Back to Compliances
oraclecloud

CIS Controls v8.1

cis_controls_8.1
CIS-Controlsv8.1
CIS-Controls framework logo
OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

22requirements44checks
Prowler logoProwlerprowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --compliance cis_controls_8.1

Requirements (22)

3. Data Protection410
3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.4
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

3.10Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).1
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.11Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.4
Attributes
Section
  1. Data Protection
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

3.14Log sensitive data access, including modification and disposal.1
Attributes
Section
  1. Data Protection
Function

Detect

Asset Type

Data

Implementation Groups

  • IG3

4. Secure Configuration of Enterprise Assets and Software48
4.4Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.5
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.6Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.1
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG1

  • IG2

  • IG3

4.7Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.1
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

4.8Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.1
Attributes
Section
  1. Secure Configuration of Enterprise Assets and Software
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

5. Account Management26
5.2Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using Multi-Factor Authentication (MFA) and a 14-character password for accounts not using MFA.2
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.4
Attributes
Section
  1. Account Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6. Access Control Management26
6.3Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.1
Attributes
Section
  1. Access Control Management
Function

Protect

Asset Type

Users

Implementation Groups

  • IG1

  • IG2

  • IG3

6.8Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.5
Attributes
Section
  1. Access Control Management
Function

Govern

Asset Type

Users

Implementation Groups

  • IG3

8. Audit Log Management315
8.2Collect audit logs. Ensure that logging, per the enterprise's audit log management process, has been enabled across enterprise assets.2
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

8.10Retain audit logs across enterprise assets for a minimum of 90 days.1
Attributes
Section
  1. Audit Log Management
Function

Protect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

8.11Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat. Conduct reviews on a weekly, or more frequent, basis.12
Attributes
Section
  1. Audit Log Management
Function

Detect

Asset Type

Data

Implementation Groups

  • IG2

  • IG3

10. Malware Defenses11
10.5Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.1
Attributes
Section
  1. Malware Defenses
Function

Protect

Asset Type

Devices

Implementation Groups

  • IG2

  • IG3

11. Data Recovery11
11.2Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the sensitivity of the data.1
Attributes
Section
  1. Data Recovery
Function

Recover

Asset Type

Data

Implementation Groups

  • IG1

  • IG2

  • IG3

12. Network Infrastructure Management14
12.2Design and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum. Example implementations may include documentation, policy, and design components.4
Attributes
Section
  1. Network Infrastructure Management
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13. Network Monitoring and Defense420
13.1Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts. A log analytics platform configured with security-relevant correlation alerts also satisfies this Safeguard.13
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.3Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service.1
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.4Perform traffic filtering between network segments, where appropriate.5
Attributes
Section
  1. Network Monitoring and Defense
Function

Protect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3

13.6Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.1
Attributes
Section
  1. Network Monitoring and Defense
Function

Detect

Asset Type

Network

Implementation Groups

  • IG2

  • IG3