized software executes and all unauthorized software is blocked from executing on assets.                                                                                                                                                                                                                                                                                                                                                                                    |                        |                        | X                      |
| 2           | 2.8             | Applications | Protect           | Implement Application Whitelisting of Libraries                                                                                                                                                                                                                                                                                                                                               | The organization's application whitelisting software must ensure that only authorized software libraries (such as \*.dll, \*.ocx, \*.so, etc.) are allowed to load into a system process.                                                                                                                                                                                                                                                                                                                                                                        |                        |                        | X                      |
| 2           | 2.9             | Applications | Protect           | Implement Application Whitelisting of Scripts                                                                                                                                                                                                                                                                                                                                                 | The organization's application whitelisting software must ensure that only authorized, digitally signed scripts (such as \*.ps1,  \*.py, macros, etc.) are allowed to run on a system.                                                                                                                                                                                                                                                                                                                                                                           |                        |                        | X                      |
| 2           | 2.10            | Applications | Protect           | Physically or Logically Segregate High Risk Applications                                                                                                                                                                                                                                                                                                                                      | Physically or logically segregated systems should be used to isolate and run software that is required for business operations but incurs higher risk for the organization.                                                                                                                                                                                                                                                                                                                                                                                      |                        |                        | X                      |
| 3           |                 |              |                   | Continuous Vulnerability Management                                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Continuously acquire, assess, and take action on new information in order to identify vulnerabilities, remediate, and minimize the window of opportunity for attackers.                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 3           | 3.1             | Applications | Detect            | Run Automated Vulnerability Scanning Tools                                                                                                                                                                                                                                                                                                                                                    | Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning tool to automatically scan all systems on the network on a weekly or more frequent basis to identify all potential vulnerabilities on the organization's systems.                                                                                                                                                                                                                                                                                             |                        | X                      | X                      |
| 3           | 3.2             | Applications | Detect            | Perform Authenticated Vulnerability Scanning                                                                                                                                                                                                                                                                                                                                                  | Perform authenticated vulnerability scanning with agents running locally on each system or with remote scanners that are configured with elevated rights on the system being tested.                                                                                                                                                                                                                                                                                                                                                                             |                        | X                      | X                      |
| 3           | 3.3             | Users        | Protect           | Protect Dedicated Assessment Accounts                                                                                                                                                                                                                                                                                                                                                         | Use a dedicated account for authenticated vulnerability scans, which should not be used for any other administrative activities and should be tied to specific machines at specific IP addresses.                                                                                                                                                                                                                                                                                                                                                                |                        | X                      | X                      |
| 3           | 3.4             | Applications | Protect           | Deploy Automated Operating System Patch Management Tools                                                                                                                                                                                                                                                                                                                                      | Deploy automated software update tools in order to ensure that the operating systems are running the most recent security updates provided by the software vendor.                                                                                                                                                                                                                                                                                                                                                                                               | X                      | X                      | X                      |
| 3           | 3.5             | Applications | Protect           | Deploy Automated Software Patch Management Tools                                                                                                                                                                                                                                                                                                                                              | Deploy automated software update tools in order to ensure that third-party software on all systems is running the most recent security updates provided by the software vendor.                                                                                                                                                                                                                                                                                                                                                                                  | X                      | X                      | X                      |
| 3           | 3.6             | Applications | Respond           | Compare Back-to-Back Vulnerability Scans                                                                                                                                                                                                                                                                                                                                                      | Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have been remediated in a timely manner.                                                                                                                                                                                                                                                                                                                                                                                                                       |                        | X                      | X                      |
| 3           | 3.7             | Applications | Respond           | Utilize a Risk-Rating Process                                                                                                                                                                                                                                                                                                                                                                 | Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                        | X                      | X                      |
| 4           |                 |              |                   | Controlled Use of Administrative Privileges                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | The processes and tools used to track/control/prevent/correct the use, assignment, and configuration of administrative privileges on computers, networks, and applications.                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 4           | 4.1             | Users        | Detect            | Maintain Inventory of Administrative Accounts                                                                                                                                                                                                                                                                                                                                                 | Use automated tools to inventory all administrative accounts, including domain and local accounts, to ensure that only authorized individuals have elevated privileges.                                                                                                                                                                                                                                                                                                                                                                                          |                        | X                      | X                      |
| 4           | 4.2             | Users        | Protect           | Change Default Passwords                                                                                                                                                                                                                                                                                                                                                                      | Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts.                                                                                                                                                                                                                                                                                                                                                                                                                                       | X                      | X                      | X                      |
| 4           | 4.3             | Users        | Protect           | Ensure the Use of Dedicated Administrative Accounts                                                                                                                                                                                                                                                                                                                                           | Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities.                                                                                                                                                                                                                                                                                                                   | X                      | X                      | X                      |
| 4           | 4.4             | Users        | Protect           | Use Unique Passwords                                                                                                                                                                                                                                                                                                                                                                          | Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system.                                                                                                                                                                                                                                                                                                                                                                                         |                        | X                      | X                      |
| 4           | 4.5             | Users        | Protect           | Use Multi-Factor Authentication for All Administrative Access                                                                                                                                                                                                                                                                                                                                 | Use multi-factor authentication and encrypted channels for all administrative account access.                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 4           | 4.6             | Users        | Protect           | Use Dedicated Workstations For All Administrative Tasks                                                                                                                                                                                                                                                                                                                                       | Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring administrative access. This machine will be segmented from the organization's primary network and not be allowed Internet access. This machine will not be used for reading e-mail, composing documents, or browsing the Internet.                                                                                                                                                                                                                                 |                        | X                      | X                      |
| 4           | 4.7             | Users        | Protect           | Limit Access to Script Tools                                                                                                                                                                                                                                                                                                                                                                  | Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or development users with the need to access those capabilities.                                                                                                                                                                                                                                                                                                                                                                                               |                        | X                      | X                      |
| 4           | 4.8             | Users        | Detect            | Log and Alert on Changes to Administrative Group Membership                                                                                                                                                                                                                                                                                                                                   | Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges.                                                                                                                                                                                                                                                                                                                                                                                                                       |                        | X                      | X                      |
| 4           | 4.9             | Users        | Detect            | Log and Alert on Unsuccessful Administrative Account Login                                                                                                                                                                                                                                                                                                                                    | Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                        | X                      | X                      |
| 5           |                 |              |                   | Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Establish, implement, and actively manage (track, report on, correct) the security configuration of mobile devices, laptops, servers, and workstations using a rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings.                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 5           | 5.1             | Applications | Protect           | Establish Secure Configurations                                                                                                                                                                                                                                                                                                                                                               | Maintain documented security configuration standards for all authorized operating systems and software.                                                                                                                                                                                                                                                                                                                                                                                                                                                          | X                      | X                      | X                      |
| 5           | 5.2             | Applications | Protect           | Maintain Secure Images                                                                                                                                                                                                                                                                                                                                                                        | Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates.                                                                                                                                                                                                                                                                                               |                        | X                      | X                      |
| 5           | 5.3             | Applications | Protect           | Securely Store Master Images                                                                                                                                                                                                                                                                                                                                                                  | Store the master images and templates on securely configured servers, validated with integrity monitoring tools, to ensure that only authorized changes to the images are possible.                                                                                                                                                                                                                                                                                                                                                                              |                        | X                      | X                      |
| 5           | 5.4             | Applications | Protect           | Deploy System Configuration Management Tools                                                                                                                                                                                                                                                                                                                                                  | Deploy system configuration management tools that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals.                                                                                                                                                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 5           | 5.5             | Applications | Detect            | Implement Automated Configuration Monitoring Systems                                                                                                                                                                                                                                                                                                                                          | Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to verify all security configuration elements, catalog approved exceptions, and alert when unauthorized changes occur.                                                                                                                                                                                                                                                                                                                                           |                        | X                      | X                      |
| 6           |                 |              |                   | Maintenance, Monitoring and Analysis of Audit Logs                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Collect, manage, and analyze audit logs of events that could help detect, understand, or recover from an attack.                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 6           | 6.1             | Network      | Detect            | Utilize Three Synchronized Time Sources                                                                                                                                                                                                                                                                                                                                                       | Use at least three synchronized time sources from which all servers and network devices retrieve time information on a regular basis so that timestamps in logs are consistent.                                                                                                                                                                                                                                                                                                                                                                                  |                        | X                      | X                      |
| 6           | 6.2             | Network      | Detect            | Activate Audit Logging                                                                                                                                                                                                                                                                                                                                                                        | Ensure that local logging has been enabled on all systems and networking devices.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | X                      | X                      | X                      |
| 6           | 6.3             | Network      | Detect            | Enable Detailed Logging                                                                                                                                                                                                                                                                                                                                                                       | Enable system logging to include detailed information such as a event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.                                                                                                                                                                                                                                                                                                                                                                                         |                        | X                      | X                      |
| 6           | 6.4             | Network      | Detect            | Ensure Adequate Storage for Logs                                                                                                                                                                                                                                                                                                                                                              | Ensure that all systems that store logs have adequate storage space for the logs generated.                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                        | X                      | X                      |
| 6           | 6.5             | Network      | Detect            | Central Log Management                                                                                                                                                                                                                                                                                                                                                                        | Ensure that appropriate logs are being aggregated to a central log management system for analysis and review.                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 6           | 6.6             | Network      | Detect            | Deploy SIEM or Log Analytic Tools                                                                                                                                                                                                                                                                                                                                                             | Deploy Security Information and Event Management (SIEM) or log analytic tool for log correlation and analysis.                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                        | X                      | X                      |
| 6           | 6.7             | Network      | Detect            | Regularly Review Logs                                                                                                                                                                                                                                                                                                                                                                         | On a regular basis, review logs to identify anomalies or abnormal events.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |                        | X                      | X                      |
| 6           | 6.8             | Network      | Detect            | Regularly Tune SIEM                                                                                                                                                                                                                                                                                                                                                                           | On a regular basis, tune your SIEM system to better identify actionable events and decrease event noise.                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                        |                        | X                      |
| 7           |                 |              |                   | Email and Web Browser Protections                                                                                                                                                                                                                                                                                                                                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Minimize the attack surface and the opportunities for attackers to manipulate human behavior though their interaction with web browsers and email systems.                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 7           | 7.1             | Applications | Protect           | Ensure Use of Only Fully Supported Browsers and Email Clients                                                                                                                                                                                                                                                                                                                                 | Ensure that only fully supported web browsers and email clients are allowed to execute in the organization, ideally only using the latest version of the browsers and email clients provided by the vendor.                                                                                                                                                                                                                                                                                                                                                      | X                      | X                      | X                      |
| 7           | 7.2             | Applications | Protect           | Disable Unnecessary or Unauthorized Browser or Email Client Plugins                                                                                                                                                                                                                                                                                                                           | Uninstall or disable any unauthorized browser or email client plugins or add-on applications.                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 7           | 7.3             | Applications | Protect           | Limit Use of Scripting Languages in Web Browsers and Email Clients                                                                                                                                                                                                                                                                                                                            | Ensure that only authorized scripting languages are able to run in all web browsers and email clients.                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                        | X                      | X                      |
| 7           | 7.4             | Network      | Protect           | Maintain and Enforce Network-Based URL Filters                                                                                                                                                                                                                                                                                                                                                | Enforce network-based URL filters that limit a system's ability to connect to websites not approved by the organization. This filtering shall be enforced for each of the organization's systems, whether they are physically at an organization's facilities or not.                                                                                                                                                                                                                                                                                            |                        | X                      | X                      |
| 7           | 7.5             | Network      | Protect           | Subscribe to URL-Categorization Service                                                                                                                                                                                                                                                                                                                                                       | Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent website category definitions available. Uncategorized sites shall be blocked by default.                                                                                                                                                                                                                                                                                                                                                                        |                        | X                      | X                      |
| 7           | 7.6             | Network      | Detect            | Log All URL requester                                                                                                                                                                                                                                                                                                                                                                         | Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in order to identify potentially malicious activity and assist incident handlers with identifying potentially compromised systems.                                                                                                                                                                                                                                                                                                                             |                        | X                      | X                      |
| 7           | 7.7             | Network      | Protect           | Use of DNS Filtering Services                                                                                                                                                                                                                                                                                                                                                                 | Use Domain Name System (DNS) filtering services to help block access to known malicious domains.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | X                      | X                      | X                      |
| 7           | 7.8             | Network      | Protect           | Implement DMARC and Enable Receiver-Side Verification                                                                                                                                                                                                                                                                                                                                         | To lower the chance of spoofed or modified emails from valid domains, implement Domain-based Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail(DKIM) standards.                                                                                                                                                                                                                                                                   |                        | X                      | X                      |
| 7           | 7.9             | Network      | Protect           | Block Unnecessary File Types                                                                                                                                                                                                                                                                                                                                                                  | Block all email attachments entering the organization's email gateway if the file types are unnecessary for the organization's business.                                                                                                                                                                                                                                                                                                                                                                                                                         |                        | X                      | X                      |
| 7           | 7.10            | Network      | Protect           | Sandbox All Email Attachments                                                                                                                                                                                                                                                                                                                                                                 | Use sandboxing to analyze and block inbound email attachments with malicious behavior.                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                        |                        | X                      |
| 8           |                 |              |                   | Malware Defenses                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Control the installation, spread, and execution of malicious code at multiple points in the enterprise, while optimizing the use of automation to enable rapid updating of defense, data gathering, and corrective action.                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 8           | 8.1             | Devices      | Protect           | Utilize Centrally Managed Anti-malware Software                                                                                                                                                                                                                                                                                                                                               | Utilize centrally managed anti-malware software to continuously monitor and defend each of the organization's workstations and servers.                                                                                                                                                                                                                                                                                                                                                                                                                          |                        | X                      | X                      |
| 8           | 8.2             | Devices      | Protect           | Ensure Anti-Malware Software and Signatures Are Updated                                                                                                                                                                                                                                                                                                                                       | Ensure that the organization's anti-malware software updates its scanning engine and signature database on a regular basis.                                                                                                                                                                                                                                                                                                                                                                                                                                      | X                      | X                      | X                      |
| 8           | 8.3             | Devices      | Protect           | Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit Technologies                                                                                                                                                                                                                                                                                                           | Enable anti-exploitation features such as Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that can be configured to apply protection to a broader set of applications and executables.                                                                                                                                                                                                                                                                     |                        | X                      | X                      |
