Back to Compliances
okta

CIS Controls v8.1

cis_controls_8.1
CIS-Controlsv8.1
CIS-Controls framework logo
OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

9requirements18checks
Prowler logoProwlerprowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud
Run
prowler okta --compliance cis_controls_8.1

Requirements (9)

4. Secure Configuration of Enterprise Assets and Software14
4.3Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.4
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

5. Account Management39
5.2Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA.7
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.3Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.1
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.1
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6. Access Control Management24
6.3Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.2
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.5Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.2
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

8. Audit Log Management33
8.2Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.1
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

8.9Centralize, to the extent possible, audit log collection and retention across enterprise assets in accordance with the documented audit log management process. Example implementations primarily include leveraging a SIEM tool to centralize multiple log sources.1
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.12Collect service provider logs, where supported. Example implementations include collecting authentication and authorization events, data creation and disposal events, and user management events.1
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG3