CIS Controls v8

International

vv8.1

18 domains

153 controls

Center for Internet Security Critical Security Controls - prioritized set of actions to protect organizations and data from known cyber attack vectors

Verified

Get the official standard — this page is an AI-assisted companion tool, not a replacement for the authoritative text.

Visit cisecurity.org

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (18)

CIS Control 10: Malware Defenses

7 controls

Controls in the CIS Control 10: Malware Defenses domain of CIS Controls v8 — 7 controls
Code	Title	Description
CIS-10.1	Deploy and Maintain Anti-Malware Software	Deploy and maintain anti-malware software on all enterprise assets.
CIS-10.2	Configure Automatic Anti-Malware Signature Updates	Configure automatic updates for anti-malware signature files on all enterprise assets.
CIS-10.3	Disable Autorun and Autoplay for Removable Media	Disable autorun and autoplay auto-execute functionality for removable media.
CIS-10.4	Configure Automatic Anti-Malware Scanning of Removable Media	Configure anti-malware software to automatically scan removable media.
CIS-10.5	Enable Anti-Exploitation Features	Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution P...
CIS-10.6	Centrally Manage Anti-Malware Software	Centrally manage anti-malware software.
CIS-10.7	Use Behavior-Based Anti-Malware Software	Use behavior-based anti-malware software.

CIS Control 11: Data Recovery

5 controls

Controls in the CIS Control 11: Data Recovery domain of CIS Controls v8 — 5 controls
Code	Title	Description
CIS-11.1	Establish and Maintain a Data Recovery Process	Establish and maintain a data recovery process. In the process, address the scope of data recovery activities, recovery...
CIS-11.2	Perform Automated Backups	Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivit...
CIS-11.3	Protect Recovery Data	Protect recovery data with equivalent controls to the original data. Reference encryption or data separation, based on r...
CIS-11.4	Establish and Maintain an Isolated Instance of Recovery Data	Establish and maintain an isolated instance of recovery data. Example implementations include, version controlling backu...
CIS-11.5	Test Data Recovery	Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets.

CIS Control 12: Network Infrastructure Management

8 controls

Controls in the CIS Control 12: Network Infrastructure Management domain of CIS Controls v8 — 8 controls
Code	Title	Description
CIS-12.1	Ensure Network Infrastructure is Up-to-Date	Ensure network infrastructure is kept up-to-date. Example implementations include running the latest stable release of s...
CIS-12.2	Establish and Maintain a Secure Network Architecture	Establish and maintain a secure network architecture. A secure network architecture must address segmentation, least pri...
CIS-12.3	Securely Manage Network Infrastructure	Securely manage network infrastructure. Example implementations include version-controlled-infrastructure-as-code, and t...
CIS-12.4	Establish and Maintain Architecture Diagram(s)	Establish and maintain architecture diagram(s) and/or other network system documentation. Review and update documentatio...
CIS-12.5	Centralize Network Authentication, Authorization, and Auditing (AAA)	Centralize network AAA.
CIS-12.6	Use of Secure Network Management and Communication Protocols	Use secure network management and communication protocols (e.g., 802.1X, Wi-Fi Protected Access 2 (WPA2) Enterprise or g...
CIS-12.7	Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise’s AAA Infrastructure	Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resour...
CIS-12.8	Establish and Maintain Dedicated Computing Resources for All Administrative Work	Establish and maintain dedicated computing resources, either physically or logically separated, for all administrative t...

CIS Control 13: Network Monitoring and Defense

11 controls

Controls in the CIS Control 13: Network Monitoring and Defense domain of CIS Controls v8 — 11 controls
Code	Title	Description
CIS-13.1	Centralize Security Event Alerting	Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice implementati...
CIS-13.10	Perform Application Layer Filtering	Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or g...
CIS-13.11	Tune Security Event Alerting Thresholds	Tune security event alerting thresholds monthly, or more frequently.
CIS-13.2	Deploy a Host-Based Intrusion Detection Solution	Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.
CIS-13.3	Deploy a Network Intrusion Detection Solution	Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include t...
CIS-13.4	Perform Traffic Filtering Between Network Segments	Perform traffic filtering between network segments, where appropriate.
CIS-13.5	Manage Access Control for Remote Assets	Manage access control for assets remotely connecting to enterprise resources. Determine amount of access to enterprise r...
CIS-13.6	Collect Network Traffic Flow Logs	Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.
CIS-13.7	Deploy a Host-Based Intrusion Prevention Solution	Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example impl...
CIS-13.8	Deploy a Network Intrusion Prevention Solution	Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a Network...
CIS-13.9	Deploy Port-Level Access Control	Deploy port-level access control. Port-level access control utilizes 802.1x, or similar network access control protocols...

CIS Control 14: Security Awareness and Skills Training

9 controls

Controls in the CIS Control 14: Security Awareness and Skills Training domain of CIS Controls v8 — 9 controls
Code	Title	Description
CIS-14.1	Establish and Maintain a Security Awareness Program	Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enter...
CIS-14.2	Train Workforce Members to Recognize Social Engineering Attacks	Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.
CIS-14.3	Train Workforce Members on Authentication Best Practices	Train workforce members on authentication best practices. Example topics include MFA, password composition, and credenti...
CIS-14.4	Train Workforce on Data Handling Best Practices	Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This also...
CIS-14.5	Train Workforce Members on Causes of Unintentional Data Exposure	Train workforce members to be aware of causes for unintentional data exposure. Example topics include mis-delivery of se...
CIS-14.6	Train Workforce Members on Recognizing and Reporting Security Incidents	Train workforce members to be able to recognize a potential incident and be able to report such an incident.
CIS-14.7	Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates	Train workforce to understand how to verify and report out-of-date software patches or any failures in automated process...
CIS-14.8	Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks	Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for enterprise ac...
CIS-14.9	Conduct Role-Specific Security Awareness and Skills Training	Conduct role-specific security awareness and skills training. Example implementations include secure system administrati...

CIS Control 15: Service Provider Management

7 controls

Controls in the CIS Control 15: Service Provider Management domain of CIS Controls v8 — 7 controls
Code	Title	Description
CIS-15.1	Establish and Maintain an Inventory of Service Providers	Establish and maintain an inventory of service providers. The inventory is to list all known service providers, include...
CIS-15.2	Establish and Maintain a Service Provider Management Policy	Establish and maintain a service provider management policy. Ensure the policy addresses the classification, inventory,...
CIS-15.3	Classify Service Providers	Classify service providers. Classification consideration may include one or more characteristics, such as data sensitivi...
CIS-15.4	Ensure Service Provider Contracts Include Security Requirements	Ensure service provider contracts include security requirements. Example requirements may include minimum security progr...
CIS-15.5	Assess Service Providers	Assess service providers consistent with the enterprise’s service provider management policy. Assessment scope may vary...
CIS-15.6	Monitor Service Providers	Monitor service providers consistent with the enterprise’s service provider management policy. Monitoring may include pe...
CIS-15.7	Securely Decommission Service Providers	Securely decommission service providers. Example considerations include user and service account deactivation, terminati...

CIS Control 16: Application Software Security

14 controls

Controls in the CIS Control 16: Application Software Security domain of CIS Controls v8 — 14 controls
Code	Title	Description
CIS-16.1	Establish and Maintain a Secure Application Development Process	Establish and maintain a secure application development process. In the process, address such items as: secure applicati...
CIS-16.10	Apply Secure Design Principles in Application Architectures	Apply secure design principles in application architectures. Secure design principles include the concept of least privi...
CIS-16.11	Leverage Vetted Modules or Services for Application Security Components	Leverage vetted modules or services for application security components, such as identity management, encryption, and au...
CIS-16.12	Implement Code-Level Security Checks	Apply static and dynamic analysis tools within the application life cycle to verify that secure coding practices are bei...
CIS-16.13	Conduct Application Penetration Testing	Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited t...
CIS-16.14	Conduct Threat Modeling	Conduct threat modeling. Threat modeling is the process of identifying and addressing application security design flaws...
CIS-16.2	Establish and Maintain a Process to Accept and Address Software Vulnerabilities	Establish and maintain a process to accept and address reports of software vulnerabilities, including providing a means...
CIS-16.3	Perform Root Cause Analysis on Security Vulnerabilities	Perform root cause analysis on security vulnerabilities. When reviewing vulnerabilities, root cause analysis is the task...
CIS-16.4	Establish and Manage an Inventory of Third-Party Software Components	Establish and manage an updated inventory of third-party components used in development, often referred to as a “bill of...
CIS-16.5	Use Up-to-Date and Trusted Third-Party Software Components	Use up-to-date and trusted third-party software components. When possible, choose established and proven frameworks and...
CIS-16.6	Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities	Establish and maintain a severity rating system and process for application vulnerabilities that facilitates prioritizin...
CIS-16.7	Use Standard Hardening Configuration Templates for Application Infrastructure	Use standard, industry-recommended hardening configuration templates for application infrastructure components. This inc...
CIS-16.8	Separate Production and Non-Production Systems	Maintain separate environments for production and non-production systems.
CIS-16.9	Train Developers in Application Security Concepts and Secure Coding	Ensure that all software development personnel receive training in writing secure code for their specific development en...

