CIS Controls v8
CIS Control 4: Secure Configuration of Enterprise Assets and Software

CIS Controls v8 CIS-4.1: Establish and Maintain a Secure Configuration Process

Set up and keep a process for configuring enterprise assets securely (end-user devices, portable and mobile ones included, IoT and other non-computing devices, and servers) as well as software (both operating systems and applications). Revisit the documentation each year, or sooner when a major change in the enterprise could affect this Safeguard.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 83 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 12 controls

  • 1.2.1 1.2.1 Ruleset configuration standards for NSCs
  • 1.2.7 1.2.7 Six-monthly review of NSC configurations
  • 1.2.8 1.2.8 NSC configuration files secured and consistent
  • 11.1.1 11.1.1 Requirement 11 policies and procedures managed
  • 2.1.1 2.1.1 Requirement 2 policies and procedures governed
  • 2.2.1 2.2.1 System configuration standards maintained
  • 2.2.6 2.2.6 System security parameters configured against misuse
  • 4.1.1 4.1.1 Requirement 4 policies and procedures maintained and communicated
  • 5.1.1 5.1.1 Requirement 5 policies and procedures maintained and communicated
  • 7.1.1 7.1.1 Requirement 7 policies and procedures maintained
  • 6.5.2 6.5.2 Confirm PCI DSS controls after significant change
  • 8.1.1 8.1.1 Requirement 8 policies and procedures maintained

FedRAMP High · 6 controls

  • CM-1 Policy and Procedures
  • CM-2 Baseline Configuration
  • CM-3 Configuration Change Control
  • CM-6 Configuration Settings
  • CM-6(1) Automated Management, Application, and Verification
  • CM-9 Configuration Management Plan

FedRAMP Moderate · 6 controls

  • CM-1 Policy and Procedures
  • CM-2 Baseline Configuration
  • CM-3 Configuration Change Control
  • CM-6 Configuration Settings
  • CM-6(1) Automated Management, Application, and Verification
  • CM-9 Configuration Management Plan

NIST SP 800-53 Rev 5 · 6 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

Azure Security Benchmark · 4 controls

  • ASBv3-GS-5 Define and implement security posture management strategy
  • ASBv3-PV-1 Define and establish secure configurations
  • ASBv3-PV-3 Define and establish secure configurations for compute resources
  • PV-2 Audit and enforce secure configurations

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

  • ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate
  • ANSSI-HYG-16 Use a Centralised Management Tool to Standardise Security Policies
  • ANSSI-HYG-33 Adopt Security Policies Dedicated to Mobile Terminals

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-04 User application hardening (Essential)
  • ASD37-11 Operating system hardening (Very Good)
  • ASD37-36 System recovery capabilities (Very Good)

Australian Information Security Manual · 3 controls

  • ISM-1588 Annual review of Standard Operating Environments
  • ISM-1914 Approved operating system configurations
  • ISM-1915 Approved user application configurations

C5 (Germany) · 3 controls

  • C5-AM-03 Commissioning of Hardware
  • C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening
  • C5-PSS-11 Images for Virtual Machines and Containers

CMMC 2.0 · 3 controls

NIST SP 800-161 Rev 1 · 3 controls

AWS Well-Architected Security Pillar · 2 controls

  • SEC01-BP06 Automate deployment of standard security controls
  • SEC06-BP02 Provision compute from hardened images

DORA · 2 controls

ISO 27001:2022 · 2 controls

  • 5.37 Documented operating procedures
  • 8.9 Configuration management

ISO 27002:2022 · 2 controls

  • 5.37 Documented operating procedures
  • 8.9 Configuration management

ISO 27701:2019 · 2 controls

  • 6.3.2 Mobile devices and teleworking
  • 6.9.1 Operational procedures and responsibilities

NIST SP 800-171 Rev 3 · 2 controls

NIST SP 800-172 · 2 controls

  • 3.14.4e Refresh Systems and Components from a Trusted Baseline
  • 3.4.2e Automated Detection and Remediation of Unauthorized Software

SOC 2 · 2 controls

  • SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

ACSC Essential Eight · 1 control

  • E8-UAH-ML2 User Application Hardening - Maturity Level 2

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-2 Secure the network and systems within the data environment

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

DISA Security Technical Implementation Guides (STIGs) · 1 control

  • STIG-SRG-OS Operating system STIG hardening

HIPAA Security Rule · 1 control

ISO/IEC 42001:2023 · 1 control

NIS2 Directive · 1 control

  • Art.21.2.g Basic cyber hygiene practices and cybersecurity training

NIST Cybersecurity Framework 2.0 · 1 control

NIST SP 800-218 · 1 control

UK Cyber Essentials · 1 control

  • CE-SC.1 Remove or Disable Unused Software

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in CIS Control 4: Secure Configuration of Enterprise Assets and Software

You are reading one control. How much of CIS Controls v8 have you already done?

CIS Controls v8 CIS-4.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.

If you hold ISO 27001:202266.7% covered · 51 gapsIf you hold FedRAMP Moderate62.7% covered · 57 gapsIf you hold NIST SP 800-53 Rev 557.5% covered · 65 gapsIf you hold NIST Cybersecurity Framework 2.050.3% covered · 76 gapsIf you hold ISO 27002:202249.7% covered · 77 gapsIf you hold Azure Security Benchmark49% covered · 78 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 83 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll CIS Controls v8 controls