CIS Controls v8.1

cis_controls_8.1

CIS-Controlsv8.1

OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

25requirements56checks

Prowler prowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler m365 --compliance cis_controls_8.1

Requirements (25)

2. Inventory and Control of Software Assets13

2.5Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.3

Attributes

Section: Inventory and Control of Software Assets
Function: Protect
Asset Type: Software
Implementation Groups: IG2
IG3

3. Data Protection213

3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.10

Attributes

Section: Data Protection
Function: Protect
Asset Type: Data
Implementation Groups: IG1
IG2
IG3

3.14Log sensitive data access, including modification and disposal.3

Attributes

Section: Data Protection
Function: Detect
Asset Type: Data
Implementation Groups: IG3

4. Secure Configuration of Enterprise Assets and Software36

4.3Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.3

Attributes

Section: Secure Configuration of Enterprise Assets and Software
Function: Protect
Asset Type: Devices
Implementation Groups: IG1
IG2
IG3

4.7Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.1

Attributes

Section: Secure Configuration of Enterprise Assets and Software
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

4.8Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.2

Attributes

Section: Secure Configuration of Enterprise Assets and Software
Function: Protect
Asset Type: Devices
Implementation Groups: IG2
IG3

5. Account Management14

5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.4

Attributes

Section: Account Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

6. Access Control Management515

6.3Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.3

Attributes

Section: Access Control Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

6.4Require MFA for remote network access.2

Attributes

Section: Access Control Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

6.5Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.3

Attributes

Section: Access Control Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

6.7Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.3

Attributes

Section: Access Control Management
Function: Protect
Asset Type: Users
Implementation Groups: IG2
IG3

6.8Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.4

Attributes

Section: Access Control Management
Function: Govern
Asset Type: Users
Implementation Groups: IG3

8. Audit Log Management58

8.2Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.4

Attributes

Section: Audit Log Management
Function: Detect
Asset Type: Data
Implementation Groups: IG1
IG2
IG3

8.5Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation.1

Attributes

Section: Audit Log Management
Function: Detect
Asset Type: Data
Implementation Groups: IG2
IG3

8.9Centralize, to the extent possible, audit log collection and retention across enterprise assets in accordance with the documented audit log management process. Example implementations primarily include leveraging a SIEM tool to centralize multiple log sources.1

Attributes

Section: Audit Log Management
Function: Detect
Asset Type: Data
Implementation Groups: IG2
IG3

8.10Retain audit logs across enterprise assets for a minimum of 90 days.1

Attributes

Section: Audit Log Management
Function: Protect
Asset Type: Data
Implementation Groups: IG2
IG3

8.12Collect service provider logs, where supported. Example implementations include collecting authentication and authorization events, data creation and disposal events, and user management events.1

Attributes

Section: Audit Log Management
Function: Detect
Asset Type: Data
Implementation Groups: IG3

9. Email and Web Browser Protections510

9.3Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.1

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Network
Implementation Groups: IG2
IG3

9.4Restrict, either through uninstalling or disabling, any unauthorized or unnecessary browser or email client plugins, extensions, and add-on applications.2

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Software
Implementation Groups: IG2
IG3

9.5To lower the chance of spoofed or modified emails from valid domains, implement DMARC policy and verification, starting with implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM) standards.2

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Network
Implementation Groups: IG2
IG3

9.6Block unnecessary file types attempting to enter the enterprise's email gateway.2

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Network
Implementation Groups: IG2
IG3

9.7Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing.3

Attributes

Section: Email and Web Browser Protections
Function: Protect
Asset Type: Network
Implementation Groups: IG3

10. Malware Defenses27

10.1Deploy and maintain anti-malware software on all enterprise assets.4

Attributes

Section: Malware Defenses
Function: Detect
Asset Type: Devices
Implementation Groups: IG1
IG2
IG3

10.7Use behavior-based anti-malware software.3

Attributes

Section: Malware Defenses
Function: Detect
Asset Type: Devices
Implementation Groups: IG2
IG3

13. Network Monitoring and Defense15

13.5Manage access control for assets remotely connecting to enterprise resources. Determine amount of access to enterprise resources based on: up-to-date anti-malware software installed, configuration compliance with the enterprise's secure configuration process, and ensuring the operating system and applications are up-to-date.5

Attributes

Section: Network Monitoring and Defense
Function: Protect
Asset Type: Devices
Implementation Groups: IG2
IG3