CIS Controls v8.1

cis_controls_8.1

CIS-Controlsv8.1

OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

16requirements53checks

Prowler prowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler googleworkspace --compliance cis_controls_8.1

Requirements (16)

2. Inventory and Control of Software Assets13

2.5Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.3

Attributes

Section: Inventory and Control of Software Assets
Function: Protect
Asset Type: Software
Implementation Groups: IG2
IG3

3. Data Protection218

3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.17

Attributes

Section: Data Protection
Function: Protect
Asset Type: Data
Implementation Groups: IG1
IG2
IG3

3.13Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all sensitive data stored, processed, or transmitted through enterprise assets, including those located onsite or at a remote service provider, and update the enterprise's data inventory.1

Attributes

Section: Data Protection
Function: Protect
Asset Type: Data
Implementation Groups: IG3

4. Secure Configuration of Enterprise Assets and Software27

4.3Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.1

Attributes

Section: Secure Configuration of Enterprise Assets and Software
Function: Protect
Asset Type: Devices
Implementation Groups: IG1
IG2
IG3

4.8Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.6

Attributes

Section: Secure Configuration of Enterprise Assets and Software
Function: Protect
Asset Type: Devices
Implementation Groups: IG2
IG3

5. Account Management23

5.2Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA.1

Attributes

Section: Account Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.2

Attributes

Section: Account Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

6. Access Control Management23

6.3Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.2

Attributes

Section: Access Control Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

6.5Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.1

Attributes

Section: Access Control Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

8. Audit Log Management29

8.2Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.1

Attributes

Section: Audit Log Management
Function: Detect
Asset Type: Data
Implementation Groups: IG1
IG2
IG3

8.11Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.8

Attributes

Section: Audit Log Management
Function: Detect
Asset Type: Data
Implementation Groups: IG2
IG3

9. Email and Web Browser Protections410

9.3Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.2

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Network
Implementation Groups: IG2
IG3

9.5To lower the chance of spoofed or modified emails from valid domains, implement DMARC policy and verification, starting with implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM) standards.3

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Network
Implementation Groups: IG2
IG3

9.6Block unnecessary file types attempting to enter the enterprise's email gateway.2

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Network
Implementation Groups: IG2
IG3

9.7Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing.3

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Network
Implementation Groups: IG3

13. Network Monitoring and Defense18

13.1Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts. A log analytics platform configured with security-relevant correlation alerts also satisfies this Safeguard.8

Attributes

Section: Network Monitoring and Defense
Function: Detect
Asset Type: Network
Implementation Groups: IG2
IG3