<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

The Pocket Guide for Implementing the CIS Security Controls

down-arrow

For CISOs and cybersecurity practitioners, tackling a framework like the CIS controls can be an intimidating task. With 20 critical controls to track and no specific route to achieving compliance, things can quickly become confusing. To ease this stress, we have developed a pocket guide to help ease the process of implementing CIS controls for any sized organization.

The Center for Internet Security (CIS) operates as a nonprofit organization dedicated to making the internet a better place for individuals, organizations, and governments. CIS controls serve as an international gold standard framework for mitigating companies from cyber threats and lead a global community of IT professionals that continuously work to evolve the CIS controls. CIS controls are based on risk management and share a lot of similarities to the NIST Cybersecurity Framework. CIS also has its process called the CIS Risk Assessment Method (CIS RAM) that requires implementing implementation tiers to measure an organization’s scope and determine what controls need to be implemented. CIS currently has 20 critical controls to guide readers on where to start their CIS critical controls’ implementation journey. We will be examining the twenty related to the five functions of the NIST CSF: Identify, Protect, Detect, Respond, and Recover.

How to Implement the CIS Critical Controls

Here we will be diving into the CIS controls to align with each of the five NIST CSF Functions’ outcomes.

First, identify and log all IT systems, networks, devices, and software to keep an inventory of your organizational assets and who has access to those assets.

1. Inventory and Control of Hardware Assets

2. Inventory and Control of Software Assets

Going further, provide evidence that assets and sensitive data are protected. Accomplish this by managing secure baseline configurations to prevent gaps and vulnerabilities within the organization. Additionally, this includes properly training personnel who have access to IT systems and sensitive information.

5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers

7. Email and Web Browser Protections

9. Limitation and Control of Network Ports, Protocols and Services

11. Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

12. Boundary Defense

13. Data Protection

14. Controlled Access Based on the Need to Know

15. Wireless Access Control

16. Account Monitoring and Control

17. Implement a Security Awareness and Training Program

18. Application Software Security

The organization will also need to provide evidence of cybersecurity detection in an anomaly or cybersecurity event and provide evidence of continuous monitoring and verify the effectiveness of protective measures.

3. Continuous Vulnerability Management

4. Controlled Use of Administrative Privileges

6. Maintenance, Monitoring and Analysis of Audit Logs

8. Malware Defenses

20. Penetration Tests and Red Team Exercises

With a cybersecurity event’s potential, the organization will need to prove it has an incident response plan. For this, provide evidence of the resources and people to contact in the circumstance of a cybersecurity event. This is done to mitigate the downtime and the detrimental impact that can occur in the event of a breach.

19. Incident Response and Management

The organization will also need to prove and log its data recovery capabilities to mitigate the potential damage from a cybersecurity event or day-zero attack. This will require evidence of backups that are properly maintained and protected.

10. Data Recovery Capabilities

Proving compliance with CIS is unique for each organization. Thankfully it shares many commonalities with the NIST CSF and many other gold standard cybersecurity frameworks. If you have any questions about CIS, CIS Controls or the NIST CSF, give us a call at 1-800 NIST CSF or click here, to learn more.

You may also like

October Product Update
on October 3, 2022

Hey, Jimmy - is it really always 5 o’clock somewhere? If not, it should be! With this release, we’re focusing on empowering our customers to work smarter, not harder. Whether ...

How Does FAIR Fit into ...
on September 26, 2022

The Factor Analysis of Information Risk (FAIR) methodology breaks down risk into elements that organizations can compute, understand, analyze and quantify cyber threats and their ...

All-in-One Cybersecurity Board ...
on September 19, 2022

CISOs and Board Members can no longer ignore the importance of cybersecurity. New cyber attacks and threats surface every week and threaten the security of business operations. ...

Rules for Effective Cyber Risk ...
on September 12, 2022

Cybersecurity threats are becoming more challenging for businesses. According to PurpleSec’s Cyber Security Trend Report in 2021, cybercrime surged by 600% during the pandemic, ...

A Pocket Guide to Factor Analysis ...
on September 14, 2022

FAIR, short for Factor Analysis of Information Risk, is a risk quantification methodology founded to help businesses evaluate information risks. FAIR is the only international ...

Your Guide to Cyber Risk ...
on August 30, 2022

During the pandemic, online businesses flourished as people turned to e-commerce stores to shop from the comfort and safety of their homes. This unprecedented expansion of ...