Cloud Checklist~2.xlsx
XLSX spreadsheet 479 KB Posted
- Attached to
- CLIC's Software System
- Solicitation number
- 40DHHS-S3547
- Issued by
- Churchill County, Nevada
About this file
This is a Cloud Checklist and Cloud Services Assessment Worksheet developed by the Center for Internet Security (CIS) and modified for use by the State of Nevada through the Nevada Office of Information Security. The document serves as a comprehensive security compliance tool based on CIS Controls Version 7, designed to guide state agencies in evaluating and implementing cloud security best practices. Rather than requesting specific products or services, this resource provides a standardized framework for assessing cloud environments across four service models (IaaS, PaaS, SaaS, and FaaS) and five deployment models (on-premises private cloud, third-party hosted private cloud, community cloud, public cloud, and hybrid cloud). The assessment worksheet maps 20 primary CIS Controls and their corresponding sub-controls to specific cloud service responsibilities, identifying whether the cloud service provider (CSP) or the agency bears responsibility for implementation. Additionally, the document includes 11 supplemental Nevada-specific questions addressing data segregation, residency, physical security, intellectual property rights, and end-of-service data handling requirements.
The assessment tool does not involve pricing terms, set-asides, or incumbents, as it functions as a security evaluation framework rather than a procurement instrument. State agencies are instructed to download and customize the spreadsheet for their specific cloud services projects, filter controls based on information risk levels (Low, Medium, or High), and select appropriate cloud service types to determine applicable security requirements. The worksheet incorporates the shared security responsibility model inherent to cloud environments, emphasizing that agencies must understand service-level agreements and legal contracts with CSPs regarding liability, breach disclosure, incident response timeframes, and security obligations. The document is classified as Confidential under Nevada Revised Statutes 242.105 and is not subject to public disclosure or records requests. Organizations using this tool are required to maintain current guidance by referring to the official CIS Controls website and can integrate additional controls or columns as needed to align with specific regulatory, compliance, or operational requirements.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Quote Instructions (1).pdf | ||
| Quote Instructions (2).pdf | ||
| 40DHHS-S3547 - Clarification on Question 128.docx | DOCX document | |
| 40DHHS-S3547 - request-for-proposals - final~2.docx | DOCX document | |
| 55AGR-S3574 PIZZA -reference-questionnaire.docx | DOCX document | |
| 40DHHS-S3547 - Vendor-Information-Response.pdf | ||
| 55AGR-S3574 PIZZA -Vendor-Information-Response.pdf | ||
| 55AGR-S3574 PIZZA -Request for Samples.docx | DOCX document | |
| 55AGR-S3574 PIZZA Certification-regarding-lobbying.pdf | ||
| 55AGR-S3574- State Processing Agreement.doc | DOC document | |
| Insurance Schedule~7.docx | DOCX document | |
| 40DHHS-S3547 Questions and Answers - Final.docx | DOCX document | |
| 40DHHS-S3547 - reference-questionnaire .docx | DOCX document | |
| Quote Instructions (10).pdf | ||
| Cost Schedule~12.xlsx | XLSX spreadsheet | |
| 55AGR-S3574 Cost Schedule.xlsx | XLSX spreadsheet |
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Introduction
CIS Controls Cloud Companion Guide
Be sure to download our PDF with details around each CIS Control and Sub-Control
Introduction
The CIS Controls™ are a prioritized set of actions that collectively form a defense-in-depth set of best practifces that mitigate the most common attacks against systems and networks. The CIS Controls are developed by a community of IT experts who apply their first-hand experience as cyber defenders to create these globally accepted security best practices. The experts who develop the CIS Controls come from a wide range of sectors including, retail, manufacturing, healthcare, education, government, defense, and others. So, while the CIS Controls address the general practices that most organizations should take to secure their systems, some operational environments may present unique requirements not addressed by the CIS Controls.
We are at a fascinating point in the evolution of what we now call cyber defense. To help us understand the cyber threat, we have seen the emergence of threat information feeds, reports, tools, alert services, standards, and threat-sharing frameworks. To top it all off, we are surrounded by security requirements, risk management frameworks, compliance regimes, regulatory mandates, and so forth. There is no shortage of information available to security practitioners on what they should do to secure their infrastructure. But all of this technology, information, and oversight has become a veritable “Fog of More” – competing options, priorities, opinions, and claims that can paralyze or distract an enterprise from vital action. Business complexity is growing, dependencies are expanding, users are becoming more mobile, and the threats are evolving. New technology brings us great benefits, but it also means that our data and applications are distributed across multiple locations, many of which are not within our organization’s infrastructure.
Rather than chase every new exceptional threat and neglect the fundamentals, how can we get on track with a roadmap of fundamentals and guidance for measures and improve? How can we get on track with a roadmap of fundamentals, and guidance to measure and improve cloud security? Which CIS Controls and defensive steps are applicable and have the greatest value?
