CIS Controls v8 CIS-18.4: Validate Security Measures

What else in your programme already covers this

This control maps to 59 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

SOC 2 · 7 controls

SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
SOC2-CC7.2 CC7.2 Monitoring system components for anomalies
SOC2-CC7.3 CC7.3 Evaluating security events to identify incidents

ISO 27001:2022 · 6 controls

5.24 Information security incident management planning and preparation
5.25 Assessment and decision on information security events
5.27 Learning from information security incidents
5.36 Compliance with policies, rules and standards for information security
8.29 Security testing in development and acceptance
8.32 Change management

ISO 27701:2019 · 5 controls

5.6.2 Information security risk assessment
5.7 Performance evaluation
5.7.1 Monitoring, measurement, analysis and evaluation
5.8.1 Nonconformity and corrective action
6.9.6 Technical vulnerability management

NIST SP 800-53 Rev 5 · 5 controls

NIST800-CA-2 CA-2 Control Assessments
NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-CA-8 CA-8 Penetration Testing
NIST800-IR-4 IR-4 Incident Handling
NIST800-SI-6 SI-6 Security and Privacy Function Verification

FedRAMP High · 3 controls

CA-2 Control Assessments
CA-7 Continuous Monitoring
CM-4(2) Impact Analyses | Verification of Controls (CM-4(2))

FedRAMP Moderate · 3 controls

CA-2 Control Assessments
CA-7 Continuous Monitoring
CM-4(2) Impact Analyses | Verification of Controls (CM-4(2))

ISO/IEC 42001:2023 · 3 controls

10.2 Nonconformity and corrective action
9.1 Monitoring, measurement, analysis and evaluation
A.6.2.4 AI system verification and validation

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-ID.IM-01 Improvements are identified from evaluations
NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established

PCI DSS 4.0 · 3 controls

11.4.4 11.4.4 Correct exploitable findings from penetration tests
11.4.5 11.4.5 Annual segmentation penetration testing
11.4.6 11.4.6 Service provider segmentation testing every six months

CMMC 2.0 · 2 controls

CA.L2-3.12.1 Security Control Assessment
CA.L2-3.12.3 Security Control Monitoring

ISO 22301:2019 · 2 controls

8.6 Evaluation of business continuity documentation and capabilities
9.2 Internal audit

NIST SP 800-172 · 2 controls

3.11.5e Assess Effectiveness of Security Solutions
3.14.7e Verify Correctness of Security Functions

NIST SP 800-53A Rev. 5 · 2 controls

53A-3.5 Assess Security and Privacy Capabilities
53A-C-TEST Assessment Method: Test

APRA CPS 234 · 1 control

CPS234-P31 Annual Review of Testing Program Sufficiency

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

Australian Information Security Manual · 1 control

ISM-1636 Security assessment by organisational or IRAP assessors

C5 (Germany) · 1 control

C5-OPS-20 Managing Vulnerabilities, Malfunctions and Errors - Measurements, Analyses and Assessments of Procedures

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-15 Controls Testing

DORA · 1 control

DORA-Art.24 General requirements for the performance of digital operational resilience testing

HIPAA Security Rule · 1 control

164.308(a)(8) Evaluation (Standard)

ISO 27002:2022 · 1 control

5.36 Compliance with policies, rules and standards for information security

NIS2 Directive · 1 control

Art.21.2.f Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures

NIST SP 800-161 Rev 1 · 1 control

161R1-CA-2 Control Assessments

NIST SP 800-171 Rev 3 · 1 control

03.12.01 Security Assessment

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(8) Evaluation (Standard)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of CIS Controls v8 have you already done?

CIS Controls v8 CIS-18.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.

If you hold ISO 27001:202266.7% covered · 51 gaps If you hold FedRAMP Moderate62.7% covered · 57 gaps If you hold NIST SP 800-53 Rev 557.5% covered · 65 gaps If you hold NIST Cybersecurity Framework 2.050.3% covered · 76 gaps If you hold ISO 27002:202249.7% covered · 77 gaps If you hold Azure Security Benchmark49% covered · 78 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free