Back to Compliances
aws

CIS Controls v8.1

cis_controls_8.1
CIS-Controlsv8.1
CIS-Controls framework logo
OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

55requirements412checks
Prowler logoProwlerprowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud
Run
prowler aws --compliance cis_controls_8.1

Requirements (55)

1. Inventory and Control of Enterprise Assets12
1.1Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile), network devices, non-computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware address, machine name, enterprise asset owner, department for each asset, and whether the asset has been approved to connect to the network. For mobile end-user devices, MDM type tools can support this process, where appropriate. This inventory includes assets connected to the infrastructure physically, virtually, remotely, and those within cloud environments. Additionally, it includes assets that are regularly connected to the enterprise's network infrastructure, even if they are not under control of the enterprise. Review and update the inventory of all enterprise assets bi-annually, or more frequently.2
Attributes
Section
  1. Inventory and Control of Enterprise Assets
Function

Identify

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

2. Inventory and Control of Software Assets15
2.2Ensure that only currently supported software is designated as authorized in the software inventory for enterprise assets. If software is unsupported, yet necessary for the fulfillment of the enterprise's mission, document an exception detailing mitigating controls and residual risk acceptance. For any unsupported software without an exception documentation, designate as unauthorized. Review the software list to verify software support at least monthly, or more frequently.5
Attributes
Section
  1. Inventory and Control of Software Assets
Function

Identify

Asset Type

Software

Implementation Groups

  • IG1

  • IG2

  • IG3

3. Data Protection7112
3.2Establish and maintain a data inventory based on the enterprise's data management process. Inventory sensitive data, at a minimum. Review and update inventory annually, at a minimum, with a priority on sensitive data.2
Attributes
Section
  1. Data Protection
Function

Identify

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.32
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

3.4Retain data according to the enterprise's documented data management process. Data retention must include both minimum and maximum timelines.4
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

3.10Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).24
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.11Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.45
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.13Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all sensitive data stored, processed, or transmitted through enterprise assets, including those located onsite or at a remote service provider, and update the enterprise's data inventory.2
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG3

3.14Log sensitive data access, including modification and disposal.3
Attributes
Section
  1. Data Protection
Function

Detect

Asset Type

Data

Implementation Groups

  • IG3

4. Secure Configuration of Enterprise Assets and Software452
4.3Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.3
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.4Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.38
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.6Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.5
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.7Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.6
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5. Account Management420
5.2Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA.11
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.3Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.2
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.6
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.6Centralize account management through a directory or identity service.1
Attributes
Section
  1. Account Management
Function

Govern

Asset Type

Users

Implementation Groups

  • IG2

  • IG3

6. Access Control Management532
6.3Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.3
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.4Require MFA for remote network access.2
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.5Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.3
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.7Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.7
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG2

  • IG3

6.8Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.17
Attributes
Section
  1. Access Control Management
Function

Govern

Asset Type

Users

Implementation Groups

  • IG3

7. Continuous Vulnerability Management515
7.3Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.1
Attributes
Section
  1. Continuous Vulnerability Management
Function

Protect

Asset Type

Software

Implementation Groups

  • IG1

  • IG2

  • IG3

7.4Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.8
Attributes
Section
  1. Continuous Vulnerability Management
Function

Protect

Asset Type

Software

Implementation Groups

  • IG1

  • IG2

  • IG3

7.5Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans.4
Attributes
Section
  1. Continuous Vulnerability Management
Function

Identify

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

7.6Perform automated vulnerability scans of externally-exposed enterprise assets. Perform scans on a monthly, or more frequent, basis.1
Attributes
Section
  1. Continuous Vulnerability Management
Function

Identify

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

7.7Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.1
Attributes
Section
  1. Continuous Vulnerability Management
Function

Respond

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

8. Audit Log Management762
8.2Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.37
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

8.5Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.3
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.6Collect DNS query audit logs on enterprise assets, where appropriate and supported.1
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.9Centralize, to the extent possible, audit log collection and retention across enterprise assets in accordance with the documented audit log management process. Example implementations primarily include leveraging a SIEM tool to centralize multiple log sources.2
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.10Retain audit logs across enterprise assets for a minimum of 90 days.1
Attributes
Section
  1. Audit Log Management
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.11Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.16
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.12Collect service provider logs, where supported. Example implementations include collecting authentication and authorization events, data creation and disposal events, and user management events.2
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG3