The CIS Controls started as a grassroots activity to cut through the "Fog of More" and focus on the most fundamental and valuable actions that every enterprise should take. This companion guide will break down and map the applicable Controls and their implementation for the cloud environment. As the CIS Controls continue to be refined and re-worked through the community, the call for this CIS Controls Guidance for the cloud was identified as one of the high priority companion documents to be developed.
| While many of the core security concerns of enterprise Information Technology (IT) systems are shared within cloud environments, the main challenge in applying best practices is tied to the fact that these systems typically operate software and hardware under different assumed security responsibilities. Ensuring and understanding that the service-level agreements (SLAs) and Legal Contracts with the Cloud Service Provider (CSP) highlight liability, service levels, breach disclosure, and incident response timeframes is an important piece of your cloud security. The shared security responsibility, as well as the specific cloud services and deployment models utilized, changes who handles the security requirements and whom the assumed security risk resides with. CSPs are constantly adding new functional services along with configuration and security tools to better manage them at a very rapid pace. As new tools become available, the cloud consumer should consider a hybrid approach using third-party tools along with CSP native security tools that best fit an organization's security and management needs. Company management processes should ensure there is overlap rather than gaps in coverage between native and third-party tools. |
| A cloud environment has four distinct service models that the application or service can fall under: |
| · IaaS (Infrastructure as a Service) is a cloud environment that computing resources such as virtual servers, storage, and networking hardware. The consumer utilizes their own software such as operating systems, middleware, and applications. The underlying cloud infrastructure is managed by the CSP. |
| · PaaS (Platform as a Service) is a cloud computing environment for development and management of a consumer’s applications. It includes the infrastructure hardware: virtual servers, storage, and networking while tying in the middleware and development tools to allow the consumer to deploy their applications. It is designed to support the complete application lifecycle while leaving the management of the underlying infrastructure to the CSP. |
| · SaaS (Software as a Service) is a cloud computing software solution that provides the consumer with access to a complete software product. The software application resides on a cloud environment and is accessed by the consumer through the web or an application program interface (API). The consumer can utilize the application to store and analyze data without having to worry about managing the infrastructure, service, or software, as that falls to the CSP. |
| · FaaS (Function as a Service) is a cloud computing service that allows the consumer to develop, manage, and run their application functionalities without having to manage and maintain any of the infrastructure that is required. The consumer can execute code in response to events that happen within the CSP or the application without having to build out or maintain a complex underlying infrastructure. |
| To complicate things even more, a cloud environment has multiple deployment models: |
| · Private cloud (on-prem) consists of all the computing resources being hosted and used exclusively by one consumer (organization) within its own offices and data centers. The consumer is responsible for the operational costs, hardware, software, and the resources required to build and maintain the infrastructure. This is best used for critical business operations and applications that require complete control and configurability. |
| · Private cloud (third-party hosted) is a private cloud that is hosted by an external third party provider. The third party provides an exclusive cloud environment for the consumer and manages the hardware. All costs associated with the maintenance is the responsibility of the consumer. |
| · Community cloud (shared) is a deployment solution where the computing resources and infrastructure are shared between several organizations. The resources can be managed internally or by a third party and they can be hosted on-prem or externally. The organizations share the cost and often have similar cloud security requirements and business objectives. |
| · Public cloud is an infrastructure and computing services hosted by a third party company defined as a CSP. It is available over the internet and the services are delivered through a self-service portal. The consumer is provided on-demand accessibility and scalability without the high overhead cost of maintaining the physical hardware and software. The CSP is responsible for the management and maintenance of the system while the consumer pays only for resources they use. |
| · Hybrid cloud is an environment that uses a combination of the three cloud deployment models, private cloud (on-prem), private cloud (third- party hosted), and public cloud with an orchestration service between the three deployment models. |
| These are the kinds of issues that led to and now drive the CIS Controls Cloud Companion Guide, https://www.cisecurity.org/resources/white-papers/?o=controls. |
How to Use This Document
In this document, we provide guidance on how to apply the security best practices found in CIS Controls Version 7 to any cloud environment from the consumer/customer perspective. For each top-level CIS Control, there is a brief discussion of how to interpret and apply the CIS Control in such environments, along with any unique considerations or differences from common IT environments.
The applicability of specific CIS Controls and CIS Sub-Controls is addressed, and additional steps needed in any cloud environment are explained, based on the individual service models. Throughout this document, we take into consideration the unique mission/business requirements found in cloud environments, as well as the unique risks (vulnerabilities, threats, consequences, and security responsibilities), which in turn drive the priority of the security requirements (e.g., availability, integrity, and confidentiality of process data).
| By walking through CIS Controls Version 7 with this companion guide, the reader should be able to tailor the CIS Controls in the context of a specific IT/OT cloud enterprise as an essential starting point for a security improvement assessment and roadmap. |
| Contact Information |
| CIS |
| 31 Tech Valley Drive |
| East Greenbush, NY 12061 |
| 518.266.3460 |
| controlsinfo@cisecurity.org |
&"Arial,Regular"Page &P of &N
&"Arial,Regular"&14S.5.06.01.1F Cloud Services Assessment Worksheet &"Arial,Regular"&14&A &"Arial,Regular"&14 10/20/2021
The Center for Internet Security, Inc.
(CIS) is a 501(c)(3) nonprofit organization whose mission is to identify, develop, validate, promote, and sustain best practices in cybersecurity; deliver world-class cybersecurity solutions to prevent and rapidly respond to cyber incidents;
and build and lead communities to enable an environment of trust in cyberspace.
