Back to Compliances
alibabacloud

CIS Controls v8.1

cis_controls_8.1
CIS-Controlsv8.1
CIS-Controls framework logo
OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

28requirements56checks
Prowler logoProwlerprowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --compliance cis_controls_8.1

Requirements (28)

3. Data Protection411
3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.3
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

3.10Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).2
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.11Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.4
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.14Log sensitive data access, including modification and disposal.2
Attributes
Section
  1. Data Protection
Function

Detect

Asset Type

Data

Implementation Groups

  • IG3

4. Secure Configuration of Enterprise Assets and Software46
4.4Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.2
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.6Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.2
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.7Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.1
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

4.8Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.1
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

5. Account Management38
5.2Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA.6
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.3Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.1
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.1
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6. Access Control Management35
6.3Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.1
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.5Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.1
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.8Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.3
Attributes
Section
  1. Access Control Management
Function

Govern

Asset Type

Users

Implementation Groups

  • IG3

7. Continuous Vulnerability Management22
7.3Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.1
Attributes
Section
  1. Continuous Vulnerability Management
Function

Protect

Asset Type

Software

Implementation Groups

  • IG1

  • IG2

  • IG3

7.5Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans.1
Attributes
Section
  1. Continuous Vulnerability Management
Function

Identify

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

8. Audit Log Management524
8.2Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.5
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

8.5Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.3
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.10Retain audit logs across enterprise assets for a minimum of 90 days.2
Attributes
Section
  1. Audit Log Management
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.11Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.13
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.12Collect service provider logs, where supported. Example implementations include collecting authentication and authorization events, data creation and disposal events, and user management events.1
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG3

10. Malware Defenses24
10.1Deploy and maintain anti-malware software on all enterprise assets.2
Attributes
Section
  1. Malware Defenses
Function

Detect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

10.6Centrally manage anti-malware software.2
Attributes
Section
  1. Malware Defenses
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

12. Network Infrastructure Management12
12.2Design and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum. Example implementations may include documentation, policy, and design components.2
Attributes
Section
  1. Network Infrastructure Management
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13. Network Monitoring and Defense418
13.1Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts. A log analytics platform configured with security-relevant correlation alerts also satisfies this Safeguard.14
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.2Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.2
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

13.4Perform traffic filtering between network segments, where appropriate.1
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.6Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.1
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3