Back to Compliances
azure

CIS Controls v8.1

cis_controls_8.1
CIS-Controlsv8.1
CIS-Controls framework logo
OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

48requirements141checks
Prowler logoProwlerprowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud
Run
prowler azure --compliance cis_controls_8.1

Requirements (48)

3. Data Protection429
3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.8
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

3.10Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).10
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.11Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.8
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.14Log sensitive data access, including modification and disposal.3
Attributes
Section
  1. Data Protection
Function

Detect

Asset Type

Data

Implementation Groups

  • IG3

4. Secure Configuration of Enterprise Assets and Software514
4.1Establish and maintain a documented secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.1
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Govern

Asset Type

Documentation

Implementation Groups

  • IG1

  • IG2

  • IG3

4.4Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.3
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.6Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.4
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.7Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.4
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

4.8Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.2
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

5. Account Management39
5.3Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.1
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.4
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.6Centralize account management through a directory or identity service.4
Attributes
Section
  1. Account Management
Function

Govern

Asset Type

Users

Implementation Groups

  • IG2

  • IG3

6. Access Control Management521
6.3Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.3
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.4Require MFA for remote network access.3
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.5Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.4
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.7Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.4
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG2

  • IG3

6.8Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.7
Attributes
Section
  1. Access Control Management
Function

Govern

Asset Type

Users

Implementation Groups

  • IG3

7. Continuous Vulnerability Management514
7.3Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.2
Attributes
Section
  1. Continuous Vulnerability Management
Function

Protect

Asset Type

Software

Implementation Groups

  • IG1

  • IG2

  • IG3

7.4Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.4
Attributes
Section
  1. Continuous Vulnerability Management
Function

Protect

Asset Type

Software

Implementation Groups

  • IG1

  • IG2

  • IG3

7.5Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans.6
Attributes
Section
  1. Continuous Vulnerability Management
Function

Identify

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

7.6Perform automated vulnerability scans of externally-exposed enterprise assets. Perform scans on a monthly, or more frequent, basis.1
Attributes
Section
  1. Continuous Vulnerability Management
Function

Identify

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

7.7Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.1
Attributes
Section
  1. Continuous Vulnerability Management
Function

Respond

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

8. Audit Log Management733
8.2Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.11
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

8.5Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.4
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.7Collect URL request audit logs on enterprise assets, where appropriate and supported.1
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.9Centralize, to the extent possible, audit log collection and retention across enterprise assets in accordance with the documented audit log management process. Example implementations primarily include leveraging a SIEM tool to centralize multiple log sources.2
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.10Retain audit logs across enterprise assets for a minimum of 90 days.3
Attributes
Section
  1. Audit Log Management
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.11Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.11
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.12Collect service provider logs, where supported. Example implementations include collecting authentication and authorization events, data creation and disposal events, and user management events.1
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG3

10. Malware Defenses48
10.1Deploy and maintain anti-malware software on all enterprise assets.2
Attributes
Section
  1. Malware Defenses
Function

Detect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

10.5Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.1
Attributes
Section
  1. Malware Defenses
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

10.6Centrally manage anti-malware software.3
Attributes
Section
  1. Malware Defenses
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

10.7Use behavior-based anti-malware software.2
Attributes
Section
  1. Malware Defenses
Function

Detect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

11. Data Recovery311
11.2Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data.6
Attributes
Section
  1. Data Recovery
Function

Recover

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

11.3Protect recovery data with equivalent controls to the original data. Reference encryption or data separation, based on requirements.2
Attributes
Section
  1. Data Recovery
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

11.4Establish and maintain an isolated instance of recovery data. Example implementations include, version controlling backup destinations through offline, cloud, or off-site systems or services.3
Attributes
Section
  1. Data Recovery
Function

Recover

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

12. Network Infrastructure Management320
12.2Design and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum. Example implementations may include documentation, policy, and design components.12
Attributes
Section
  1. Network Infrastructure Management
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

12.6Adopt secure network management protocols (e.g., 802.1X) and secure communication protocols (e.g., Wi-Fi Protected Access 2 (WPA2) Enterprise or more secure alternatives).6
Attributes
Section
  1. Network Infrastructure Management
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

12.8Establish and maintain dedicated computing resources, either physically or logically separated, for all administrative tasks or tasks requiring administrative access. The computing resources should be segmented from the enterprise's primary network and not be allowed internet access.2
Attributes
Section
  1. Network Infrastructure Management
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG3

13. Network Monitoring and Defense719
13.1Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts. A log analytics platform configured with security-relevant correlation alerts also satisfies this Safeguard.5
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.2Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.2
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

13.3Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service.1
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.4Perform traffic filtering between network segments, where appropriate.5
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.6Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.3
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.7Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.2
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG3

13.8Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.1
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Network

Implementation Groups

  • IG3

16. Application Software Security27
16.7Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening.3
Attributes
Section
  1. Application Software Security
Function

Protect

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

16.11Leverage vetted modules or services for application security components, such as identity management, encryption, auditing, and logging. Using platform features in critical security functions will reduce developers' workload and minimize the likelihood of design or implementation errors. Modern operating systems provide effective mechanisms for identification, authentication, and authorization and make those mechanisms available to applications. Use only standardized, currently accepted, and extensively reviewed encryption algorithms. Operating systems also provide mechanisms to create and maintain secure audit logs.4
Attributes
Section
  1. Application Software Security
Function

Protect

Asset Type

Software

Implementation Groups

  • IG2

  • IG3