<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

The Pocket Guide for Implementing the CIS Security Controls

down-arrow

For CISOs and cybersecurity practitioners, tackling a framework like the CIS controls can be an intimidating task. With 20 critical controls to track and no specific route to achieving compliance, things can quickly become confusing. To ease this stress, we have developed a pocket guide to help ease the process of implementing CIS controls for any sized organization.

The Center for Internet Security (CIS) operates as a nonprofit organization dedicated to making the internet a better place for individuals, organizations, and governments. CIS controls serve as an international gold standard framework for mitigating companies from cyber threats and lead a global community of IT professionals that continuously work to evolve the CIS controls. CIS controls are based on risk management and share a lot of similarities to the NIST Cybersecurity Framework. CIS also has its process called the CIS Risk Assessment Method (CIS RAM) that requires implementing implementation tiers to measure an organization’s scope and determine what controls need to be implemented. CIS currently has 20 critical controls to guide readers on where to start their CIS critical controls’ implementation journey. We will be examining the twenty related to the five functions of the NIST CSF: Identify, Protect, Detect, Respond, and Recover.

How to Implement the CIS Critical Controls

Here we will be diving into the CIS controls to align with each of the five NIST CSF Functions’ outcomes.

First, identify and log all IT systems, networks, devices, and software to keep an inventory of your organizational assets and who has access to those assets.

1. Inventory and Control of Hardware Assets

2. Inventory and Control of Software Assets

Going further, provide evidence that assets and sensitive data are protected. Accomplish this by managing secure baseline configurations to prevent gaps and vulnerabilities within the organization. Additionally, this includes properly training personnel who have access to IT systems and sensitive information.

5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers

7. Email and Web Browser Protections

9. Limitation and Control of Network Ports, Protocols and Services

11. Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

12. Boundary Defense

13. Data Protection

14. Controlled Access Based on the Need to Know

15. Wireless Access Control

16. Account Monitoring and Control

17. Implement a Security Awareness and Training Program

18. Application Software Security

The organization will also need to provide evidence of cybersecurity detection in an anomaly or cybersecurity event and provide evidence of continuous monitoring and verify the effectiveness of protective measures.

3. Continuous Vulnerability Management

4. Controlled Use of Administrative Privileges

6. Maintenance, Monitoring and Analysis of Audit Logs

8. Malware Defenses

20. Penetration Tests and Red Team Exercises

With a cybersecurity event’s potential, the organization will need to prove it has an incident response plan. For this, provide evidence of the resources and people to contact in the circumstance of a cybersecurity event. This is done to mitigate the downtime and the detrimental impact that can occur in the event of a breach.

19. Incident Response and Management

The organization will also need to prove and log its data recovery capabilities to mitigate the potential damage from a cybersecurity event or day-zero attack. This will require evidence of backups that are properly maintained and protected.

10. Data Recovery Capabilities

Proving compliance with CIS is unique for each organization. Thankfully it shares many commonalities with the NIST CSF and many other gold standard cybersecurity frameworks. If you have any questions about CIS, CIS Controls or the NIST CSF, give us a call at 1-800 NIST CSF or click here, to learn more.

You may also like

What's New in NIST SP 800 53 Rev 5
on November 27, 2020

NIST Special Publication (SP) 800-53 offers regulatory guidelines and controls for federal information systems except those relating to national security. This catalog of security ...

NIST SP 800-53 Explained
on November 24, 2020

Has anyone ever been the victim of a data breach? I have, and it’s not a pleasant experience. For some, it’s as simple as getting a new credit or debit card, but for others, it ...

How Healthcare IT Teams Can Unify ...
on November 19, 2020

The Health Insurance Portability and Accountability Act (HIPAA) seeks to ensure that patients’ data, protected health information (PHI), is reasonably protected from both a ...

How the Convergence of IT and OT ...
on November 17, 2020

The oil and gas industry has transformed through the adoption of many new technologies. Information Technology (IT), Operational Technology (OT), and Internet of Things (IoT) ...

Three Ways Tracking NIST 800 53 in ...
on November 12, 2020

The new NIST 800-53 revision five has over one thousand controls. Let that sink in - over one thousand individual controls. Of course, as the sophistication of cyber-attacks has ...

How IRM is Accelerating Digital ...
on November 9, 2020

The way the insurance industry has operated has changed dramatically in recent years. With the rise of insurtech startups and digitalization using emerging technologies to bridge ...