For additional information, go to https://www.cisecurity.org/ https://www.cisecurity.org/resources/white-papers/?o=controls License for Use
| License for Use |
| This work is licensed under a Creative Commons Attribution-Non Commercial-No Derivatives 4.0 International Public License (the link can be found at https://creativecommons.org/licenses/by-nc-nd/4.0/legalcode |
To further clarify the Creative Commons license related to the CIS ControlsTM content, you are authorized to copy and redistribute the content as a framework for use by you, within your organization and outside of your organization for non-commercial purposes only, provided that (i) appropriate credit is given to CIS, and (ii) a link to the license is provided. Additionally, if you remix, transform or build upon the CIS Controls, you may not distribute the modified materials. Users of the CIS Controls framework are also required to refer to (http://www.cisecurity.org/controls/) when referring to the CIS Controls in order to ensure that users are employing the most up-to-date guidance. Commercial use of the CIS Controls is subject to the prior approval of CIS® (Center for Internet Security, Inc.).
This spreadsheet has been modified for use in the State of Nevada by the Nevada Office of Information Security. Permission was obtained from CIS for these modifications and use.
This spreadsheet and the responses provided are classified Confidential under NRS 242.105, and are not subject to disclosure or public records requests.
&"Arial,Regular"Page &P of &N
&"Arial,Regular"&14S.5.06.01.1F Cloud Services Assessment Worksheet &"Arial,Regular"&14&A &"Arial,Regular"&14 10/20/2021
Instructions for Use
State Agencies
Download a copy of the spreadsheet and rename it to the name of the agency cloud services project.
Filter the controls based on the risk level of the information being used in the cloud, including all lower risk levels. For example, a Medium risk project would include Medium and Low risk controls.
Select the type of cloud service being considered, and filter the controls to exclude the controls for which the agency is responsible. Optionally, hide the other cloud service columns.
Review the controls to ensure they not only are applicable to the project, but that they also reflect any other applicable regulatory requirements for cloud services. Agencies are free to add additional controls or columns as needed to work with this tool.
&"Arial,Regular"&14S.5.06.01.1F Cloud Services Assessment Worksheet &"Arial,Regular"&14&A &"Arial,Regular"&14 10/20/2021
Applicability Overview Applicability Overview for each Service Model
| Legend | |||||
| High | More than 60% of CIS Sub-Controls apply | ||||
| Low | Between 0% and 60% of the CIS Sub-Controls apply | ||||
| None | No CIS Sub-Controls apply | ||||
| Control | Control Title | IaaS | PaaS | SaaS | FaaS |
| 1 | Inventory and Control of Hardware Assets | High | High | Low | Low |
| 2 | Inventory and Control of Software Assets | High | High | Low | Low |
| 3 | Continuous Vulnerability Management | High | High | None | None |
| 4 | Controlled Use of Administrative Privileges | High | High | High | High |
| 5 | Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers | High | Low | Low | Low |
| 6 | Maintenance, Monitoring and Analysis of Audit Logs | High | High | High | High |
| 7 | High | High | Low | Low | |
| 8 | Malware Defenses | High | High | None | None |
| 9 | Limitation and Control of Network Ports, Protocols, and Services | High | High | High | Low |
| 10 | Data Recovery Capabilities | High | High | High | High |
| 11 | Secure Configuration for Network Devices, such as Firewalls, Routers and Switches | High | Low | None | None |
| 12 | Boundary Defense | High | Low | None | None |
| 13 | Data Protection | High | Low | Low | Low |
| 14 | Controlled Access Based on the Need to Know | High | Low | Low | Low |
| 15 | Wireless Access Control | None | None | None | None |
| 16 | Account Monitoring and Control | High | High | High | High |
| 17 | Implement a Security Awareness and Training Program | High | High | High | High |
| 18 | Application Software Security | High | High | High | Low |
| 19 | Incident Response and Management | High | High | High | High |
| 20 | Penetration Teses and Red Team Exercises | High | High | High | High |
&"Arial,Regular"S.5.06.01.1F Cloud Services Assessment Worksheet: &A &"Arial,Regular"10/20/2021
All CIS Controls & Sub-Controls
| 1 | Inventory and Control of Hardware Assets | |||||||||||||
| Actively manage (inventory, track, and correct) all hardware devices on the network so that only authorized devices are given | ||||||||||||||
| access, and unauthorized and unmanaged devices are found and prevented from gaining access. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 1 | 1.1 | Devices | Identify | Utilize an Active Discovery Tool | Utilize an active discovery tool to identify devices connected to the organization's network and update the hardware asset inventory. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 1 | 1.2 | Devices | Identify | Use a Passive Asset Discovery Tool | Utilize a passive discovery tool to identify devices connected to the organization's network and automatically update the organization's hardware asset inventory. | @ | High | Agency | Agency | CSP | CSP | |||
| 1 | 1.3 | Devices | Identify | Use DHCP Logging to Update Asset Inventory | Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address management tools to update the organization's hardware asset inventory. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 1 | 1.4 | Devices | Identify | Maintain Detailed Asset Inventory | Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or process information. This inventory shall include all hardware assets, whether connected to the organization's network or not. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 1 | 1.5 | Devices | Identify | Maintain Asset Inventory Information | Ensure that the hardware asset inventory records the network address, hardware address, machine name, data asset owner, and department for each asset and whether the hardware asset has been approved to connect to the network. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 1 | 1.6 | Devices | Respond | Address Unauthorized Assets | Ensure that unauthorized assets are either removed from the network, quarantined, or the inventory is updated in a timely manner. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 1 | 1.7 | Devices | Protect | Deploy Port Level Access Control | Utilize port level access control, following 802.1x standards, to control which devices can authenticate to the network. The authentication system shall be tied into the hardware asset inventory data to ensure only authorized devices can connect to the network. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 1 | 1.8 | Devices | Protect | Utilize Client Certificates to Authenticate Hardware Assets | Use client certificates to authenticate hardware assets connecting to the organization's trusted network. | @ | High | Agency | CSP | Agency | Agency | |||