9. Email and Web Browser Protections11
9.5To lower the chance of spoofed or modified emails from valid domains, implement DMARC policy and verification, starting with implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM) standards.1
Attributes
Section
  1. Email and Web Browser Protections
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

10. Malware Defenses311
10.1Deploy and maintain anti-malware software on all enterprise assets.1
Attributes
Section
  1. Malware Defenses
Function

Detect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

10.6Centrally manage anti-malware software.2
Attributes
Section
  1. Malware Defenses
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

10.7Use behavior-based anti-malware software.8
Attributes
Section
  1. Malware Defenses
Function

Detect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

11. Data Recovery332
11.2Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data.19
Attributes
Section
  1. Data Recovery
Function

Recover

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

11.3Protect recovery data with equivalent controls to the original data. Reference encryption or data separation, based on requirements.12
Attributes
Section
  1. Data Recovery
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

11.4Establish and maintain an isolated instance of recovery data. Example implementations include, version controlling backup destinations through offline, cloud, or off-site systems or services.1
Attributes
Section
  1. Data Recovery
Function

Recover

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

12. Network Infrastructure Management236
12.2Design and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum. Example implementations may include documentation, policy, and design components.35
Attributes
Section
  1. Network Infrastructure Management
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

12.7Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resources on end-user devices.1
Attributes
Section
  1. Network Infrastructure Management
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

13. Network Monitoring and Defense634
13.1Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts. A log analytics platform configured with security-relevant correlation alerts also satisfies this Safeguard.4
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.3Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service.3
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.4Perform traffic filtering between network segments, where appropriate.5
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.6Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.1
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.8Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.10
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Network

Implementation Groups

  • IG3

13.10Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.11
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Network

Implementation Groups

  • IG3

16. Application Software Security418
16.5Use up-to-date and trusted third-party software components. When possible, choose established and proven frameworks and libraries that provide adequate security. Acquire these components from trusted sources or evaluate the software for vulnerabilities before use.1
Attributes
Section
  1. Application Software Security
Function

Protect

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

16.10Apply secure design principles in application architectures. Secure design principles include the concept of least privilege and enforcing mediation to validate every operation that the user makes, promoting the concept of "never trust user input." Examples include ensuring that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats. Secure design also means minimizing the application infrastructure attack surface, such as turning off unprotected ports and services, removing unnecessary programs and files, and renaming or removing default accounts.13
Attributes
Section
  1. Application Software Security
Function

Protect

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

16.11Leverage vetted modules or services for application security components, such as identity management, encryption, auditing, and logging. Using platform features in critical security functions will reduce developers' workload and minimize the likelihood of design or implementation errors. Modern operating systems provide effective mechanisms for identification, authentication, and authorization and make those mechanisms available to applications. Use only standardized, currently accepted, and extensively reviewed encryption algorithms. Operating systems also provide mechanisms to create and maintain secure audit logs.2
Attributes
Section
  1. Application Software Security
Function

Protect

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

16.12Apply static and dynamic analysis tools within the application life cycle to verify that secure coding practices are being followed.2
Attributes
Section
  1. Application Software Security
Function

Protect

Asset Type

Software

Implementation Groups

  • IG3

17. Incident Response Management24
17.2Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may include internal staff, service providers, law enforcement, cyber insurance providers, relevant government agencies, Information Sharing and Analysis Center (ISAC) partners, or other stakeholders. Verify contacts annually to ensure that information is up-to-date.3
Attributes
Section
  1. Incident Response Management
Function

Govern

Asset Type

Documentation

Implementation Groups

  • IG1

  • IG2

  • IG3

17.4Establish and maintain a documented incident response process that addresses roles and responsibilities, compliance requirements, and a communication plan. Review annually, or when significant enterprise changes occur that could impact this Safeguard.1
Attributes
Section
  1. Incident Response Management
Function

Govern

Asset Type

Documentation

Implementation Groups

  • IG2

  • IG3