Back to Compliances
openstack

CIS Controls v8.1

cis_controls_8.1
CIS-Controlsv8.1
CIS-Controls framework logo
OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

10requirements25checks
Prowler logoProwlerprowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud
Run
prowler openstack --compliance cis_controls_8.1

Requirements (10)

3. Data Protection311
3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.6
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

3.11Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.1
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.13Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all sensitive data stored, processed, or transmitted through enterprise assets, including those located onsite or at a remote service provider, and update the enterprise's data inventory.4
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG3

4. Secure Configuration of Enterprise Assets and Software311
4.1Establish and maintain a documented secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.5
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Govern

Asset Type

Documentation

Implementation Groups

  • IG1

  • IG2

  • IG3

4.4Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.5
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.6Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.1
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

10. Malware Defenses11
10.5Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.1
Attributes
Section
  1. Malware Defenses
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

11. Data Recovery12
11.2Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data.2
Attributes
Section
  1. Data Recovery
Function

Recover

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

12. Network Infrastructure Management11
12.2Design and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum. Example implementations may include documentation, policy, and design components.1
Attributes
Section
  1. Network Infrastructure Management
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13. Network Monitoring and Defense13
13.4Perform traffic filtering between network segments, where appropriate.3
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3