| 2 | Inventory and Control of Software Assets | |||||||||||||
| Actively manage (inventory, track, and correct) all software on the network so that only authorized software is installed and can | ||||||||||||||
| execute, and that unauthorized and unmanaged software is found and prevented from installation or execution. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 2 | 2.1 | Applications | Identify | Maintain Inventory of Authorized Software | Maintain an up-to-date list of all authorized software that is required in the enterprise for any business purpose on any business system. | @ | @ | @ | Low | Agency | Agency | Agency | Agency | |
| 2 | 2.2 | Applications | Identify | Ensure Software is Supported by Vendor | Ensure that only software applications or operating systems currently supported and receiving vendor updates are added to the organization's authorized software inventory. Unsupported software should be tagged as unsupported in the inventory system. | @ | @ | @ | Low | Agency | Agency | Agency | CSP | |
| 2 | 2.3 | Applications | Identify | Utilize Software Inventory Tools | Utilize software inventory tools throughout the organization to automate the documentation of all software on business systems. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 2 | 2.4 | Applications | Identify | Track Software Inventory Information | The software inventory system should track the name, version, publisher, and install date for all software, including operating systems authorized by the organization. | @ | @ | Medium | Agency | Agency | Agency | CSP | ||
| 2 | 2.5 | Applications | Identify | Integrate Software and Hardware Asset Inventories | The software inventory system should be tied into the hardware asset inventory so all devices and associated software are tracked from a single location. | @ | High | Agency | Agency | CSP | CSP | |||
| 2 | 2.6 | Applications | Respond | Address unapproved software | Ensure that unauthorized software is either removed or the inventory is updated in a timely manner | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 2 | 2.7 | Applications | Protect | Utilize Application Whitelisting | Utilize application whitelisting technology on all assets to ensure that only authorized software executes and all unauthorized software is blocked from executing on assets. | @ | High | Agency | CSP | CSP | CSP | |||
| 2 | 2.8 | Applications | Protect | Implement Application Whitelisting of Libraries | The organization's application whitelisting software must ensure that only authorized software libraries (such as *.dll, *.ocx, *.so, etc.) are allowed to load into a system process. | @ | High | Agency | CSP | CSP | CSP | |||
| 2 | 2.9 | Applications | Protect | Implement Application Whitelisting of Scripts | The organization's application whitelisting software must ensure that only authorized, digitally signed scripts (such as *.ps1, *.py, macros, etc.) are allowed to run on a system. | @ | High | Agency | CSP | CSP | CSP | |||
| 2 | 2.10 | Applications | Protect | Physically or Logically Segregate High Risk Applications | Physically or logically segregated systems should be used to isolate and run software that is required for business operations but incurs higher risk for the organization. | @ | High | Agency | CSP | CSP | CSP | |||
| 3 | Continuous Vulnerability Management | |||||||||||||
| Continuously acquire, assess, and take action on new information in order to identify vulnerabilities, remediate, and minimize | ||||||||||||||
| the window of opportunity for attackers. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 3 | 3.1 | Applications | Detect | Run Automated Vulnerability Scanning Tools | Utilize an up-to-date Security Content Automation Protocol (SCAP) compliant vulnerability scanning tool to automatically scan all systems on the network on a weekly or more frequent basis to identify all potential vulnerabilities on the organization's systems. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 3 | 3.2 | Applications | Detect | Perform Authenticated Vulnerability Scanning | Perform authenticated vulnerability scanning with agents running locally on each system or with remote scanners that are configured with elevated rights on the system being tested. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 3 | 3.3 | Users | Protect | Protect Dedicated Assessment Accounts | Use a dedicated account for authenticated vulnerability scans, which should not be used for any other administrative activities and should be tied to specific machines at specific IP addresses. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 3 | 3.4 | Applications | Protect | Deploy Automated Operating System Patch Management Tools | Deploy automated software update tools in order to ensure that the operating systems are running the most recent security updates provided by the software vendor. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 3 | 3.5 | Applications | Protect | Deploy Automated Software Patch Management Tools | Deploy automated software update tools in order to ensure that third-party software on all systems is running the most recent security updates provided by the software vendor. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 3 | 3.6 | Applications | Respond | Compare Back-to-Back Vulnerability Scans | Regularly compare the results from consecutive vulnerability scans to verify that vulnerabilities have been remediated in a timely manner. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 3 | 3.7 | Applications | Respond | Utilize a Risk-Rating Process | Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 4 | Controlled Use of Administrative Privileges | |||||||||||||
| The processes and tools used to track/control/prevent/correct the use, assignment, and configuration of administrative | ||||||||||||||
| privileges on computers, networks, and applications. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 4 | 4.1 | Users | Detect | Maintain Inventory of Administrative Accounts | Use automated tools to inventory all administrative accounts, including domain and local accounts, to ensure that only authorized individuals have elevated privileges. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 4 | 4.2 | Users | Protect | Change Default Passwords | Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts. | @ | @ | @ | Low | Agency | Agency | Agency | Agency | |
