CIS Controls v8.1

cis_controls_8.1

CIS-Controlsv8.1

OfficialVerified

The CIS Critical Security Controls (CIS Controls) v8.1 are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are organized into 18 top-level Controls and mapped to three Implementation Groups (IG1, IG2, IG3). This is a cross-provider mapping of Prowler checks to the CIS Controls Safeguards that can be assessed automatically against cloud and platform configurations.

18requirements21checks

Prowler prowler-compliance-cis-controls

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler vercel --compliance cis_controls_8.1

Requirements (18)

3. Data Protection36

3.3Configure data access control lists based on a user's need to know. Apply data access control lists, also known as access permissions, to local and remote file systems, databases, and applications.4

Attributes

Section: Data Protection
Function: Protect
Asset Type: Data
Implementation Groups: IG1
IG2
IG3

3.10Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).1

Attributes

Section: Data Protection
Function: Protect
Asset Type: Data
Implementation Groups: IG2
IG3

3.11Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional encryption methods may include application-layer encryption, also known as client-side encryption, where access to the data storage device(s) does not permit access to the plain-text data.1

Attributes

Section: Data Protection
Function: Protect
Asset Type: Data
Implementation Groups: IG2
IG3

4. Secure Configuration of Enterprise Assets and Software25

4.4Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent.3

Attributes

Section: Secure Configuration of Enterprise Assets and Software
Function: Protect
Asset Type: Devices
Implementation Groups: IG1
IG2
IG3

4.8Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.2

Attributes

Section: Secure Configuration of Enterprise Assets and Software
Function: Protect
Asset Type: Devices
Implementation Groups: IG2
IG3

5. Account Management34

5.3Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.1

Attributes

Section: Account Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

5.4Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user's primary, non-privileged account.1

Attributes

Section: Account Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

5.6Centralize account management through a directory or identity service.2

Attributes

Section: Account Management
Function: Govern
Asset Type: Users
Implementation Groups: IG2
IG3

6. Access Control Management58

6.1Establish and follow a documented process, preferably automated, for granting access to enterprise assets upon new hire or role change of a user.1

Attributes

Section: Access Control Management
Function: Govern
Asset Type: Documentation
Implementation Groups: IG1
IG2
IG3

6.2Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails.1

Attributes

Section: Access Control Management
Function: Govern
Asset Type: Documentation
Implementation Groups: IG1
IG2
IG3

6.5Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a service provider.2

Attributes

Section: Access Control Management
Function: Protect
Asset Type: Users
Implementation Groups: IG1
IG2
IG3

6.7Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.3

Attributes

Section: Access Control Management
Function: Protect
Asset Type: Users
Implementation Groups: IG2
IG3

6.8Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.1

Attributes

Section: Access Control Management
Function: Govern
Asset Type: Users
Implementation Groups: IG3

13. Network Monitoring and Defense28

13.8Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.3

Attributes

Section: Network Monitoring and Defense
Function: Protect
Asset Type: Network
Implementation Groups: IG3

13.10Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.5

Attributes

Section: Network Monitoring and Defense
Function: Protect
Asset Type: Network
Implementation Groups: IG3

16. Application Software Security39

16.7Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening.3

Attributes

Section: Application Software Security
Function: Protect
Asset Type: Software
Implementation Groups: IG2
IG3

16.8Maintain separate environments for production and non-production systems.4

Attributes

Section: Application Software Security
Function: Protect
Asset Type: Network
Implementation Groups: IG2
IG3

16.11Leverage vetted modules or services for application security components, such as identity management, encryption, auditing, and logging. Using platform features in critical security functions will reduce developers' workload and minimize the likelihood of design or implementation errors. Modern operating systems provide effective mechanisms for identification, authentication, and authorization and make those mechanisms available to applications. Use only standardized, currently accepted, and extensively reviewed encryption algorithms. Operating systems also provide mechanisms to create and maintain secure audit logs.2

Attributes

Section: Application Software Security
Function: Protect
Asset Type: Software
Implementation Groups: IG2
IG3