CIS Control 17: Incident Response Management

9 controls

Controls in the CIS Control 17: Incident Response Management domain of CIS Controls v8 — 9 controls
Code	Title	Description
CIS-17.1	Designate Personnel to Manage Incident Handling	Designate one key person, and at least one backup, who will manage the enterprise’s incident handling process. Managemen...
CIS-17.2	Establish and Maintain Contact Information for Reporting Security Incidents	Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may incl...
CIS-17.3	Establish and Maintain an Enterprise Process for Reporting Incidents	Establish and maintain an enterprise process for the workforce to report security incidents. The process includes report...
CIS-17.4	Establish and Maintain an Incident Response Process	Establish and maintain an incident response process that addresses roles and responsibilities, compliance requirements,...
CIS-17.5	Assign Key Roles and Responsibilities	Assign key roles and responsibilities for incident response, including staff from legal, IT, information security, facil...
CIS-17.6	Define Mechanisms for Communicating During Incident Response	Determine which primary and secondary mechanisms will be used to communicate and report during a security incident. Mech...
CIS-17.7	Conduct Routine Incident Response Exercises	Plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident response p...
CIS-17.8	Conduct Post-Incident Reviews	Conduct post-incident reviews. Post-incident reviews help prevent incident recurrence through identifying lessons learne...
CIS-17.9	Establish and Maintain Security Incident Thresholds	Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an...

CIS Control 18: Penetration Testing

5 controls

Controls in the CIS Control 18: Penetration Testing domain of CIS Controls v8 — 5 controls
Code	Title	Description
CIS-18.1	Establish and Maintain a Penetration Testing Program	Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise...
CIS-18.2	Perform Periodic External Penetration Tests	Perform periodic external penetration tests based on program requirements, no less than annually. External penetration t...
CIS-18.3	Remediate Penetration Test Findings	Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.
CIS-18.4	Validate Security Measures	Validate security measures after each penetration test. If deemed necessary, modify rulesets and capabilities to detect...
CIS-18.5	Perform Periodic Internal Penetration Tests	Perform periodic internal penetration tests based on program requirements, no less than annually. The testing may be cle...

CIS Control 1: Inventory and Control of Enterprise Assets

5 controls

Controls in the CIS Control 1: Inventory and Control of Enterprise Assets domain of CIS Controls v8 — 5 controls
Code	Title	Description
CIS-1.1	Establish and Maintain Detailed Enterprise Asset Inventory	Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to st...
CIS-1.2	Address Unauthorized Assets	Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to remove the a...
CIS-1.3	Utilize an Active Discovery Tool	Utilize an active discovery tool to identify assets connected to the enterprise’s network. Configure the active discover...
CIS-1.4	Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory	Use DHCP logging on all DHCP servers or Internet Protocol (IP) address management tools to update the enterprise’s asset...
CIS-1.5	Use a Passive Asset Discovery Tool	Use a passive discovery tool to identify assets connected to the enterprise’s network. Review and use scans to update th...

CIS Control 2: Inventory and Control of Software Assets

7 controls

Controls in the CIS Control 2: Inventory and Control of Software Assets domain of CIS Controls v8 — 7 controls
Code	Title	Description
CIS-2.1	Establish and Maintain a Software Inventory	Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The software invent...
CIS-2.2	Ensure Authorized Software is Currently Supported	Ensure that only currently supported software is designated as authorized in the software inventory for enterprise asset...
CIS-2.3	Address Unauthorized Software	Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Re...
CIS-2.4	Utilize Automated Software Inventory Tools	Utilize software inventory tools, when possible, throughout the enterprise to automate the discovery and documentation o...
CIS-2.5	Allowlist Authorized Software	Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be acce...
CIS-2.6	Allowlist Authorized Libraries	Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files,...
CIS-2.7	Allowlist Authorized Scripts	Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as...

CIS Control 3: Data Protection

14 controls

Controls in the CIS Control 3: Data Protection domain of CIS Controls v8 — 14 controls
Code	Title	Description
CIS-3.1	Establish and Maintain a Data Management Process	Establish and maintain a data management process. In the process, address data sensitivity, data owner, handling of data...
CIS-3.10	Encrypt Sensitive Data in Transit	Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure S...
CIS-3.11	Encrypt Sensitive Data at Rest	Encrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer encrypti...
CIS-3.12	Segment Data Processing and Storage Based on Sensitivity	Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise as...
CIS-3.13	Deploy a Data Loss Prevention Solution	Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all sensitive data stored,...
CIS-3.14	Log Sensitive Data Access	Log sensitive data access, including modification and disposal.
CIS-3.2	Establish and Maintain a Data Inventory	Establish and maintain a data inventory, based on the enterprise’s data management process. Inventory sensitive data, at...
CIS-3.3	Configure Data Access Control Lists	Configure data access control lists based on a user’s need to know. Apply data access control lists, also known as acces...
CIS-3.4	Enforce Data Retention	Retain data according to the enterprise’s data management process. Data retention must include both minimum and maximum...
CIS-3.5	Securely Dispose of Data	Securely dispose of data as outlined in the enterprise’s data management process. Ensure the disposal process and method...
CIS-3.6	Encrypt Data on End-User Devices	Encrypt data on end-user devices containing sensitive data. Example implementations can include: Windows BitLocker®, App...
CIS-3.7	Establish and Maintain a Data Classification Scheme	Establish and maintain an overall data classification scheme for the enterprise. Enterprises may use labels, such as “Se...
CIS-3.8	Document Data Flows	Document data flows. Data flow documentation includes service provider data flows and should be based on the enterprise’...
CIS-3.9	Encrypt Data on Removable Media	Encrypt data on removable media.

CIS Control 4: Secure Configuration of Enterprise Assets and Software

12 controls

Controls in the CIS Control 4: Secure Configuration of Enterprise Assets and Software domain of CIS Controls v8 — 12 controls
Code	Title	Description
CIS-4.1	Establish and Maintain a Secure Configuration Process	Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mo...
CIS-4.10	Enforce Automatic Device Lockout on Portable End-User Devices	Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable...
CIS-4.11	Enforce Remote Wipe Capability on Portable End-User Devices	Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate such as lost or st...
CIS-4.12	Separate Enterprise Workspaces on Mobile End-User Devices	Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example implementations incl...
CIS-4.2	Establish and Maintain a Secure Configuration Process for Network Infrastructure	Establish and maintain a secure configuration process for network devices. Review and update documentation annually, or...
CIS-4.3	Configure Automatic Session Locking on Enterprise Assets	Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose opera...
CIS-4.4	Implement and Manage a Firewall on Servers	Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operati...
CIS-4.5	Implement and Manage a Firewall on End-User Devices	Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that dro...
CIS-4.6	Securely Manage Enterprise Assets and Software	Securely manage enterprise assets and software. Example implementations include managing configuration through version-c...
CIS-4.7	Manage Default Accounts on Enterprise Assets and Software	Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor...
CIS-4.8	Uninstall or Disable Unnecessary Services on Enterprise Assets and Software	Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web...
CIS-4.9	Configure Trusted DNS Servers on Enterprise Assets	Configure trusted DNS servers on enterprise assets. Example implementations include: configuring assets to use enterpris...

CIS Control 5: Account Management

6 controls

Controls in the CIS Control 5: Account Management domain of CIS Controls v8 — 6 controls
Code	Title	Description
CIS-5.1	Establish and Maintain an Inventory of Accounts	Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both user and...
CIS-5.2	Use Unique Passwords	Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character pass...
CIS-5.3	Disable Dormant Accounts	Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.
CIS-5.4	Restrict Administrator Privileges to Dedicated Administrator Accounts	Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing ac...
CIS-5.5	Establish and Maintain an Inventory of Service Accounts	Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, rev...
CIS-5.6	Centralize Account Management	Centralize account management through a directory or identity service.

CIS Control 6: Access Control Management

8 controls

Controls in the CIS Control 6: Access Control Management domain of CIS Controls v8 — 8 controls
Code	Title	Description
CIS-6.1	Establish an Access Granting Process	Establish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, rights gra...
CIS-6.2	Establish an Access Revoking Process	Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accoun...
CIS-6.3	Require MFA for Externally-Exposed Applications	Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA thr...
CIS-6.4	Require MFA for Remote Network Access	Require MFA for remote network access.
CIS-6.5	Require MFA for Administrative Access	Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site o...
CIS-6.6	Establish and Maintain an Inventory of Authentication and Authorization Systems	Establish and maintain an inventory of the enterprise’s authentication and authorization systems, including those hosted...
CIS-6.7	Centralize Access Control	Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.
CIS-6.8	Define and Maintain Role-Based Access Control	Define and maintain role-based access control, through determining and documenting the access rights necessary for each...