| 4 | 4.3 | Users | Protect | Ensure the Use of Dedicated Administrative Accounts | Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities. | @ | @ | @ | Low | Agency | Agency | Agency | Agency | |
| 4 | 4.4 | Users | Protect | Use Unique Passwords | Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 4 | 4.5 | Users | Protect | Use Multi-Factor Authentication for All Administrative Access | Use multi-factor authentication and encrypted channels for all administrative account access. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 4 | 4.6 | Users | Protect | Use Dedicated Workstations For All Administrative Tasks | Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring administrative access. This machine will be segmented from the organization's primary network and not be allowed Internet access. This machine will not be used for reading e-mail, composing documents, or browsing the Internet. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 4 | 4.7 | Users | Protect | Limit Access to Script Tools | Limit access to scripting tools (such as Microsoft® PowerShell and Python) to only administrative or development users with the need to access those capabilities. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 4 | 4.8 | Users | Detect | Log and Alert on Changes to Administrative Group Membership | Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 4 | 4.9 | Users | Detect | Log and Alert on Unsuccessful Administrative Account Login | Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 5 | Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers | |||||||||||||
| Establish, implement, and actively manage (track, report on, correct) the security configuration of mobile devices, laptops, | ||||||||||||||
| servers, and workstations using a rigorous configuration management and change control process in order to prevent attackers | ||||||||||||||
| from exploiting vulnerable services and settings. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 5 | 5.1 | Applications | Protect | Establish Secure Configurations | Maintain documented security configuration standards for all authorized operating systems and software. | @ | @ | @ | Low | Agency | Agency | Agency | Agency | |
| 5 | 5.2 | Applications | Protect | Maintain Secure Images | Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 5 | 5.3 | Applications | Protect | Securely Store Master Images | Store the master images and templates on securely configured servers, validated with integrity monitoring tools, to ensure that only authorized changes to the images are possible. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 5 | 5.4 | Applications | Protect | Deploy System Configuration Management Tools | Deploy system configuration management tools that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 5 | 5.5 | Applications | Detect | Implement Automated Configuration Monitoring Systems | Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to verify all security configuration elements, catalog approved exceptions, and alert when unauthorized changes occur. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 6 | Maintenance, Monitoring and Analysis of Audit Logs | |||||||||||||
| Collect, manage, and analyze audit logs of events that could help detect, understand, or recover from an attack. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 6 | 6.1 | Network | Detect | Utilize Three Synchronized Time Sources | Use at least three synchronized time sources from which all servers and network devices retrieve time information on a regular basis so that timestamps in logs are consistent. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 6 | 6.2 | Network | Detect | Activate Audit Logging | Ensure that local logging has been enabled on all systems and networking devices. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 6 | 6.3 | Network | Detect | Enable Detailed Logging | Enable system logging to include detailed information such as a event source, date, user, timestamp, source addresses, destination addresses, and other useful elements. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 6 | 6.4 | Network | Detect | Ensure Adequate Storage for Logs | Ensure that all systems that store logs have adequate storage space for the logs generated. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 6 | 6.5 | Network | Detect | Central Log Management | Ensure that appropriate logs are being aggregated to a central log management system for analysis and review. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 6 | 6.6 | Network | Detect | Deploy SIEM or Log Analytic Tools | Deploy Security Information and Event Management (SIEM) or log analytic tool for log correlation and analysis. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 6 | 6.7 | Network | Detect | Regularly Review Logs | On a regular basis, review logs to identify anomalies or abnormal events. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 6 | 6.8 | Network | Detect | Regularly Tune SIEM | On a regular basis, tune your SIEM system to better identify actionable events and decrease event noise. | @ | High | Agency | Agency | Agency | Agency | |||
| 7 | Email and Web Browser Protections | |||||||||||||
| Minimize the attack surface and the opportunities for attackers to manipulate human behavior though their interaction with web | ||||||||||||||
| browsers and email systems. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 7 | 7.2 | Applications | Protect | Disable Unnecessary or Unauthorized Browser or Email Client Plugins | Uninstall or disable any unauthorized browser or email client plugins or add-on applications. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 7 | 7.3 | Applications | Protect | Limit Use of Scripting Languages in Web Browsers and Email Clients | Ensure that only authorized scripting languages are able to run in all web browsers and email clients. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 7 | 7.4 | Network | Protect | Maintain and Enforce Network-Based URL Filters | Enforce network-based URL filters that limit a system's ability to connect to websites not approved by the organization. This filtering shall be enforced for each of the organization's systems, whether they are physically at an organization's facilities or not. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 7 | 7.5 | Network | Protect | Subscribe to URL-Categorization Service | Subscribe to URL-categorization services to ensure that they are up-to-date with the most recent website category definitions available. Uncategorized sites shall be blocked by default. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 7 | 7.6 | Network | Detect | Log All URL requester | Log all URL requests from each of the organization's systems, whether on-site or a mobile device, in order to identify potentially malicious activity and assist incident handlers with identifying potentially compromised systems. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 7 | 7.7 | Network | Protect | Use of DNS Filtering Services | Use Domain Name System (DNS) filtering services to help block access to known malicious domains. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 7 | 7.8 | Network | Protect | Implement DMARC and Enable Receiver-Side Verification | To lower the chance of spoofed or modified emails from valid domains, implement Domain-based Message Authentication, Reporting and Conformance (DMARC) policy and verification, starting by implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail(DKIM) standards. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 7 | 7.9 | Network | Protect | Block Unnecessary File Types | Block all email attachments entering the organization's email gateway if the file types are unnecessary for the organization's business. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 7 | 7.10 | Network | Protect | Sandbox All Email Attachments | Use sandboxing to analyze and block inbound email attachments with malicious behavior. | @ | High | Agency | Agency | CSP | CSP | |||
| 8 | Malware Defenses | |||||||||||||
| Control the installation, spread, and execution of malicious code at multiple points in the enterprise, while optimizing the use of | ||||||||||||||
| automation to enable rapid updating of defense, data gathering, and corrective action. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 8 | 8.1 | Devices | Protect | Utilize Centrally Managed Anti-malware Software | Utilize centrally managed anti-malware software to continuously monitor and defend each of the organization's workstations and servers. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 8 | 8.2 | Devices | Protect | Ensure Anti-Malware Software and Signatures Are Updated | Ensure that the organization's anti-malware software updates its scanning engine and signature database on a regular basis. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 8 | 8.3 | Devices | Protect | Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit Technologies | Enable anti-exploitation features such as Data Execution Prevention (DEP) or Address Space Layout Randomization (ASLR) that are available in an operating system or deploy appropriate toolkits that can be configured to apply protection to a broader set of applications and executables. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 8 | 8.4 | Devices | Detect | Configure Anti-Malware Scanning of Removable Devices | Configure devices so that they automatically conduct an anti-malware scan of removable media when inserted or connected. | @ | @ | @ | Low | Agency | CSP | CSP | CSP | |
| 8 | 8.5 | Devices | Protect | Configure Devices to Not Auto-Run Content | Configure devices to not auto-run content from removable media. | @ | @ | @ | Low | Agency | CSP | CSP | CSP | |
| 8 | 8.6 | Devices | Detect | Centralize Anti-Malware Logging | Send all malware detection events to enterprise anti-malware administration tools and event log servers for analysis and alerting. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 8 | 8.7 | Network | Detect | Enable DNS Query Logging | Enable Domain Name System (DNS) query logging to detect hostname lookups for known malicious domains. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 8 | 8.8 | Devices | Detect | Enable Command-Line Audit Logging | Enable command-line audit logging for command shells, such as Microsoft PowerShell and Bash. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 9 | Limitation and Control of Network Ports, Protocols, and Services | |||||||||||||
| Manage (track/control/correct) the ongoing operational use of ports, protocols, and services on networked devices in order to | ||||||||||||||
| minimize windows of vulnerability available to attackers. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 9 | 9.1 | Devices | Identify | Associate Active Ports, Services, and Protocols to Asset Inventory | Associate active ports, services, and protocols to the hardware assets in the asset inventory. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 9 | 9.2 | Devices | Protect | Ensure Only Approved Ports, Protocols, and Services Are Running | Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 9 | 9.3 | Devices | Detect | Perform Regular Automated Port Scans | Perform automated port scans on a regular basis against all systems and alert if unauthorized ports are detected on a system. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 9 | 9.4 | Devices | Protect | Apply Host-Based Firewalls or Port-Filtering | Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 9 | 9.5 | Devices | Protect | Implement Application Firewalls | Place application firewalls in front of any critical servers to verify and validate the traffic going to the server. Any unauthorized traffic should be blocked and logged. | @ | High | Agency | Agency | Agency | CSP | |||
| 10 | Data Recovery Capabilities | |||||||||||||
| The processes and tools used to properly back up critical information with a proven methodology for timely recovery of it. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 10 | 10.2 | Data | Protect | Perform Complete System Backups | Ensure that all of the organization's key systems are backed up as a complete system, through processes such as imaging, to enable the quick recovery of an entire system. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 10 | 10.3 | Data | Protect | Test Data on Backup Media | Test data integrity on backup media on a regular basis by performing a data restoration process to ensure that the backup is properly working. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 10 | 10.4 | Data | Protect | Ensure Protection of Backups | Ensure that backups are properly protected via physical security or encryption when they are stored, as well as when they are moved across the network. This includes remote backups and cloud services. | @ | @ | @ | Low | Agency | Agency | Agency | Agency | |
