<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

The Pocket Guide for Implementing the CIS Security Controls

down-arrow

For CISOs and cybersecurity practitioners, tackling a framework like the CIS controls can be an intimidating task. With 20 critical controls to track and no specific route to achieving compliance, things can quickly become confusing. To ease this stress, we have developed a pocket guide to help ease the process of implementing CIS controls for any sized organization.

The Center for Internet Security (CIS) operates as a nonprofit organization dedicated to making the internet a better place for individuals, organizations, and governments. CIS controls serve as an international gold standard framework for mitigating companies from cyber threats and lead a global community of IT professionals that continuously work to evolve the CIS controls. CIS controls are based on risk management and share a lot of similarities to the NIST Cybersecurity Framework. CIS also has its process called the CIS Risk Assessment Method (CIS RAM) that requires implementing implementation tiers to measure an organization’s scope and determine what controls need to be implemented. CIS currently has 20 critical controls to guide readers on where to start their CIS critical controls’ implementation journey. We will be examining the twenty related to the five functions of the NIST CSF: Identify, Protect, Detect, Respond, and Recover.

How to Implement the CIS Critical Controls

Here we will be diving into the CIS controls to align with each of the five NIST CSF Functions’ outcomes.

First, identify and log all IT systems, networks, devices, and software to keep an inventory of your organizational assets and who has access to those assets.

1. Inventory and Control of Hardware Assets

2. Inventory and Control of Software Assets

Going further, provide evidence that assets and sensitive data are protected. Accomplish this by managing secure baseline configurations to prevent gaps and vulnerabilities within the organization. Additionally, this includes properly training personnel who have access to IT systems and sensitive information.

5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers

7. Email and Web Browser Protections

9. Limitation and Control of Network Ports, Protocols and Services

11. Secure Configuration for Network Devices, such as Firewalls, Routers and Switches

12. Boundary Defense

13. Data Protection

14. Controlled Access Based on the Need to Know

15. Wireless Access Control

16. Account Monitoring and Control

17. Implement a Security Awareness and Training Program

18. Application Software Security

The organization will also need to provide evidence of cybersecurity detection in an anomaly or cybersecurity event and provide evidence of continuous monitoring and verify the effectiveness of protective measures.

3. Continuous Vulnerability Management

4. Controlled Use of Administrative Privileges

6. Maintenance, Monitoring and Analysis of Audit Logs

8. Malware Defenses

20. Penetration Tests and Red Team Exercises

With a cybersecurity event’s potential, the organization will need to prove it has an incident response plan. For this, provide evidence of the resources and people to contact in the circumstance of a cybersecurity event. This is done to mitigate the downtime and the detrimental impact that can occur in the event of a breach.

19. Incident Response and Management

The organization will also need to prove and log its data recovery capabilities to mitigate the potential damage from a cybersecurity event or day-zero attack. This will require evidence of backups that are properly maintained and protected.

10. Data Recovery Capabilities

Proving compliance with CIS is unique for each organization. Thankfully it shares many commonalities with the NIST CSF and many other gold standard cybersecurity frameworks. If you have any questions about CIS, CIS Controls or the NIST CSF, give us a call at 1-800 NIST CSF or click here, to learn more.

You may also like

NIST vs. ISO –What You Need To Know
on June 24, 2022

Organizations are increasingly on the lookout for ways to strengthen their cybersecurity capabilities. Many have found solace in compliance frameworks that help guide and improve ...

Top 5 Recommendations For Your ...
on June 22, 2022

Discover, design, validate, promote, and sustain best practice cyber protection solutions to safeguard your people and processes. As the cyber attack surface expands, the Center ...

June Product Update
on June 21, 2022

It’s a celebration! 🎵♪🎵♪ ♩Automate your scores, come on (Let’s automate) Automate your scores, come on (Let’s automate) There’s a party goin’ on right here An automation to last ...

Why You Need CIS Controls for ...
on June 17, 2022

The Center for Internet Security (CIS) is a non-profit organization that helps public sectors and private sectors improve their cybersecurity. The organization aims to help small, ...

Small Business Cybersecurity ...
on June 15, 2022

To achieve peace of mind in the modern threat landscape, small business owners must have a solid security strategy and budget in place. VIPRE’s SMB Security Trends report state ...

Do Small Businesses and Startups ...
on June 10, 2022

Did you know that about 60% of small businesses shut down within 6 months by falling victim to a data breach or cyber-attack, where the average global breach cost hovers at $3.62 ...