Back to Compliances
CIS Controls v8.1
cis_controls_8.1
CIS-Controlsv8.1
OfficialVerified
The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.
30requirements83checks
ProwlerRun this compliance with Prowler
Run in Prowler CloudRun
prowler gcp --compliance cis_controls_8.1Requirements (30)
1. Inventory and Control of Enterprise Assets11
1.1Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile), network devices, non-computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware address, machine name, enterprise asset owner, department for each asset, and whether the asset has been approved to connect to the network. For mobile end-user devices, MDM type tools can support this process, where appropriate. This inventory includes assets connected to the infrastructure physically, virtually, remotely, and those within cloud environments. Additionally, it includes assets that are regularly connected to the enterprise's network infrastructure, even if they are not under control of the enterprise. Review and update the inventory of all enterprise assets bi-annually, or more frequently.1
Attributes
- Section
- Inventory and Control of Enterprise Assets
- Function
Identify
- Asset Type
Devices
- Implementation Groups
IG1
IG2
IG3
3. Data Protection517
3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.8
Attributes
- Section
- Data Protection
- Function
Protect
- Asset Type
Data
- Implementation Groups
IG1
IG2
IG3
3.4Retain data according to the enterprise's documented data management process. Data retention must include both minimum and maximum timelines.2
Attributes
- Section
- Data Protection
- Function
Protect
- Asset Type
Data
- Implementation Groups
IG1
IG2
IG3
3.10Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).1
Attributes
- Section
- Data Protection
- Function
Protect
- Asset Type
Data
- Implementation Groups
IG2
IG3
3.11Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.5
Attributes
- Section
- Data Protection
- Function
Protect
- Asset Type
Data
- Implementation Groups
IG2
IG3
3.14Log sensitive data access, including modification and disposal.1
Attributes
- Section
- Data Protection
- Function
Detect
- Asset Type
Data
- Implementation Groups
IG3
4. Secure Configuration of Enterprise Assets and Software49
4.4Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.2
Attributes
- Section
- Secure Configuration of Enterprise Assets and Software
- Function
Protect
- Asset Type
Devices
- Implementation Groups
IG1
IG2
IG3
4.6Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.2
Attributes
- Section
- Secure Configuration of Enterprise Assets and Software
- Function
Protect
- Asset Type
Devices
- Implementation Groups
IG1
IG2
IG3
4.7Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.3
Attributes
- Section
- Secure Configuration of Enterprise Assets and Software
- Function
Protect
- Asset Type
Users
- Implementation Groups
IG1
IG2
IG3
4.8Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.2
Attributes
- Section
- Secure Configuration of Enterprise Assets and Software
- Function
Protect
- Asset Type
Devices
- Implementation Groups
IG2
IG3
5. Account Management23
5.3Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.2
Attributes
- Section
- Account Management
- Function
Protect
- Asset Type
Users
- Implementation Groups
IG1
IG2
IG3
5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.1
Attributes
- Section
- Account Management
- Function
Protect
- Asset Type
Users
- Implementation Groups
IG1
IG2
IG3
6. Access Control Management26
6.4Require MFA for remote network access.1
Attributes
- Section
- Access Control Management
- Function
Protect
- Asset Type
Users
- Implementation Groups
IG1
IG2
IG3
6.8Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.5
Attributes
- Section
- Access Control Management
- Function
Govern
- Asset Type
Users
- Implementation Groups
IG3
7. Continuous Vulnerability Management12
7.5Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans.2
Attributes
- Section
- Continuous Vulnerability Management
- Function
Identify
- Asset Type
Software
- Implementation Groups
IG2
IG3
8. Audit Log Management827
8.2Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.5
Attributes
- Section
- Audit Log Management
- Function
Detect
- Asset Type
Data
- Implementation Groups
IG1
IG2
IG3
8.5Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.8
Attributes
- Section
- Audit Log Management
- Function
Detect
- Asset Type
Data
- Implementation Groups
IG2
IG3
8.6Collect DNS query audit logs on enterprise assets, where appropriate and supported.1
Attributes
- Section
- Audit Log Management
- Function
Detect
- Asset Type
Data
- Implementation Groups
IG2
IG3
8.7Collect URL request audit logs on enterprise assets, where appropriate and supported.1
Attributes
- Section
- Audit Log Management
- Function
Detect
- Asset Type
Data
- Implementation Groups
IG2
IG3
8.9Centralize, to the extent possible, audit log collection and retention across enterprise assets in accordance with the documented audit log management process. Example implementations primarily include leveraging a SIEM tool to centralize multiple log sources.1
Attributes
- Section
- Audit Log Management
- Function
Detect
- Asset Type
Data
- Implementation Groups
IG2
IG3
8.10Retain audit logs across enterprise assets for a minimum of 90 days.1
Attributes
- Section
- Audit Log Management
- Function
Protect
- Asset Type
Data
- Implementation Groups
IG2
IG3
8.11Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.9
Attributes
- Section
- Audit Log Management
- Function
Detect
- Asset Type
Data
- Implementation Groups
IG2
IG3
8.12Collect service provider logs, where supported. Example implementations include collecting authentication and authorization events, data creation and disposal events, and user management events.1
Attributes
- Section
- Audit Log Management
- Function
Detect
- Asset Type
Data
- Implementation Groups
IG3
11. Data Recovery13
11.2Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data.3
Attributes
- Section
- Data Recovery
- Function
Recover
- Asset Type
Data
- Implementation Groups
IG1
IG2
IG3
12. Network Infrastructure Management211
12.2Design and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum. Example implementations may include documentation, policy, and design components.8
Attributes
- Section
- Network Infrastructure Management
- Function
Protect
- Asset Type
Network
- Implementation Groups
IG2
IG3
12.3Securely manage network infrastructure. Example implementations include version-controlled Infrastructure-as-Code (IaC), and the use of secure network protocols, such as SSH and HTTPS.3
Attributes
- Section
- Network Infrastructure Management
- Function
Protect
- Asset Type
Network
- Implementation Groups
IG2
IG3
13. Network Monitoring and Defense23
13.4Perform traffic filtering between network segments, where appropriate.2
Attributes
- Section
- Network Monitoring and Defense
- Function
Protect
- Asset Type
Network
- Implementation Groups
IG2
IG3
13.6Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.1
Attributes
- Section
- Network Monitoring and Defense
- Function
Detect
- Asset Type
Network
- Implementation Groups
IG2
IG3
16. Application Software Security18
16.7Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening.8
Attributes
- Section
- Application Software Security
- Function
Protect
- Asset Type
Software
- Implementation Groups
IG2
IG3
17. Incident Response Management11
17.2Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may include internal staff, service providers, law enforcement, cyber insurance providers, relevant government agencies, Information Sharing and Analysis Center (ISAC) partners, or other stakeholders. Verify contacts annually to ensure that information is up-to-date.1
Attributes
- Section
- Incident Response Management
- Function
Govern
- Asset Type
Documentation
- Implementation Groups
IG1
IG2
IG3