CIS Control 7: Continuous Vulnerability Management

7 controls

Controls in the CIS Control 7: Continuous Vulnerability Management domain of CIS Controls v8 — 7 controls
Code	Title	Description
CIS-7.1	Establish and Maintain a Vulnerability Management Process	Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentat...
CIS-7.2	Establish and Maintain a Remediation Process	Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more freq...
CIS-7.3	Perform Automated Operating System Patch Management	Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent,...
CIS-7.4	Perform Automated Application Patch Management	Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basi...
CIS-7.5	Perform Automated Vulnerability Scans of Internal Enterprise Assets	Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct bot...
CIS-7.6	Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets	Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scann...
CIS-7.7	Remediate Detected Vulnerabilities	Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, base...

CIS Control 8: Audit Log Management

12 controls

Controls in the CIS Control 8: Audit Log Management domain of CIS Controls v8 — 12 controls
Code	Title	Description
CIS-8.1	Establish and Maintain an Audit Log Management Process	Establish and maintain an audit log management process that defines the enterprise’s logging requirements. At a minimum,...
CIS-8.10	Retain Audit Logs	Retain audit logs across enterprise assets for a minimum of 90 days.
CIS-8.11	Conduct Audit Log Reviews	Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct rev...
CIS-8.12	Collect Service Provider Logs	Collect service provider logs, where supported. Example implementations include collecting authentication and authorizat...
CIS-8.2	Collect Audit Logs	Collect audit logs. Ensure that logging, per the enterprise’s audit log management process, has been enabled across ente...
CIS-8.3	Ensure Adequate Audit Log Storage	Ensure that logging destinations maintain adequate storage to comply with the enterprise’s audit log management process.
CIS-8.4	Standardize Time Synchronization	Standardize time synchronization. Configure at least two synchronized time sources across enterprise assets, where suppo...
CIS-8.5	Collect Detailed Audit Logs	Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username,...
CIS-8.6	Collect DNS Query Audit Logs	Collect DNS query audit logs on enterprise assets, where appropriate and supported.
CIS-8.7	Collect URL Request Audit Logs	Collect URL request audit logs on enterprise assets, where appropriate and supported.
CIS-8.8	Collect Command-Line Audit Logs	Collect command-line audit logs. Example implementations include collecting audit logs from PowerShell®, BASH™, and remo...
CIS-8.9	Centralize Audit Logs	Centralize, to the extent possible, audit log collection and retention across enterprise assets.

CIS Control 9: Email and Web Browser Protections

7 controls

Controls in the CIS Control 9: Email and Web Browser Protections domain of CIS Controls v8 — 7 controls
Code	Title	Description
CIS-9.1	Ensure Use of Only Fully Supported Browsers and Email Clients	Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest v...
CIS-9.2	Use DNS Filtering Services	Use DNS filtering services on all enterprise assets to block access to known malicious domains.
CIS-9.3	Maintain and Enforce Network-Based URL Filters	Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or un...
CIS-9.4	Restrict Unnecessary or Unauthorized Browser and Email Client Extensions	Restrict, either through uninstalling or disabling, any unauthorized or unnecessary browser or email client plugins, ext...
CIS-9.5	Implement DMARC	To lower the chance of spoofed or modified emails from valid domains, implement DMARC policy and verification, starting...
CIS-9.6	Block Unnecessary File Types	Block unnecessary file types attempting to enter the enterprise’s email gateway.
CIS-9.7	Deploy and Maintain Email Server Anti-Malware Protections	Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing.

Maps to 2 other frameworks

153 total controls

ASD Strategies to Mitigate Cyber Security Incidents

10 source controls mapped|10 target controls covered

DISA Security Technical Implementation Guides (STIGs)

1 source controls mapped|1 target controls covered

Compare CIS Controls v8 with ASD Strategies to Mitigate Cyber Security Incidents

Frequently Asked Questions

What is CIS Controls v8?

CIS Controls v8 is a compliance framework from International with 18 domains and 153 controls. Center for Internet Security Critical Security Controls - prioritized set of actions to protect organizations and data from known cyber attack vectors It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does CIS Controls v8 have?

CIS Controls v8 has 153 controls organised across 18 domains. The largest domains are CIS Control 16: Application Software Security (14 controls), CIS Control 3: Data Protection (14 controls), CIS Control 4: Secure Configuration of Enterprise Assets and Software (12 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does CIS Controls v8 map to?

CIS Controls v8 maps to 2 other compliance frameworks. The top mapping partners are ASD Strategies to Mitigate Cyber Security Incidents (7% coverage), DISA Security Technical Implementation Guides (STIGs) (1% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with CIS Controls v8 compliance?

Start your CIS Controls v8 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CIS Controls v8 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 153 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required