Back to Compliances
github

CIS Controls v8.1

cis_controls_8.1
CIS-Controlsv8.1
CIS-Controls framework logo
OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

11requirements20checks
Prowler logoProwlerprowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud
Run
prowler github --compliance cis_controls_8.1

Requirements (11)

3. Data Protection11
3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.1
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

6. Access Control Management46
6.3Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.1
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.4Require MFA for remote network access.1
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.5Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.1
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.8Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.3
Attributes
Section
  1. Access Control Management
Function

Govern

Asset Type

Users

Implementation Groups

  • IG3

7. Continuous Vulnerability Management11
7.5Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans.1
Attributes
Section
  1. Continuous Vulnerability Management
Function

Identify

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

16. Application Software Security517
16.1Establish and maintain a secure application development process. In the process, address such items as: secure application design standards, secure coding practices, developer training, vulnerability management, security of third-party code, and application security testing procedures. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.12
Attributes
Section
  1. Application Software Security
Function

Govern

Asset Type

Documentation

Implementation Groups

  • IG2

  • IG3

16.2Establish and maintain a process to accept and address reports of software vulnerabilities, including providing a means for external entities to report. The process is to include such items as: a vulnerability handling policy that identifies reporting process, responsible party for handling vulnerability reports, and a process for intake, assignment, remediation, and remediation testing. As part of the process, use a vulnerability tracking system that includes severity ratings and metrics for measuring timing for identification, analysis, and remediation of vulnerabilities. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. Third-party application developers need to consider this an externally-facing policy that helps to set expectations for outside stakeholders.1
Attributes
Section
  1. Application Software Security
Function

Govern

Asset Type

Documentation

Implementation Groups

  • IG2

  • IG3

16.4Establish and manage an updated inventory of third-party components used in development, often referred to as a "bill of materials," as well as components slated for future use. This inventory is to include any risks that each third-party component could pose. Evaluate the list at least monthly to identify any changes or updates to these components, and validate that the component is still supported.1
Attributes
Section
  1. Application Software Security
Function

Identify

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

16.5Use up-to-date and trusted third-party software components. When possible, choose established and proven frameworks and libraries that provide adequate security. Acquire these components from trusted sources or evaluate the software for vulnerabilities before use.1
Attributes
Section
  1. Application Software Security
Function

Protect

Asset Type

Software

Implementation Groups

  • IG2

  • IG3

16.12Apply static and dynamic analysis tools within the application life cycle to verify that secure coding practices are being followed.2
Attributes
Section
  1. Application Software Security
Function

Protect

Asset Type

Software

Implementation Groups

  • IG3