| 10 | 10.5 | Data | Protect | Ensure All Backups Have at Least One Offline Backup Destination | Ensure that all backups have at least one offline (i.e., not accessible via a network connection) backup destination. | @ | @ | @ | Low | Agency | Agency | Agency | Agency | |
| 11 | Secure Configuration for Network Devices, such as Firewalls, Routers and Switches | |||||||||||||
| Establish, implement, and actively manage (track, report on, correct) the security configuration of network infrastructure devices | ||||||||||||||
| using a rigorous configuration management and change control process in order to prevent attackers from exploiting | ||||||||||||||
| vulnerable services and settings. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 11 | 11.2 | Network | Identify | Document Traffic Configuration Rules | All configuration rules that allow traffic to flow through network devices should be documented in a configuration management system with a specific business reason for each rule, a specific individual’s name responsible for that business need, and an expected duration of the need. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 11 | 11.3 | Network | Detect | Use Automated Tools to Verify Standard Device Configurations and Detect Changes | Compare all network device configuration against approved security configurations defined for each network device in use, and alert when any deviations are discovered. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 11 | 11.4 | Network | Protect | Install the Latest Stable Version of Any Security-Related Updates on All Network Devices | Install the latest stable version of any security-related updates on all network devices. | @ | @ | @ | Low | Agency | CSP | CSP | CSP | |
| 11 | 11.5 | Network | Protect | Manage Network Devices Using Multi-Factor Authentication and Encrypted Sessions | Manage all network devices using multi-factor authentication and encrypted sessions. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 11 | 11.6 | Network | Protect | Use Dedicated Machines For All Network Administrative Tasks | Ensure network engineers use a dedicated machine for all administrative tasks or tasks requiring elevated access. This machine shall be segmented from the organization's primary network and not be allowed Internet access. This machine shall not be used for reading email, composing documents, or surfing the Internet. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 11 | 11.7 | Network | Protect | Manage Network Infrastructure Through a Dedicated Network | Manage the network infrastructure across network connections that are separated from the business use of that network, relying on separate VLANs or, preferably, on entirely different physical connectivity for management sessions for network devices. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 12 | Boundary Defense | |||||||||||||
| Detect/prevent/correct the flow of information transferring networks of different trust levels with a focus on security-damaging | ||||||||||||||
| data. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 12 | 12.2 | Network | Detect | Scan for Unauthorized Connections Across Trusted Network Boundaries | Perform regular scans from outside each trusted network boundary to detect any unauthorized connections which are accessible across the boundary. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 12 | 12.3 | Network | Protect | Deny Communications With Known Malicious IP Addresses | Deny communications with known malicious or unused Internet IP addresses and limit access only to trusted and necessary IP address ranges at each of the organization's network boundaries,. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 12 | 12.4 | Network | Protect | Deny Communication Over Unauthorized Ports | Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only authorized protocols are allowed to cross the network boundary in or out of the network at each of the organization's network boundaries. | @ | @ | @ | Low | Agency | Agency | CSP | CSP | |
| 12 | 12.5 | Network | Detect | Configure Monitoring Systems to Record Network Packets | Configure monitoring systems to record network packets passing through the boundary at each of the organization's network boundaries. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 12 | 12.6 | Network | Detect | Deploy Network-Based IDS Sensors | Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 12 | 12.7 | Network | Protect | Deploy Network-Based Intrusion Prevention Systems | Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each of the organization's network boundaries. | @ | High | Agency | CSP | CSP | CSP | |||
| 12 | 12.8 | Network | Detect | Deploy NetFlow Collection on Networking Boundary Devices | Enable the collection of NetFlow and logging data on all network boundary devices. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 12 | 12.9 | Network | Detect | Deploy Application Layer Filtering Proxy Server | Ensure that all network traffic to or from the Internet passes through an authenticated application layer proxy that is configured to filter unauthorized connections. | @ | High | Agency | CSP | CSP | CSP | |||
| 12 | 12.10 | Network | Detect | Decrypt Network Traffic at Proxy | Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However, the organization may use whitelists of allowed sites that can be accessed through the proxy without decrypting the traffic. | @ | High | Agency | CSP | CSP | CSP | |||
| 12 | 12.11 | Users | Protect | Require All Remote Login to Use Multi-Factor Authentication | Require all remote login access to the organization's network to encrypt data in transit and use multi-factor authentication. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 12 | 12.12 | Devices | Protect | Manage All Devices Remotely Logging into Internal Network | Scan all enterprise devices remotely logging into the organization's network prior to accessing the network to ensure that each of the organization's security policies has been enforced in the same manner as local network devices. | @ | High | Agency | CSP | CSP | CSP | |||
| 13 | Data Protection | |||||||||||||
| The processes and tools used to prevent data exfiltration, mitigate the effects of exfiltrated data, and ensure the privacy and | ||||||||||||||
| integrity of sensitive information. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 13 | 13.2 | Data | Protect | Remove Sensitive Data or Systems Not Regularly Accessed by Organization | Remove sensitive data or systems not regularly accessed by the organization from the network. These systems shall only be used as stand-alone systems (disconnected from the network) by the business unit needing to occasionally use the system or completely virtualized and powered off until needed. | @ | @ | @ | Low | Agency | Agency | Agency | CSP | |
