Frameworks / CIS Controls v8 / CIS-12.2 CIS Controls v8
CIS Control 12: Network Infrastructure Management
CIS Controls v8 CIS-12.2: Establish and Maintain a Secure Network Architecture Set up and keep a secure network architecture that deals, as a minimum, with segmentation, least privilege and availability.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 91 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AC-17 Remote Access AC-4 Information Flow Enforcement AC-4(21) Physical or Logical Separation of Information Flows AC-6 Least Privilege PL-8 Security and Privacy Architectures SC-45 System Time Synchronization (SC-45) SC-7 Boundary Protection SC-7(3) Access Points SC-7(4) External Telecommunications Services AC-17 Remote Access AC-4 Information Flow Enforcement AC-4(21) Physical or Logical Separation of Information Flows AC-6 Least Privilege PL-8 Security and Privacy Architectures SC-45 System Time Synchronization (SC-45) SC-7 Boundary Protection SC-7(3) Access Points SC-7(4) External Telecommunications Services 1.2.3 1.2.3 Accurate network diagram of CDE connections 1.3.1 1.3.1 Inbound CDE traffic restricted 1.3.2 1.3.2 Outbound CDE traffic restricted 1.3.3 1.3.3 NSCs between wireless networks and the CDE 1.4.1 1.4.1 NSCs between trusted and untrusted networks 1.4.3 1.4.3 Anti-spoofing measures at trusted boundary 1.4.4 1.4.4 Cardholder data stores not reachable from untrusted networks 5.15 Access control 8.20 Networks security 8.21 Security of network services 8.22 Segregation of networks 8.27 Secure system architecture and engineering principles 8.31 Separation of development, test and production environments ANSSI-HYG-19 Segment the Network and Partition the Zones ANSSI-HYG-20 Secure Wi-Fi Access Networks and Separate Usage ANSSI-HYG-23 Partition Internet Facing Services from the Rest of the Information System ANSSI-HYG-25 Secure Dedicated Network Interconnections with Partners ANSSI-HYG-28 Use a Dedicated and Partitioned Network for Administration 8.20 Networks security 8.21 Security of network services 8.22 Segregation of networks 8.27 Secure system architecture and engineering principles 8.31 Separation of development, test and production environments SOC2-A1.1 A1.1 Managing processing capacity SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11) SOC2-CC6.1 CC6.1 Logical access security over protected information assets SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary C5-COS-01 Technical safeguards C5-COS-02 Security requirements for connections in the Cloud Service Provider's network C5-COS-03 Monitoring of connections in the Cloud Service Provider's network C5-COS-06 Segregation of data traffic in jointly used network environments NIST-CSF-ID.AM-03 Representations of the organization's authorized network communication and internal and external network data flows are maintained NIST-CSF-PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage NIST-CSF-PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations ASBv3-GS-2 Define and implement enterprise segmentation/separation of duties strategy ASBv3-GS-4 Define and implement network security strategy NS-1 Establish network segmentation boundaries ASD37-08 Deny direct internet connectivity (Excellent) ASD37-22 Network segmentation (Excellent) ISM-1181 Network zones by criticality ISM-1182 Restricting traffic between network segments 6.10 Communications security 6.10.1 Network security management 3.1.3e Employ Secure Information Transfer Solutions 3.13.1e Create Diversity in System Components to Limit Malicious Code Propagation AUCDR-IS-2 Secure the network and systems within the data environment Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in CIS Control 12: Network Infrastructure Management You are reading one control. How much of CIS Controls v8 have you already done? CIS Controls v8 CIS-12.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 91 it maps to, and the evidence behind each claim, over MCP and REST.