| 8           | 8.4             | Devices      | Detect            | Configure Anti-Malware Scanning of Removable Devices                                                                                                                                                                                                                                                                                                                                          | Configure devices so that they automatically conduct an anti-malware scan of removable media when inserted or connected.                                                                                                                                                                                                                                                                                                                                                                                                                                         | X                      | X                      | X                      |
| 8           | 8.5             | Devices      | Protect           | Configure Devices to Not Auto-Run Content                                                                                                                                                                                                                                                                                                                                                     | Configure devices to not auto-run content from removable media.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | X                      | X                      | X                      |
| 8           | 8.6             | Devices      | Detect            | Centralize Anti-Malware Logging                                                                                                                                                                                                                                                                                                                                                               | Send all malware detection events to enterprise anti-malware administration tools and event log servers for analysis and alerting.                                                                                                                                                                                                                                                                                                                                                                                                                               |                        | X                      | X                      |
| 8           | 8.7             | Network      | Detect            | Enable DNS Query Logging                                                                                                                                                                                                                                                                                                                                                                      | Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious domains.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                        | X                      | X                      |
| 8           | 8.8             | Devices      | Detect            | Enable Command-Line Audit Logging                                                                                                                                                                                                                                                                                                                                                             | Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash.                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                        | X                      | X                      |
| 9           |                 |              |                   | Limitation and Control of Network Ports, Protocols, and Services                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Manage (track/control/correct) the ongoing operational use of ports, protocols, and services on networked devices in order to minimize windows of vulnerability available to attackers.                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 9           | 9.1             | Devices      | Identify          | Associate Active Ports, Services, and Protocols to Asset Inventory                                                                                                                                                                                                                                                                                                                            | Associate active ports, services, and protocols to the hardware assets in the asset inventory.                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |                        | X                      | X                      |
| 9           | 9.2             | Devices      | Protect           | Ensure Only Approved Ports, Protocols, and Services Are Running                                                                                                                                                                                                                                                                                                                               | Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system.                                                                                                                                                                                                                                                                                                                                                                                                                          |                        | X                      | X                      |
| 9           | 9.3             | Devices      | Detect            | Perform Regular Automated Port Scans                                                                                                                                                                                                                                                                                                                                                          | Perform automated port scans on a regular basis against all systems and alert if unauthorized ports are detected on a system.                                                                                                                                                                                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 9           | 9.4             | Devices      | Protect           | Apply Host-Based Firewalls or Port-Filtering                                                                                                                                                                                                                                                                                                                                                  | Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.                                                                                                                                                                                                                                                                                                                                                                                  | X                      | X                      | X                      |
| 9           | 9.5             | Devices      | Protect           | Implement Application Firewalls                                                                                                                                                                                                                                                                                                                                                               | Place application firewalls in front of any critical servers to verify and validate the traffic going to the server. Any unauthorized traffic should be blocked and logged.                                                                                                                                                                                                                                                                                                                                                                                      |                        |                        | X                      |
| 10          |                 |              |                   | Data Recovery Capabilities                                                                                                                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | The processes and tools used to properly back up critical information with a proven methodology for timely recovery of it.                                                                                                                                                                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 10          | 10.1            | Data         | Protect           | Ensure Regular Automated BackUps                                                                                                                                                                                                                                                                                                                                                              | Ensure that all system data is automatically backed up on a regular basis.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | X                      | X                      | X                      |
| 10          | 10.2            | Data         | Protect           | Perform Complete System Backups                                                                                                                                                                                                                                                                                                                                                               | Ensure that all of the organization's key systems are backed up as a complete system, through processes such as imaging, to enable the quick recovery of an entire system.                                                                                                                                                                                                                                                                                                                                                                                       | X                      | X                      | X                      |
| 10          | 10.3            | Data         | Protect           | Test Data on Backup Media                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        | X                      | X                      |
| 10          | 10.4            | Data         | Protect           | Protect Backups                                                                                                                                                                                                                                                                                                                                                                               | Ensure that backups are properly protected via physical security or encryption when they are stored, as well as when they are moved across the network. This includes remote backups and cloud services.                                                                                                                                                                                                                                                                                                                                                         | X                      | X                      | X                      |
| 10          | 10.5            | Data         | Protect           | Ensure All Backups Have at Least One Offline Backup Destination                                                                                                                                                                                                                                                                                                                               | Ensure that all backups have at least one offline (i.e., not accessible via a network connection) backup destination.                                                                                                                                                                                                                                                                                                                                                                                                                                            | X                      | X                      | X                      |
| 11          |                 |              |                   | Secure Configuration for Network Devices, such as Firewalls, Routers and Switches                                                                                                                                                                                                                                                                                                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Establish, implement, and actively manage (track, report on, correct) the security configuration of network infrastructure devices using a rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings.                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 11          | 11.1            | Network      | Identify          | Maintain Standard Security Configurations for Network Devices                                                                                                                                                                                                                                                                                                                                 | Maintain documented security configuration standards for all authorized network devices.                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |                        | X                      | X                      |
| 11          | 11.2            | Network      | Identify          | Document Traffic Configuration Rules                                                                                                                                                                                                                                                                                                                                                          | All configuration rules that allow traffic to flow through network devices should be documented in a configuration management system with a specific business reason for each rule, a specific individual’s name responsible for that business need, and an expected duration of the need.                                                                                                                                                                                                                                                                       |                        | X                      | X                      |
| 11          | 11.3            | Network      | Detect            | Use Automated Tools to Verify Standard Device Configurations and Detect Changes                                                                                                                                                                                                                                                                                                               | Compare all network device configuration against approved security configurations defined for each network device in use, and alert when any deviations are discovered.                                                                                                                                                                                                                                                                                                                                                                                          |                        | X                      | X                      |
| 11          | 11.4            | Network      | Protect           | Install the Latest Stable Version of Any Security-Related Updates on All Network Devices                                                                                                                                                                                                                                                                                                      | Install the latest stable version of any security-related updates on all network devices.                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | X                      | X                      | X                      |
| 11          | 11.5            | Network      | Protect           | Manage Network Devices Using Multi-Factor Authentication and Encrypted Sessions                                                                                                                                                                                                                                                                                                               | Manage all network devices using multi-factor authentication and encrypted sessions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |                        | X                      | X                      |
| 11          | 11.6            | Network      | Protect           | Use Dedicated Machines For All Network Administrative Tasks                                                                                                                                                                                                                                                                                                                                   | Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring elevated access. This machine shall be segmented from the organization's primary network and not be allowed Internet access. This machine shall not be used for reading email, composing documents, or surfing the Internet.                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 11          | 11.7            | Network      | Protect           | Manage Network Infrastructure Through a Dedicated Network                                                                                                                                                                                                                                                                                                                                     | Manage the network infrastructure across network connections that are separated from the business use of that network, relying on separate VLANs or, preferably, on entirely different physical connectivity for management sessions for network devices.                                                                                                                                                                                                                                                                                                        |                        | X                      | X                      |
| 12          |                 |              |                   | Boundary Defense                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Detect/prevent/correct the flow of information transferring networks of different trust levels with a focus on security-damaging data.                                                                                                                                                                                                                                                        |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 12          | 12.1            | Network      | Identify          | Maintain an Inventory of Network Boundaries                                                                                                                                                                                                                                                                                                                                                   | Maintain an up-to-date inventory of all of the organization's network boundaries.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | X                      | X                      | X                      |
| 12          | 12.2            | Network      | Detect            | Scan for Unauthorized Connections Across Trusted Network Boundaries                                                                                                                                                                                                                                                                                                                           | Perform regular scans from outside each trusted network boundary to detect any unauthorized connections which are accessible across the boundary.                                                                                                                                                                                                                                                                                                                                                                                                                |                        | X                      | X                      |
| 12          | 12.3            | Network      | Protect           | Deny Communications With Known Malicious IP Addresses                                                                                                                                                                                                                                                                                                                                         | Deny communications with known malicious or unused Internet IP addresses and limit access only to trusted and necessary IP address ranges at each of the organization's network boundaries,.                                                                                                                                                                                                                                                                                                                                                                     |                        | X                      | X                      |
| 12          | 12.4            | Network      | Protect           | Deny Communication Over Unauthorized Ports                                                                                                                                                                                                                                                                                                                                                    | Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only authorized protocols are allowed to cross the network boundary in or out of the network at each of the organization's network boundaries.                                                                                                                                                                                                                                                                                                                       | X                      | X                      | X                      |
| 12          | 12.5            | Network      | Detect            | Configure Monitoring Systems to Record Network Packets                                                                                                                                                                                                                                                                                                                                        | Configure monitoring systems to record network packets passing through the boundary at each of the organization's network boundaries.                                                                                                                                                                                                                                                                                                                                                                                                                            |                        | X                      | X                      |
| 12          | 12.6            | Network      | Detect            | Deploy Network-Based IDS Sensors                                                                                                                                                                                                                                                                                                                                                              | Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries.                                                                                                                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 12          | 12.7            | Network      | Protect           | Deploy Network-Based Intrusion Prevention Systems                                                                                                                                                                                                                                                                                                                                             | Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each of the organization's network boundaries.                                                                                                                                                                                                                                                                                                                                                                                                                     |                        |                        | X                      |
| 12          | 12.8            | Network      | Detect            | Deploy NetFlow Collection on Networking Boundary Devices                                                                                                                                                                                                                                                                                                                                      | Enable the collection of NetFlow and logging data on all network boundary devices.                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                        | X                      | X                      |
| 12          | 12.9            | Network      | Detect            | Deploy Application Layer Filtering Proxy Server                                                                                                                                                                                                                                                                                                                                               | Ensure that all network traffic to or from the Internet passes through an authenticated application layer proxy that is configured to filter unauthorized connections.                                                                                                                                                                                                                                                                                                                                                                                           |                        |                        | X                      |
| 12          | 12.10           | Network      | Detect            | Decrypt Network Traffic at Proxy                                                                                                                                                                                                                                                                                                                                                              | Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However, the organization may use whitelists of allowed sites that can be accessed through the proxy without decrypting the traffic.                                                                                                                                                                                                                                                                                                                                 |                        |                        | X                      |
| 12          | 12.11           | Users        | Protect           | Require All Remote Login to Use Multi-Factor Authentication                                                                                                                                                                                                                                                                                                                                   | Require all remote login access to the organization's network to encrypt data in transit and use multi-factor authentication.                                                                                                                                                                                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 12          | 12.12           | Devices      | Protect           | Manage All Devices Remotely Logging into Internal Network                                                                                                                                                                                                                                                                                                                                     | Scan all enterprise devices remotely logging into the organization's network prior to accessing the network to ensure that each of the organization's security policies has been enforced in the same manner as local network devices.                                                                                                                                                                                                                                                                                                                           |                        |                        | X                      |
| 13          |                 |              |                   | Data Protection                                                                                                                                                                                                                                                                                                                                                                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | The processes and tools used to prevent data exfiltration, mitigate the effects of exfiltrated data, and ensure the privacy and integrity of sensitive information.                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 13          | 13.1            | Data         | Identify          | Maintain an Inventory of Sensitive Information                                                                                                                                                                                                                                                                                                                                                | Maintain an inventory of all sensitive information stored, processed, or transmitted by the organization's technology systems, including those located on-site or at a remote service provider.                                                                                                                                                                                                                                                                                                                                                                  | X                      | X                      | X                      |
| 13          | 13.2            | Data         | Protect           | Remove Sensitive Data or Systems Not Regularly Accessed by Organization                                                                                                                                                                                                                                                                                                                       | Remove sensitive data or systems not regularly accessed by the organization from the network. These systems shall only be used as stand-alone systems (disconnected from the network) by the business unit needing to occasionally use the system or completely virtualized and powered off until needed.                                                                                                                                                                                                                                                        | X                      | X                      | X                      |
| 13          | 13.3            | Data         | Detect            | Monitor and Block Unauthorized Network Traffic                                                                                                                                                                                                                                                                                                                                                | Deploy an automated tool on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals.                                                                                                                                                                                                                                                                                                                                                                     |                        |                        | X                      |
| 13          | 13.4            | Data         | Protect           | Only Allow Access to Authorized Cloud Storage or Email Providers                                                                                                                                                                                                                                                                                                                              | Only allow access to authorized cloud storage or email providers.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                        | X                      | X                      |
| 13          | 13.5            | Data         | Detect            | Monitor and Detect Any Unauthorized Use of Encryption                                                                                                                                                                                                                                                                                                                                         | Monitor all traffic leaving the organization and detect any unauthorized use of encryption.                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                        |                        | X                      |
| 13          | 13.6            | Data         | Protect           | Encrypt Mobile Device Data                                                                                                                                                                                                                                                                                                                                                                    | Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices.                                                                                                                                                                                                                                                                                                                                                                                                                                                               | X                      | X                      | X                      |
| 13          | 13.7            | Data         | Protect           | Manage USB Devices                                                                                                                                                                                                                                                                                                                                                                            | If USB storage devices are required, enterprise software should be used that can configure systems to allow the use of specific devices. An inventory of such devices should be maintained.                                                                                                                                                                                                                                                                                                                                                                      |                        | X                      | X                      |
| 13          | 13.8            | Data         | Protect           | Manage System's External Removable Media's Read/Write Configurations                                                                                                                                                                                                                                                                                                                          | Configure systems not to write data to external removable media, if there is no business need for supporting such devices.                                                                                                                                                                                                                                                                                                                                                                                                                                       |                        |                        | X                      |
| 13          | 13.9            | Data         | Protect           | Encrypt Data on USB Storage Devices                                                                                                                                                                                                                                                                                                                                                           | If USB storage devices are required, all data stored on such devices must be encrypted while at rest.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                        |                        | X                      |
| 14          |                 |              |                   | Controlled Access Based on the Need to Know                                                                                                                                                                                                                                                                                                                                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | The processes and tools used to track/control/prevent/correct secure access to critical assets (e.g., information, resources, systems) according to the formal determination of which persons, computers, and applications have a need and right to access these critical assets based on an approved classification.                                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 14          | 14.1            | Network      | Protect           | Segment the Network Based on Sensitivity                                                                                                                                                                                                                                                                                                                                                      | Segment the network based on the label or classification level of the information stored on the servers, locate all sensitive information on separated Virtual Local Area Networks (VLANs).                                                                                                                                                                                                                                                                                                                                                                      |                        | X                      | X                      |
| 14          | 14.2            | Network      | Protect           | Enable Firewall Filtering Between VLANs                                                                                                                                                                                                                                                                                                                                                       | Enable firewall filtering between VLANs to ensure that only authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities.                                                                                                                                                                                                                                                                                                                                                                                  |                        | X                      | X                      |
| 14          | 14.3            | Network      | Protect           | Disable Workstation to Workstation Communication                                                                                                                                                                                                                                                                                                                                              | Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally and compromise neighboring systems, through technologies such as Private VLANs or micro segmentation.                                                                                                                                                                                                                                                                                                                                                      |                        | X                      | X                      |
| 14          | 14.4            | Data         | Protect           | Encrypt All Sensitive Information in Transit                                                                                                                                                                                                                                                                                                                                                  | Encrypt all sensitive information in transit.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 14          | 14.5            | Data         | Detect            | Utilize an Active Discovery Tool to Identify Sensitive Data                                                                                                                                                                                                                                                                                                                                   | Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted by the organization's technology systems, including those located on-site or at a remote service provider, and update the organization's sensitive information inventory.                                                                                                                                                                                                                                                                               |                        |                        | X                      |
| 14          | 14.6            | Data         | Protect           | Protect Information Through Access Control Lists                                                                                                                                                                                                                                                                                                                                              | Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities.                                                                                                                                                                                                                   | X                      | X                      | X                      |
| 14          | 14.7            | Data         | Protect           | Enforce Access Control to Data Through Automated Tools                                                                                                                                                                                                                                                                                                                                        | Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data even when data is copied off a system.                                                                                                                                                                                                                                                                                                                                                                                                                        |                        |                        | X                      |
| 14          | 14.8            | Data         | Protect           | Encrypt Sensitive Information at Rest                                                                                                                                                                                                                                                                                                                                                         | Encrypt all sensitive information at rest using a tool that requires a secondary authentication mechanism not integrated into the operating system, in order to access the information.                                                                                                                                                                                                                                                                                                                                                                          |                        |                        | X                      |
| 14          | 14.9            | Data         | Detect            | Enforce Detail Logging for Access or Changes to Sensitive Data                                                                                                                                                                                                                                                                                                                                | Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools such as File Integrity Monitoring or Security Information and Event Monitoring).                                                                                                                                                                                                                                                                                                                                                                       |                        |                        | X                      |
| 15          |                 |              |                   | Wireless Access Control                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | The processes and tools used to track/control/prevent/correct the security use of wireless local area networks (WLANs), access points, and wireless client systems.                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 15          | 15.1            | Network      | Identify          | Maintain an Inventory of Authorized Wireless Access Points                                                                                                                                                                                                                                                                                                                                    | Maintain an inventory of authorized wireless access points connected to the wired network.                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                        | X                      | X                      |
| 15          | 15.2            | Network      | Detect            | Detect Wireless Access Points Connected to the Wired Network                                                                                                                                                                                                                                                                                                                                  | Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access points connected to the wired network.                                                                                                                                                                                                                                                                                                                                                                                                                        |                        | X                      | X                      |
| 15          | 15.3            | Network      | Detect            | Use a Wireless Intrusion Detection System                                                                                                                                                                                                                                                                                                                                                     | Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless access points connected to the network.                                                                                                                                                                                                                                                                                                                                                                                                                            |                        | X                      | X                      |
| 15          | 15.4            | Devices      | Protect           | Disable Wireless Access on Devices if Not Required                                                                                                                                                                                                                                                                                                                                            | Disable wireless access on devices that do not have a business purpose for wireless access.                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                        |                        | X                      |
| 15          | 15.5            | Devices      | Protect           | Limit Wireless Access on Client Devices                                                                                                                                                                                                                                                                                                                                                       | Configure wireless access on client machines that do have an essential wireless business purpose, to allow access only to authorized wireless networks and to restrict access to other wireless networks.                                                                                                                                                                                                                                                                                                                                                        |                        |                        | X                      |
| 15          | 15.6            | Devices      | Protect           | Disable Peer-to-Peer Wireless Network Capabilities on Wireless Clients                                                                                                                                                                                                                                                                                                                        | Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                        | X                      | X                      |
| 15          | 15.7            | Network      | Protect           | Leverage the Advanced Encryption Standard (AES) to Encrypt Wireless Data                                                                                                                                                                                                                                                                                                                      | Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | X                      | X                      | X                      |
| 15          | 15.8            | Network      | Protect           | Use Wireless Authentication Protocols That Require Mutual, Multi-Factor Authentication                                                                                                                                                                                                                                                                                                        | Ensure that wireless networks use authentication protocols such as Extensible Authentication Protocol-Transport Layer Security (EAP/TLS), which requires mutual, multi-factor authentication.                                                                                                                                                                                                                                                                                                                                                                    |                        |                        | X                      |
| 15          | 15.9            | Devices      | Protect           | Disable Wireless Peripheral Access of Devices                                                                                                                                                                                                                                                                                                                                                 | Disable wireless peripheral access of devices \[such as Bluetooth and Near Field Communication (NFC)\], unless such access is required for a business purpose.                                                                                                                                                                                                                                                                                                                                                                                                   |                        | X                      | X                      |
| 15          | 15.10           | Network      | Protect           | Create Separate Wireless Network for Personal and Untrusted Devices                                                                                                                                                                                                                                                                                                                           | Create a separate wireless network for personal or untrusted devices. Enterprise access from this network should be treated as untrusted and filtered and audited accordingly.                                                                                                                                                                                                                                                                                                                                                                                   | X                      | X                      | X                      |
| 16          |                 |              |                   | Account Monitoring and Control                                                                                                                                                                                                                                                                                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Actively manage the life cycle of system and application accounts - their creation, use, dormancy, deletion - in order to minimize opportunities for attackers to leverage them.                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 16          | 16.1            | Users        | Identify          | Maintain an Inventory of Authentication Systems                                                                                                                                                                                                                                                                                                                                               | Maintain an inventory of each of the organization's authentication systems, including those located on-site or at a remote service provider.                                                                                                                                                                                                                                                                                                                                                                                                                     |                        | X                      | X                      |
| 16          | 16.2            | Users        | Protect           | Configure Centralized Point of Authentication                                                                                                                                                                                                                                                                                                                                                 | Configure access for all accounts through as few centralized points of authentication as possible, including network, security, and cloud systems.                                                                                                                                                                                                                                                                                                                                                                                                               |                        | X                      | X                      |
| 16          | 16.3            | Users        | Protect           | Require Multi-Factor Authentication                                                                                                                                                                                                                                                                                                                                                           | Require multi-factor authentication for all user accounts, on all systems, whether managed on-site or by a third-party provider.                                                                                                                                                                                                                                                                                                                                                                                                                                 |                        | X                      | X                      |
| 16          | 16.4            | Users        | Protect           | Encrypt or Hash all Authentication Credentials                                                                                                                                                                                                                                                                                                                                                | Encrypt or hash with a salt all authentication credentials when stored.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                        | X                      | X                      |
| 16          | 16.5            | Users        | Protect           | Encrypt Transmittal of Username and Authentication Credentials                                                                                                                                                                                                                                                                                                                                | Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.                                                                                                                                                                                                                                                                                                                                                                                                                                       |                        | X                      | X                      |
| 16          | 16.6            | Users        | Identify          | Maintain an Inventory of Accounts                                                                                                                                                                                                                                                                                                                                                             | Maintain an inventory of all accounts organized by authentication system.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |                        | X                      | X                      |
| 16          | 16.7            | Users        | Protect           | Establish Process for Revoking Access                                                                                                                                                                                                                                                                                                                                                         | Establish and follow an automated process for revoking system access by disabling accounts immediately upon termination or change of responsibilities of an employee or contractor . Disabling these accounts, instead of deleting accounts, allows preservation of audit trails.                                                                                                                                                                                                                                                                                |                        | X                      | X                      |
| 16          | 16.8            | Users        | Respond           | Disable Any Unassociated Accounts                                                                                                                                                                                                                                                                                                                                                             | Disable any account that cannot be associated with a business process or business owner.                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | X                      | X                      | X                      |
| 16          | 16.9            | Users        | Respond           | Disable Dormant Accounts                                                                                                                                                                                                                                                                                                                                                                      | Automatically disable dormant accounts after a set period of inactivity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | X                      | X                      | X                      |
| 16          | 16.10           | Users        | Protect           | Ensure All Accounts Have An Expiration Date                                                                                                                                                                                                                                                                                                                                                   | Ensure that all accounts have an expiration date that is monitored and enforced.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                        | X                      | X                      |
| 16          | 16.11           | Users        | Protect           | Lock Workstation Sessions After Inactivity                                                                                                                                                                                                                                                                                                                                                    | Automatically lock workstation sessions after a standard period of inactivity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | X                      | X                      | X                      |
| 16          | 16.12           | Users        | Detect            | Monitor Attempts to Access Deactivated Accounts                                                                                                                                                                                                                                                                                                                                               | Monitor attempts to access deactivated accounts through audit logging.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                        | X                      | X                      |
| 16          | 16.13           | Users        | Detect            | Alert on Account Login Behavior Deviation                                                                                                                                                                                                                                                                                                                                                     | Alert when users deviate from normal login behavior, such as time-of-day, workstation location, and duration.                                                                                                                                                                                                                                                                                                                                                                                                                                                    |                        |                        | X                      |
| 17          |                 |              |                   | Implement a Security Awareness and Training Program                                                                                                                                                                                                                                                                                                                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | For all functional roles in the organization (prioritizing those mission-critical to the business and its security), identify the specific knowledge, skills, and abilities needed to support defense of the enterprise; develop and execute an integrated plan to assess, identify gaps, and remediate through policy, organizational planning, training, and awareness programs.            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 17          | 17.1            | N/A          | N/A               | Perform a Skills Gap Analysis                                                                                                                                                                                                                                                                                                                                                                 | Perform a skills gap analysis to understand the skills and behaviors workforce members are not adhering to, using this information to build a baseline education roadmap.                                                                                                                                                                                                                                                                                                                                                                                        |                        | X                      | X                      |
| 17          | 17.2            | N/A          | N/A               | Deliver Training to Fill the Skills Gap                                                                                                                                                                                                                                                                                                                                                       | Deliver training to address the skills gap identified to positively impact workforce members' security behavior.                                                                                                                                                                                                                                                                                                                                                                                                                                                 |                        | X                      | X                      |
| 17          | 17.3            | N/A          | N/A               | Implement a Security Awareness Program                                                                                                                                                                                                                                                                                                                                                        | Create a security awareness program for all workforce members to complete on a regular basis to ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of the organization. The organization's security awareness program should be communicated in a continuous and engaging manner.                                                                                                                                                                                                                                 | X                      | X                      | X                      |
| 17          | 17.4            | N/A          | N/A               | Update Awareness Content Frequently                                                                                                                                                                                                                                                                                                                                                           | Ensure that the organization's security awareness program is updated frequently (at least annually) to address new technologies, threats, standards, and business requirements.                                                                                                                                                                                                                                                                                                                                                                                  |                        | X                      | X                      |
| 17          | 17.5            | N/A          | N/A               | Train Workforce on Secure Authentication                                                                                                                                                                                                                                                                                                                                                      | Train workforce members on the importance of enabling and utilizing secure authentication.                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | X                      | X                      | X                      |
| 17          | 17.6            | N/A          | N/A               | Train Workforce on Identifying Social Engineering Attacks                                                                                                                                                                                                                                                                                                                                     | Train the workforce on how to identify different forms of social engineering attacks, such as phishing, phone scams, and impersonation calls.                                                                                                                                                                                                                                                                                                                                                                                                                    | X                      | X                      | X                      |
| 17          | 17.7            | N/A          | N/A               | Train Workforce on Sensitive Data Handling                                                                                                                                                                                                                                                                                                                                                    | Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive information.                                                                                                                                                                                                                                                                                                                                                                                                                                             | X                      | X                      | X                      |
| 17          | 17.8            | N/A          | N/A               | Train Workforce on Causes of Unintentional Data Exposure                                                                                                                                                                                                                                                                                                                                      | Train workforce members to be aware of causes for unintentional data exposures, such as losing their mobile devices or emailing the wrong person due to autocomplete in email.                                                                                                                                                                                                                                                                                                                                                                                   | X                      | X                      | X                      |
| 17          | 17.9            | N/A          | N/A               | Train Workforce Members on Identifying and Reporting Incidents                                                                                                                                                                                                                                                                                                                                | Train workforce members to be able to identify the most common indicators of an incident and be able to report such an incident.                                                                                                                                                                                                                                                                                                                                                                                                                                 | X                      | X                      | X                      |
| 18          |                 |              |                   | Application Software Security                                                                                                                                                                                                                                                                                                                                                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Manage the security life cycle of all in-house developed and acquired software in order to prevent, detect, and correct security weaknesses.                                                                                                                                                                                                                                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 18          | 18.1            | N/A          | N/A               | Establish Secure Coding Practices                                                                                                                                                                                                                                                                                                                                                             | Establish secure coding practices appropriate to the programming language and development environment being used.                                                                                                                                                                                                                                                                                                                                                                                                                                                |                        | X                      | X                      |
| 18          | 18.2            | N/A          | N/A               | Ensure That Explicit Error Checking is Performed for All In-House Developed Software                                                                                                                                                                                                                                                                                                          | For in-house developed software, ensure that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats.                                                                                                                                                                                                                                                                                                                                                                                 |                        | X                      | X                      |
| 18          | 18.3            | N/A          | N/A               | Verify That Acquired Software is Still Supported                                                                                                                                                                                                                                                                                                                                              | Verify that the version of all software acquired from outside your organization is still supported by the developer or appropriately hardened based on developer security recommendations.                                                                                                                                                                                                                                                                                                                                                                       |                        | X                      | X                      |
| 18          | 18.4            | N/A          | N/A               | Only Use Up-to-Date and Trusted Third-Party Components                                                                                                                                                                                                                                                                                                                                        | Only use up-to-date and trusted third-party components for the software developed by the organization.                                                                                                                                                                                                                                                                                                                                                                                                                                                           |                        | X                      | X                      |
| 18          | 18.5            | N/A          | N/A               | Use Only Standardized and Extensively Reviewed Encryption Algorithms                                                                                                                                                                                                                                                                                                                          | Use only standardized, currently accepted, and extensively reviewed encryption algorithms.                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                        | X                      | X                      |
| 18          | 18.6            | N/A          | N/A               | Ensure Software Development Personnel are Trained in Secure Coding                                                                                                                                                                                                                                                                                                                            | Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities.                                                                                                                                                                                                                                                                                                                                                                                                          |                        | X                      | X                      |
| 18          | 18.7            | N/A          | N/A               | Apply Static and Dynamic Code Analysis Tools                                                                                                                                                                                                                                                                                                                                                  | Apply static and dynamic analysis tools to verify that secure coding practices are being adhered to for internally developed software.                                                                                                                                                                                                                                                                                                                                                                                                                           |                        | X                      | X                      |
| 18          | 18.8            | N/A          | N/A               | Establish a Process to Accept and Address Reports of Software Vulnerabilities                                                                                                                                                                                                                                                                                                                 | Establish a process to accept and address reports of software vulnerabilities, including providing a means for external entities to contact your security group.                                                                                                                                                                                                                                                                                                                                                                                                 |                        | X                      | X                      |
| 18          | 18.9            | N/A          | N/A               | Separate Production and Non-Production Systems                                                                                                                                                                                                                                                                                                                                                | Maintain separate environments for production and non-production systems. Developers should not have unmonitored access to production environments.                                                                                                                                                                                                                                                                                                                                                                                                              |                        | X                      | X                      |
| 18          | 18.10           | N/A          | N/A               | Deploy Web Application Firewalls                                                                                                                                                                                                                                                                                                                                                              | Protect web applications by deploying web application firewalls (WAFs) that inspect all traffic flowing to the web application for common web application attacks. For applications that are not web-based, specific application firewalls should be deployed if such tools are available for the given application type. If the traffic is encrypted, the device should either sit behind the encryption or be capable of decrypting the traffic prior to analysis. If neither option is appropriate, a host-based web application firewall should be deployed. |                        | X                      | X                      |
| 18          | 18.11           | N/A          | N/A               | Use Standard Hardening Configuration Templates for Databases                                                                                                                                                                                                                                                                                                                                  | For applications that rely on a database, use standard hardening configuration templates. All systems that are part of critical business processes should also be tested.                                                                                                                                                                                                                                                                                                                                                                                        |                        | X                      | X                      |
| 19          |                 |              |                   | Incident Response and Management                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Protect the organization's information, as well as its reputation, by developing and implementing an incident response infrastructure (e.g., plans, defined roles, training, communications, management oversight) for quickly discovering an attack and then effectively containing the damage, eradicating the attacker's presence, and restoring the integrity of the network and systems. |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 19          | 19.1            | N/A          | N/A               | Document Incident Response Procedures                                                                                                                                                                                                                                                                                                                                                         | Ensure that there are written incident response plans that define roles of personnel as well as phases of incident handling/management.                                                                                                                                                                                                                                                                                                                                                                                                                          | X                      | X                      | X                      |
| 19          | 19.2            | N/A          | N/A               | Assign Job Titles and Duties for Incident Response                                                                                                                                                                                                                                                                                                                                            | Assign job titles and duties for handling computer and network incidents to specific individuals, and ensure tracking and documentation throughout the incident through resolution.                                                                                                                                                                                                                                                                                                                                                                              |                        | X                      | X                      |
| 19          | 19.3            | N/A          | N/A               | Designate Management Personnel to Support Incident Handling                                                                                                                                                                                                                                                                                                                                   | Designate management personnel, as well as backups, who will support the incident handling process by acting in key decision-making roles.                                                                                                                                                                                                                                                                                                                                                                                                                       | X                      | X                      | X                      |
| 19          | 19.4            | N/A          | N/A               | Devise Organization-wide Standards for Reporting Incidents                                                                                                                                                                                                                                                                                                                                    | Devise organization-wide standards for the time required for system administrators and other workforce members to report anomalous events to the incident handling team, the mechanisms for such reporting, and the kind of information that should be included in the incident notification.                                                                                                                                                                                                                                                                    |                        | X                      | X                      |
| 19          | 19.5            | N/A          | N/A               | Maintain Contact Information For Reporting Security Incidents                                                                                                                                                                                                                                                                                                                                 | Assemble and maintain information on third-party contact information to be used to report a security incident, such as Law Enforcement, relevant government departments, vendors, and Information Sharing and Analysis Center (ISAC) partners.                                                                                                                                                                                                                                                                                                                   | X                      | X                      | X                      |
| 19          | 19.6            | N/A          | N/A               | Publish Information Regarding Reporting Computer Anomalies and Incidents                                                                                                                                                                                                                                                                                                                      | Publish information for all workforce members, regarding reporting computer anomalies and incidents, to the incident handling team. Such information should be included in routine employee awareness activities.                                                                                                                                                                                                                                                                                                                                                | X                      | X                      | X                      |
| 19          | 19.7            | N/A          | N/A               | Conduct Periodic Incident Scenario Sessions for Personnel                                                                                                                                                                                                                                                                                                                                     | Plan and conduct routine incident, response exercises and scenarios for the workforce involved in the incident response to maintain awareness and comfort in responding to real-world threats. Exercises should test communication channels, decision making, and incident responders technical capabilities using tools and data available to them.                                                                                                                                                                                                             |                        | X                      | X                      |
| 19          | 19.8            | N/A          | N/A               | Create Incident Scoring and Prioritization Schema                                                                                                                                                                                                                                                                                                                                             | Create incident scoring and prioritization schema based on known or potential impact to your organization. Utilize score to define frequency of status updates and escalation procedures.                                                                                                                                                                                                                                                                                                                                                                        |                        |                        | X                      |
| 20          |                 |              |                   | Penetration Tests and Red Team Exercises                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
|             |                 |              |                   | Test the overall strength of an organization's defense (the technology, the processes, and the people) by simulating the objectives and actions of an attacker.                                                                                                                                                                                                                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |                        |                        |                        |
| 20          | 20.1            | N/A          | N/A               | Establish a Penetration Testing Program                                                                                                                                                                                                                                                                                                                                                       | Establish a program for penetration tests that includes a full scope of blended attacks, such as wireless, client-based, and web application attacks.                                                                                                                                                                                                                                                                                                                                                                                                            |                        | X                      | X                      |
| 20          | 20.2            | N/A          | N/A               | Conduct Regular External and Internal Penetration Tests                                                                                                                                                                                                                                                                                                                                       | Conduct regular external and internal penetration tests to identify vulnerabilities and attack vectors that can be used to exploit enterprise systems successfully.                                                                                                                                                                                                                                                                                                                                                                                              |                        | X                      | X                      |
| 20          | 20.3            | N/A          | N/A               | Perform Periodic Red Team Exercises                                                                                                                                                                                                                                                                                                                                                           | Perform periodic Red Team exercises to test organizational readiness to identify and stop attacks or to respond quickly and effectively.                                                                                                                                                                                                                                                                                                                                                                                                                         |                        |                        | X                      |
| 20          | 20.4            | N/A          | N/A               | Include Tests for Presence of Unprotected System Information and Artifacts                                                                                                                                                                                                                                                                                                                    | Include tests for the presence of unprotected system information and artifacts that would be useful to attackers, including network diagrams, configuration files, older penetration test reports, e-mails or documents containing passwords or other information critical to system operation.                                                                                                                                                                                                                                                                  |                        | X                      | X                      |
| 20          | 20.5            | N/A          | N/A               | Create Test Bed for Elements Not Typically Tested in Production                                                                                                                                                                                                                                                                                                                               | Create a test bed that mimics a production environment for specific penetration tests and Red Team attacks against elements that are not typically tested in production, such as attacks against supervisory control and data acquisition and other control systems.                                                                                                                                                                                                                                                                                             |                        | X                      | X                      |
| 20          | 20.6            | N/A          | N/A               | Use Vulnerability Scanning and Penetration Testing Tools in Concert                                                                                                                                                                                                                                                                                                                           | Use vulnerability scanning and penetration testing tools in concert. The results of vulnerability scanning assessments should be used as a starting point to guide and focus penetration testing efforts.                                                                                                                                                                                                                                                                                                                                                        |                        | X                      | X                      |
| 20          | 20.7            | N/A          | N/A               | Ensure Results from Penetration Test are Documented Using Open, Machine-readable Standards                                                                                                                                                                                                                                                                                                    | Wherever possible, ensure that Red Team results are documented using open, machine-readable standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so that results can be compared over time.                                                                                                                                                                                                                                                                                                                         |                        |                        | X                      |
| 20          | 20.8            | N/A          | N/A               | Control and Monitor Accounts Associated with Penetration Testing                                                                                                                                                                                                                                                                                                                              | Any user or system accounts used to perform penetration testing should be controlled and monitored to make sure they are only being used for legitimate purposes, and are removed or restored to normal function after testing is over.                                                                                                                                                                                                                                                                                                                          |                        | X                      | X                      |
|  |

10SecConcept, ComplianceAndReport

CIS

This post is licensed under CC BY 4.0 by the author.

CIS20 Control

1 Inventory and Control of Hardware Assets

1.1.1 Utilize an Active Discovery Tool

1.1.2 Use a Passive Asset Discovery Tool

1.1.3 Use DHCP Logging to Update Asset Inventory

1.1.4 Maintain Detailed Asset Inventory

1.1.5 Maintain Asset Inventory Information

1.1.6 Address Unauthorized Assets

1.1.7 Deploy Port Level Access Control

1.1.8 Utilize Client Certificates to Authenticate Hardware Assets

2 Inventory and Control of Software Assets

2.2.1 Maintain Inventory of Authorized Software

2.2.2 Ensure Software is Supported by Vendor

2.2.3 Utilize Software Inventory Tools

2.2.4 Track Software Inventory Information

2.2.5 Integrate Software and Hardware Asset Inventories

2.2.6 Address unapproved software

2.2.7 Utilize Application Whitelisting

2.2.8 Implement Application Whitelisting of Libraries

2.2.9 Implement Application Whitelisting of Scripts

Protect

2.2.10 Physically or Logically Segregate High Risk Applications

3 Continuous Vulnerability Management

3.3.1 Run Automated Vulnerability Scanning Tools

3.3.2 Perform Authenticated Vulnerability Scanning

3.3.3 Protect Dedicated Assessment Accounts

3.3.4 Deploy Automated Operating System Patch Management Tools

3.3.5 Deploy Automated Software Patch Management Tools

3.3.6 Compare Back-to-Back Vulnerability Scans

3.3.7 Utilize a Risk-Rating Process

4. Controlled Use of Administrative Privileges

4.4.1 Maintain Inventory of Administrative Accounts

4.4.2 Change Default Passwords

4.4.3 Ensure the Use of Dedicated Administrative Accounts

4.4.4 Use Unique Passwords

4.4.5 Use Multi-Factor Authentication for All Administrative Access

4.4.6 Use Dedicated Workstations For All Administrative Tasks

4.4.7 Limit Access to Script Tools

4.4.8 Log and Alert on Changes to Administrative Group Membership

4.4.9 Log and Alert on Unsuccessful Administrative Account Login

5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers

5.5.1 Establish Secure Configurations

5.5.2 Maintain Secure Images

5.5.3 Securely Store Master Images

5.5.4 Deploy System Configuration Management Tools

5.5.5 Implement Automated Configuration Monitoring Systems

6 Maintenance, Monitoring and Analysis of Audit Logs

6.6.1 Utilize Three Synchronized Time Sources

6.6.2 Activate Audit Logging

6.6.3 Enable Detailed Logging

6.6.4 Ensure Adequate Storage for Logs

6.6.5 Central Log Management

6.6.6 Deploy SIEM or Log Analytic Tools

6.6.7 Regularly Review Logs

6.6.8 Regularly Tune SIEM

7 Email and Web Browser Protections

7.7.1 Ensure Use of Only Fully Supported Browsers and Email Clients

7.7.2 Disable Unnecessary or Unauthorized Browser or Email Client Plugins

7.7.3 Limit Use of Scripting Languages in Web Browsers and Email Clients

7.7.4 Maintain and Enforce Network-Based URL Filters

7.7.5 Subscribe to URL-Categorization Service

7.7.6 Log All URL requester

7.7.7 Use of DNS Filtering Services

7.7.8 Implement DMARC and Enable Receiver-Side Verification ???

7.7.9 Block Unnecessary File Types

7.7.10 Sandbox All Email Attachments

8 Malware Defenses

8.8.1 Utilize Centrally Managed Anti-malware Software

8.8.2 Ensure Anti-Malware Software and Signatures Are Updated

8.8.3 Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit Technologies ???

8.8.4 Configure Anti-Malware Scanning of Removable Devices

8.8.5 Configure Devices to Not Auto-Run Content

8.8.6 Centralize Anti-Malware Logging

8.8.7 Enable DNS Query Logging

8.8.8 Enable Command-Line Audit Logging

9 Limitation and Control of Network Ports, Protocols, and Services

9.9.1 Associate Active Ports, Services, and Protocols to Asset Inventory

9.9.2 Ensure Only Approved Ports, Protocols, and Services Are Running

9.9.3 Perform Regular Automated Port Scans

9.9.4 Apply Host-Based Firewalls or Port-Filtering

2.2.7 Utilize `Application` Whitelisting

2.2.8 Implement Application Whitelisting of `Libraries`

2.2.9 Implement Application Whitelisting of `Scripts`

3.3.1 Run `Automated Vulnerability Scanning Tools`

3.3.2 Perform `Authenticated Vulnerability Scanning`

3.3.3 Protect `Dedicated Assessment Accounts`

3.3.4 Deploy `Automated Operating System Patch Management Tools`

3.3.5 Deploy `Automated Software Patch Management Tools`

3.3.7 Utilize a `Risk-Rating` Process

4.4.6 Use `Dedicated Workstations For All Administrative Tasks`

5.5.2 Maintain `Secure Images`

5.5.4 Deploy `System Configuration Management Tools`

6.6.1 Utilize `Three Synchronized Time Sources`

6.6.2 Activate `Audit Logging`

6.6.4 Ensure `Adequate Storage for Logs`

6.6.5 `Central Log Management`

6.6.6 Deploy `SIEM or Log Analytic Tools`

6.6.7 Regularly `Review Logs`

6.6.8 Regularly `Tune SIEM`

7.7.2 Disable Unnecessary or Unauthorized Browser or Email Client `Plugins`

7.7.4 Maintain and Enforce `Network-Based URL Filters`

7.7.5 Subscribe to `URL-Categorization Service`

7.7.6 `Log All URL requester`

7.7.7 Use of `DNS Filtering Services`

7.7.8 `Implement DMARC and Enable Receiver-Side Verification` ???

7.7.9 Block `Unnecessary File Types`

8.8.1 Utilize `Centrally Managed Anti-malware Software`

8.8.4 Configure `Anti-Malware Scanning of Removable Devices`

8.8.6 `Centralize Anti-Malware Logging`

8.8.7 Enable `DNS Query Logging`

9.9.3 Perform `Regular Automated Port Scans`

9.9.4 Apply `Host-Based Firewalls or Port-Filtering`

9.9.5 Implement `Application Firewalls`

10.10.1 Ensure `Regular Automated BackUps`

10.10.2 Perform `Complete System Backups`

10.10.5 Ensure All Backups Have `at Least One Offline Backup Destination`

11.11.1 Maintain `Standard Security Configurations` for Network Devices

11.11.2 Document `Traffic Configuration Rules`

11.11.3 Use `Automated Tools to Verify Standard Device Configurations and Detect Changes`

11.11.4 Install the Latest Stable Version of Any `Security-Related Updates on All Network Devices`

11.11.5 Manage Network Devices Using `Multi-Factor Authentication and Encrypted Sessions`

11.11.6 Use `Dedicated Machines` For All Network Administrative Tasks

11.11.7 Manage Network Infrastructure Through a `Dedicated Network`

12.12.2 `Scan for Unauthorized Connections` Across Trusted Network Boundaries

12.12.3 Deny Communications With `Known Malicious IP Addresses`

12.12.4 Deny Communication Over `Unauthorized Ports`

12.12.6 Deploy `Network-Based IDS Sensors`

12.12.7 Deploy `Network-Based IPS`

12.12.8 Deploy `NetFlow Collection` on Networking Boundary Devices

12.12.9 Deploy `Application Layer Filtering Proxy Server`

12.12.10 `Decrypt Network Traffic at Proxy`

12.12.11 Require All `Remote Login to Use Multi-Factor Authentication`

13.13.1 Maintain an `Inventory of Sensitive Information`

13.13.2 `Remove Sensitive Data or Systems Not Regularly Accessed by Organization`

14.14.1 `Segment the Network Based on Sensitivity`

14.14.2 Enable `Firewall Filtering Between VLANs`

14.14.5 Utilize an `Active Discovery Tool to Identify Sensitive Data`

14.14.6 Protect Information Through `Access Control Lists`

14.14.7 `Enforce Access Control to Data` Through Automated Tools

14.14.9 Enforce Detail Logging for `Access or Changes to Sensitive Data`

15.15.1 Maintain an `Inventory of Authorized Wireless Access Points`

15.15.2 Detect `Wireless Access Points` Connected to the Wired Network

15.15.3 Use a `Wireless IDS`

15.15.4 `Disable Wireless Access on Devices` if Not Required

15.15.5 `Limit Wireless Access on Client Devices`

15.15.7 Leverage the `Advanced Encryption Standard (AES) to Encrypt Wireless Data`

15.15.8 Use `Wireless Authentication Protocols That Require Mutual, Multi-Factor Authentication`

15.15.10 Create `Separate Wireless Network for Personal and Untrusted Devices`

16.16.1 Maintain an `Inventory of Authentication Systems`

16.16.2 Configure `Centralized Point of Authentication`

16.16.3 Require `Multi-Factor Authentication`

16.16.4 `Encrypt or Hash all Authentication Credentials`

16.16.6 Maintain an `Inventory of Accounts`

16.16.7 Establish `Process for Revoking Access`

16.16.8 Disable Any `Unassociated Accounts`