| 13 | 13.3 | Data | Detect | Monitor and Block Unauthorized Network Traffic | Deploy an automated tool on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals. | @ | High | Agency | Agency | CSP | CSP | |||
| 13 | 13.4 | Data | Protect | Only Allow Access to Authorized Cloud Storage or Email Providers | Only allow access to authorized cloud storage or email providers. | @ | @ | Medium | Agency | Agency | CSP | CSP | ||
| 13 | 13.5 | Data | Detect | Monitor and Detect Any Unauthorized Use of Encryption | Monitor all traffic leaving the organization and detect any unauthorized use of encryption. | @ | High | Agency | Agency | CSP | CSP | |||
| 13 | 13.6 | Data | Protect | Encrypt Mobile Device Data | Utilize approved cryptographic mechanisms to protect enterprise data stored on all mobile devices. | @ | @ | @ | Low | CSP | CSP | CSP | CSP | |
| 13 | 13.7 | Data | Protect | Manage USB Devices | If USB storage devices are required, enterprise software should be used that can configure systems to allow the use of specific devices. An inventory of such devices should be maintained. | @ | @ | Medium | CSP | CSP | CSP | CSP | ||
| 13 | 13.8 | Data | Protect | Manage System's External Removable Media's Read/Write Configurations | Configure systems not to write data to external removable media, if there is no business need for supporting such devices. | @ | High | Agency | CSP | CSP | CSP | |||
| 13 | 13.9 | Data | Protect | Encrypt Data on USB Storage Devices | If USB storage devices are required, all data stored on such devices must be encrypted while at rest. | @ | High | CSP | CSP | CSP | CSP | |||
| 14 | Controlled Access Based on the Need to Know | |||||||||||||
| The processes and tools used to track/control/prevent/correct secure access to critical assets (e.g., information, resources, | ||||||||||||||
| systems) according to the formal determination of which persons, computers, and applications have a need and right to access | ||||||||||||||
| these critical assets based on an approved classification. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 14 | 14.2 | Network | Protect | Enable Firewall Filtering Between VLANs | Enable firewall filtering between VLANs to ensure that only authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 14 | 14.3 | Network | Protect | Disable Workstation to Workstation Communication | Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally and compromise neighboring systems, through technologies such as Private VLANs or micro segmentation. | @ | @ | Medium | Agency | CSP | CSP | CSP | ||
| 14 | 14.4 | Data | Protect | Encrypt All Sensitive Information in Transit | Encrypt all sensitive information in transit. | @ | @ | Medium | Agency | Agency | Agency | Agency | ||
| 14 | 14.5 | Data | Detect | Utilize an Active Discovery Tool to Identify Sensitive Data | Utilize an active discovery tool to identify all sensitive information stored, processed, or transmitted by the organization's technology systems, including those located on-site or at a remote service provider, and update the organization's sensitive information inventory. | @ | High | Agency | CSP | CSP | CSP | |||
| 14 | 14.6 | Data | Protect | Protect Information Through Access Control Lists | Protect all information stored on systems with file system, network share, claims, application, or database specific access control lists. These controls will enforce the principle that only authorized individuals should have access to the information based on their need to access the information as a part of their responsibilities. | @ | @ | @ | Low | Agency | Agency | Agency | CSP | |
| 14 | 14.7 | Data | Protect | Enforce Access Control to Data Through Automated Tools | Use an automated tool, such as host-based Data Loss Prevention, to enforce access controls to data even when data is copied off a system. | @ | High | Agency | CSP | CSP | CSP | |||
| 14 | 14.8 | Data | Protect | Encrypt Sensitive Information at Rest | Encrypt all sensitive information at rest using a tool that requires a secondary authentication mechanism not integrated into the operating system, in order to access the information. | @ | High | Agency | Agency | CSP | CSP | |||
| 14 | 14.9 | Data | Detect | Enforce Detail Logging for Access or Changes to Sensitive Data | Enforce detailed audit logging for access to sensitive data or changes to sensitive data (utilizing tools such as File Integrity Monitoring or Security Information and Event Monitoring). | @ | High | Agency | Agency | CSP | CSP | |||
| 15 | Wireless Access Control | |||||||||||||
| The processes and tools used to track/control/prevent/correct the security use of wireless local area networks (WLANs), | ||||||||||||||
| access points, and wireless client systems. | ||||||||||||||
| CIS Control | CIS Sub-Control | Asset Type | Security Function | Title | Description | IG | ||||||||
| 1 | IG | |||||||||||||
| 2 | IG | |||||||||||||
| 3 | Risk | IaaS | PaaS | SaaS | FaaS | Vendor Response | Agency Notes | |||||||
| 15 | 15.2 | Network | Detect | Detect Wireless Access Points Connected to the Wired Network | Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access points connected to the wired network. | @ | @ | Medium | N/A | N/A | N/A | N/A | ||
| 15 | 15.3 | Network | Detect | Use a Wireless Intrusion Detection System | Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless access points connected to the network. | @ | @ | Medium | N/A | N/A | N/A | N/A | ||
| 15 | 15.4 | Devices | Protect | Disable Wireless Access on Devices if Not Required | Disable wireless access on devices that do not have a business purpose for wireless access. | @ | High | N/A | N/A | N/A | N/A | |||
| 15 | 15.5 | Devices | Protect | Limit Wireless Access on Client Devices | Configure wireless access on client machines that do have an essential wireless business purpose, to allow access only to authorized wireless networks and to restrict access to other wireless networks. | @ | High | N/A | N/A | N/A | N/A | |||
| 15 | 15.6 | Devices | Protect | Disable Peer-to-Peer Wireless Network Capabilities on Wireless Clients | Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients. | @ | @ | Medium | N/A | N/A | N/A | N/A | ||
| 15 | 15.7 | Network | Protect | Leverage the Advanced Encryption Standard (AES) to Encrypt Wireless Data | Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit. | @ | @ | @ | Low | N/A | N/A | N/A | N/A |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .