CIS CIS Security

Asset Type Title Description IG1 IG2 IG3

Control Safeguard Function

Actively manage (inventory, track, and correct) all enterprise assets (end-user devices, including
portable and mobile; network devices; non-computing/Internet of Things (IoT) devices; and servers)
Inventory and Control of
1 connected to the infrastructure physically, virtually, remotely, and those within cloud environments, to
Enterprise Assets
accurately know the totality of assets that need to be monitored and protected within the enterprise. This
will also support identifying unauthorized and unmanaged assets to remove or remediate.

Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to
store or process data, to include: end-user devices (including portable and mobile), network devices, non-
computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware
address, machine name, enterprise asset owner, department for each asset, and whether the asset has been
Establish and Maintain Detailed
1 1,1 Devices Identify approved to connect to the network. For mobile end-user devices, MDM type tools can support this process, x x x
Enterprise Asset Inventory
where appropriate. This inventory includes assets connected to the infrastructure physically, virtually, remotely,
and those within cloud environments. Additionally, it includes assets that are regularly connected to the
enterprise’s network infrastructure, even if they are not under control of the enterprise. Review and update the
inventory of all enterprise assets bi-annually, or more frequently.
Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to
1 1,2 Devices Respond Address Unauthorized Assets remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the x x x
asset.
Utilize an active discovery tool to identify assets connected to the enterprise’s network. Configure the active
1 1,3 Devices Detect Utilize an Active Discovery Tool x x
discovery tool to execute daily, or more frequently.
Use Dynamic Host Configuration Use DHCP logging on all DHCP servers or Internet Protocol (IP) address management tools to update the
1 1,4 Devices Identify Protocol (DHCP) Logging to Update enterprise’s asset inventory. Review and use logs to update the enterprise’s asset inventory weekly, or more x x
Enterprise Asset Inventory frequently.
Use a passive discovery tool to identify assets connected to the enterprise’s network. Review and use scans to
1 1,5 Devices Detect Use a Passive Asset Discovery Tool x
update the enterprise’s asset inventory at least weekly, or more frequently.
Actively manage (inventory, track, and correct) all software (operating systems and applications) on the
Inventory and Control of Software
2 network so that only authorized software is installed and can execute, and that unauthorized and
Assets
unmanaged software is found and prevented from installation or execution.

Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The software
Establish and Maintain a Software inventory must document the title, publisher, initial install/use date, and business purpose for each entry; where
2 2,1 Applications Identify x x x
Inventory appropriate, include the Uniform Resource Locator (URL), app store(s), version(s), deployment mechanism, and
decommission date. Review and update the software inventory bi-annually, or more frequently.
Ensure that only currently supported software is designated as authorized in the software inventory for enterprise
assets. If software is unsupported, yet necessary for the fulfillment of the enterprise’s mission, document an
Ensure Authorized Software is
2 2,2 Applications Identify exception detailing mitigating controls and residual risk acceptance. For any unsupported software without an x x x
Currently Supported
exception documentation, designate as unauthorized. Review the software list to verify software support at least
monthly, or more frequently.
Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented
2 2,3 Applications Respond Address Unauthorized Software x x x
exception. Review monthly, or more frequently.
Utilize Automated Software Utilize software inventory tools, when possible, throughout the enterprise to automate the discovery and
2 2,4 Applications Detect x x
Inventory Tools documentation of installed software.
Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be
2 2,5 Applications Protect Allowlist Authorized Software x x
accessed. Reassess bi-annually, or more frequently.
Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files,
2 2,6 Applications Protect Allowlist Authorized Libraries are allowed to load into a system process. Block unauthorized libraries from loading into a system process. x x
Reassess bi-annually, or more frequently.
Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such
2 2,7 Applications Protect Allowlist Authorized Scripts as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi- x
annually, or more frequently.
Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of
3 Data Protection
data.
Establish and maintain a data management process. In the process, address data sensitivity, data owner, handling
Establish and Maintain a Data of data, data retention limits, and disposal requirements, based on sensitivity and retention standards for the
3 3,1 Data Identify x x x
Management Process enterprise. Review and update documentation annually, or when significant enterprise changes occur that could
impact this Safeguard.
Establish and Maintain a Data Establish and maintain a data inventory, based on the enterprise’s data management process. Inventory sensitive
3 3,2 Data Identify x x x
Inventory data, at a minimum. Review and update inventory annually, at a minimum, with a priority on sensitive data.
Configure data access control lists based on a user’s need to know. Apply data access control lists, also known as
3 3,3 Data Protect Configure Data Access Control Lists x x x
access permissions, to local and remote file systems, databases, and applications.
Retain data according to the enterprise’s data management process. Data retention must include both minimum
3 3,4 Data Protect Enforce Data Retention x x x
and maximum timelines.
Securely dispose of data as outlined in the enterprise’s data management process. Ensure the disposal process
3 3,5 Data Protect Securely Dispose of Data x x x
and method are commensurate with the data sensitivity.
Encrypt data on end-user devices containing sensitive data. Example implementations can include: Windows
3 3,6 Devices Protect Encrypt Data on End-User Devices ® ® ® x x x
BitLocker , Apple FileVault , Linux dm-crypt.
Establish and maintain an overall data classification scheme for the enterprise. Enterprises may use labels, such
Establish and Maintain a Data
3 3,7 Data Identify as “Sensitive,” “Confidential,” and “Public,” and classify their data according to those labels. Review and update x x
Classification Scheme
the classification scheme annually, or when significant enterprise changes occur that could impact this Safeguard.
Document data flows. Data flow documentation includes service provider data flows and should be based on the
3 3,8 Data Identify Document Data Flows enterprise’s data management process. Review and update documentation annually, or when significant x x
enterprise changes occur that could impact this Safeguard.
3 3,9 Data Protect Encrypt Data on Removable Media Encrypt data on removable media. x x

Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open
3 3,10 Data Protect Encrypt Sensitive Data in Transit x x
Secure Shell (OpenSSH).

Encrypt sensitive data at rest on servers, applications, and databases containing sensitive data. Storage-layer
3 3,11 Data Protect Encrypt Sensitive Data at Rest encryption, also known as server-side encryption, meets the minimum requirement of this Safeguard. Additional x x
encryption methods may include application-layer encryption, also known as client-side encryption, where access
to the data storage device(s) does not permit access to the plain-text data.
Segment Data Processing and Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on
3 3,12 Network Protect x x
Storage Based on Sensitivity enterprise assets intended for lower sensitivity data.
Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool to identify all sensitive data
Deploy a Data Loss Prevention
3 3,13 Data Protect stored, processed, or transmitted through enterprise assets, including those located onsite or at a remote service x
Solution
provider, and update the enterprise's sensitive data inventory.
3 3,14 Data Detect Log Sensitive Data Access Log sensitive data access, including modification and disposal. x
Establish and maintain the secure configuration of enterprise assets (end-user devices, including
Secure Configuration of
4 portable and mobile; network devices; non-computing/IoT devices; and servers) and software (operating
Enterprise Assets and Software
systems and applications).
Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable
Establish and Maintain a Secure and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review
4 4,1 Applications Protect x x x
Configuration Process and update documentation annually, or when significant enterprise changes occur that could impact this
Safeguard.
Establish and Maintain a Secure
Establish and maintain a secure configuration process for network devices. Review and update documentation
4 4,2 Network Protect Configuration Process for Network x x x
annually, or when significant enterprise changes occur that could impact this Safeguard.
Infrastructure
Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose
Configure Automatic Session
4 4,3 Users Protect operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not x x x
Locking on Enterprise Assets
exceed 2 minutes.
Implement and Manage a Firewall Implement and manage a firewall on servers, where supported. Example implementations include a virtual
4 4,4 Devices Protect x x x
on Servers firewall, operating system firewall, or a third-party firewall agent.
Implement and Manage a Firewall Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule
4 4,5 Devices Protect x x x
on End-User Devices that drops all traffic except those services and ports that are explicitly allowed.

Securely manage enterprise assets and software. Example implementations include managing configuration
Securely Manage Enterprise Assets
4 4,6 Network Protect through version-controlled-infrastructure-as-code and accessing administrative interfaces over secure network x x x
and Software
protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure
management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.
 Manage Default Accounts on Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured
4 4,7 Users Protect x x x
Enterprise Assets and Software vendor accounts. Example implementations can include: disabling default accounts or making them unusable.
Uninstall or Disable Unnecessary
Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing
4 4,8 Devices Protect Services on Enterprise Assets and x x
service, web application module, or service function.
Software
Configure Trusted DNS Servers on Configure trusted DNS servers on enterprise assets. Example implementations include: configuring assets to use
4 4,9 Devices Protect x x
Enterprise Assets enterprise-controlled DNS servers and/or reputable externally accessible DNS servers.
Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on
Enforce Automatic Device Lockout portable end-user devices, where supported. For laptops, do not allow more than 20 failed authentication
4 4,10 Devices Respond x x
on Portable End-User Devices attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations
include Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts.
Enforce Remote Wipe Capability on Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate such
4 4,11 Devices Protect x x
Portable End-User Devices as lost or stolen devices, or when an individual no longer supports the enterprise.
Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example
Separate Enterprise Workspaces on
4 4,12 Devices Protect implementations include using an Apple® Configuration Profile or Android™ Work Profile to separate enterprise x
Mobile End-User Devices
applications and data from personal applications and data.
Use processes and tools to assign and manage authorization to credentials for user accounts, including
5 Account Management
administrator accounts, as well as service accounts, to enterprise assets and software.
Establish and maintain an inventory of all accounts managed in the enterprise. The inventory must include both
Establish and Maintain an Inventory user and administrator accounts. The inventory, at a minimum, should contain the person’s name, username,
5 5,1 Users Identify x x x
of Accounts start/stop dates, and department. Validate that all active accounts are authorized, on a recurring schedule at a
minimum quarterly, or more frequently.
Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-
5 5,2 Users Protect Use Unique Passwords x x x
character password for accounts using MFA and a 14-character password for accounts not using MFA.
5 5,3 Users Respond Disable Dormant Accounts Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported. x x x
Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general
Restrict Administrator Privileges to
5 5,4 Users Protect computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non- x x x
Dedicated Administrator Accounts
privileged account.
Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department
Establish and Maintain an Inventory
5 5,5 Users Identify owner, review date, and purpose. Perform service account reviews to validate that all active accounts are x x
of Service Accounts
authorized, on a recurring schedule at a minimum quarterly, or more frequently.
5 5,6 Users Protect Centralize Account Management Centralize account management through a directory or identity service. x x
Use processes and tools to create, assign, manage, and revoke access credentials and privileges for
6 Access Control Management
user, administrator, and service accounts for enterprise assets and software.
Establish an Access Granting Establish and follow a process, preferably automated, for granting access to enterprise assets upon new hire,
6 6,1 Users Protect x x x
Process rights grant, or role change of a user.
Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling
Establish an Access Revoking
6 6,2 Users Protect accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts, instead of x x x
Process
deleting accounts, may be necessary to preserve audit trails.
Require MFA for Externally-Exposed Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing
6 6,3 Users Protect x x x
Applications MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.
Require MFA for Remote Network
6 6,4 Users Protect Require MFA for remote network access. x x x
Access
Require MFA for Administrative Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed
6 6,5 Users Protect x x x
Access on-site or through a third-party provider.
Establish and Maintain an Inventory Establish and maintain an inventory of the enterprise’s authentication and authorization systems, including those
6 6,6 Users Identify of Authentication and Authorization hosted on-site or at a remote service provider. Review and update the inventory, at a minimum, annually, or more x x
Systems frequently.
6 6,7 Users Protect Centralize Access Control Centralize access control for all enterprise assets through a directory service or SSO provider, where supported. x x

Define and maintain role-based access control, through determining and documenting the access rights necessary
Define and Maintain Role-Based for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of
6 6,8 Data Protect x
Access Control enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or
more frequently.
Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the
Continuous Vulnerability
7 enterprise’s infrastructure, in order to remediate, and minimize, the window of opportunity for attackers.
Management
Monitor public and private industry sources for new threat and vulnerability information.

Establish and Maintain a Establish and maintain a documented vulnerability management process for enterprise assets. Review and update
7 7,1 Applications Protect x x x
Vulnerability Management Process documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
Establish and Maintain a Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or
7 7,2 Applications Respond x x x
Remediation Process more frequent, reviews.
Perform Automated Operating Perform operating system updates on enterprise assets through automated patch management on a monthly, or
7 7,3 Applications Protect x x x
System Patch Management more frequent, basis.
Perform Automated Application Perform application updates on enterprise assets through automated patch management on a monthly, or more
7 7,4 Applications Protect x x x
Patch Management frequent, basis.
Perform Automated Vulnerability Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis.
7 7,5 Applications Identify x x
Scans of Internal Enterprise Assets Conduct both authenticated and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.
Perform Automated Vulnerability
Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant
7 7,6 Applications Identify Scans of Externally-Exposed x x
vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.
Enterprise Assets
Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent,
7 7,7 Applications Respond Remediate Detected Vulnerabilities x x
basis, based on the remediation process.
Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from
8 Audit Log Management
an attack.
Establish and maintain an audit log management process that defines the enterprise’s logging requirements. At a
Establish and Maintain an Audit Log
8 8,1 Network Protect minimum, address the collection, review, and retention of audit logs for enterprise assets. Review and update x x x
Management Process
documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
Collect audit logs. Ensure that logging, per the enterprise’s audit log management process, has been enabled
8 8,2 Network Detect Collect Audit Logs x x x
across enterprise assets.
Ensure that logging destinations maintain adequate storage to comply with the enterprise’s audit log management
8 8,3 Network Protect Ensure Adequate Audit Log Storage x x x
process.
Standardize time synchronization. Configure at least two synchronized time sources across enterprise assets,
8 8,4 Network Protect Standardize Time Synchronization x x
where supported.
Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date,
8 8,5 Network Detect Collect Detailed Audit Logs username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a x x
forensic investigation.
8 8,6 Network Detect Collect DNS Query Audit Logs Collect DNS query audit logs on enterprise assets, where appropriate and supported. x x
8 8,7 Network Detect Collect URL Request Audit Logs Collect URL request audit logs on enterprise assets, where appropriate and supported. x x
®
Collect command-line audit logs. Example implementations include collecting audit logs from PowerShell ,
8 8,8 Devices Detect Collect Command-Line Audit Logs ™
x x
BASH , and remote administrative terminals.
8 8,9 Network Detect Centralize Audit Logs Centralize, to the extent possible, audit log collection and retention across enterprise assets. x x
8 8,10 Network Protect Retain Audit Logs Retain audit logs across enterprise assets for a minimum of 90 days. x x
Conduct reviews of audit logs to detect anomalies or abnormal events that could indicate a potential threat.
8 8,11 Network Detect Conduct Audit Log Reviews x x
Conduct reviews on a weekly, or more frequent, basis.
Collect service provider logs, where supported. Example implementations include collecting authentication and
8 8,12 Data Detect Collect Service Provider Logs x
authorization events, data creation and disposal events, and user management events.
Email and Web Browser Improve protections and detections of threats from email and web vectors, as these are opportunities for
9
Protections attackers to manipulate human behavior through direct engagement.
Ensure Use of Only Fully Supported Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the
9 9,1 Applications Protect x x x
Browsers and Email Clients latest version of browsers and email clients provided through the vendor.
9 9,2 Network Protect Use DNS Filtering Services Use DNS filtering services on all enterprise assets to block access to known malicious domains. x x x
Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious
Maintain and Enforce Network-
9 9,3 Network Protect or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or x x
Based URL Filters
through the use of block lists. Enforce filters for all enterprise assets.
 Restrict Unnecessary or
Restrict, either through uninstalling or disabling, any unauthorized or unnecessary browser or email client plugins,
9 9,4 Applications Protect Unauthorized Browser and Email x x
extensions, and add-on applications.
Client Extensions
To lower the chance of spoofed or modified emails from valid domains, implement DMARC policy and verification,
9 9,5 Network Protect Implement DMARC starting with implementing the Sender Policy Framework (SPF) and the DomainKeys Identified Mail (DKIM) x x
standards.
9 9,6 Network Protect Block Unnecessary File Types Block unnecessary file types attempting to enter the enterprise’s email gateway. x x
Deploy and Maintain Email Server
9 9,7 Network Protect Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing. x
Anti-Malware Protections
Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on
10 Malware Defenses
enterprise assets.
Deploy and Maintain Anti-Malware
10 10,1 Devices Protect Deploy and maintain anti-malware software on all enterprise assets. x x x
Software
Configure Automatic Anti-Malware
10 10,2 Devices Protect Configure automatic updates for anti-malware signature files on all enterprise assets. x x x
Signature Updates
Disable Autorun and Autoplay for
10 10,3 Devices Protect Disable autorun and autoplay auto-execute functionality for removable media. x x x
Removable Media
Configure Automatic Anti-Malware
10 10,4 Devices Detect Configure anti-malware software to automatically scan removable media. x x
Scanning of Removable Media
Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data
10 10,5 Devices Protect Enable Anti-Exploitation Features Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection x x
(SIP) and Gatekeeper™.
Centrally Manage Anti-Malware
10 10,6 Devices Protect Centrally manage anti-malware software. x x
Software
Use Behavior-Based Anti-Malware
10 10,7 Devices Detect Use behavior-based anti-malware software. x x
Software
Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-
11 Data Recovery
incident and trusted state.
Establish and maintain a data recovery process. In the process, address the scope of data recovery activities,
Establish and Maintain a Data
11 11,1 Data Recover recovery prioritization, and the security of backup data. Review and update documentation annually, or when x x x
Recovery Process
significant enterprise changes occur that could impact this Safeguard.
Perform automated backups of in-scope enterprise assets. Run backups weekly, or more frequently, based on the
11 11,2 Data Recover Perform Automated Backups x x x
sensitivity of the data.
Protect recovery data with equivalent controls to the original data. Reference encryption or data separation, based
11 11,3 Data Protect Protect Recovery Data x x x
on requirements.
Establish and Maintain an Isolated Establish and maintain an isolated instance of recovery data. Example implementations include, version controlling
11 11,4 Data Recover x x x
Instance of Recovery Data backup destinations through offline, cloud, or off-site systems or services.
11 11,5 Data Recover Test Data Recovery Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets. x x
Network Infrastructure Establish, implement, and actively manage (track, report, correct) network devices, in order to prevent
12
Management attackers from exploiting vulnerable network services and access points.
Ensure network infrastructure is kept up-to-date. Example implementations include running the latest stable
Ensure Network Infrastructure is Up-
12 12,1 Network Protect release of software and/or using currently supported network-as-a-service (NaaS) offerings. Review software x x x
to-Date
versions monthly, or more frequently, to verify software support.
Establish and Maintain a Secure Establish and maintain a secure network architecture. A secure network architecture must address segmentation,
12 12,2 Network Protect x x
Network Architecture least privilege, and availability, at a minimum.
Securely Manage Network Securely manage network infrastructure. Example implementations include version-controlled-infrastructure-as-
12 12,3 Network Protect x x
Infrastructure code, and the use of secure network protocols, such as SSH and HTTPS.
Establish and Maintain Architecture Establish and maintain architecture diagram(s) and/or other network system documentation. Review and update
12 12,4 Network Identify x x
Diagram(s) documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

Centralize Network Authentication,

12 12,5 Network Protect Centralize network AAA. x x
Authorization, and Auditing (AAA)
Use of Secure Network
Use secure network management and communication protocols (e.g., 802.1X, Wi-Fi Protected Access 2 (WPA2)
12 12,6 Network Protect Management and Communication x x
Enterprise or greater).
Protocols
Ensure Remote Devices Utilize a
Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing
12 12,7 Devices Protect VPN and are Connecting to an x x
enterprise resources on end-user devices.
Enterprise’s AAA Infrastructure
Establish and Maintain Dedicated Establish and maintain dedicated computing resources, either physically or logically separated, for all
12 12,8 Devices Protect Computing Resources for All administrative tasks or tasks requiring administrative access. The computing resources should be segmented from x
Administrative Work the enterprise's primary network and not be allowed internet access.

Operate processes and tooling to establish and maintain comprehensive network monitoring and
13 Network Monitoring and Defense
defense against security threats across the enterprise’s network infrastructure and user base.

Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice
13 13,1 Network Detect Centralize Security Event Alerting implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts. A log analytics x x
platform configured with security-relevant correlation alerts also satisfies this Safeguard.
Deploy a Host-Based Intrusion
13 13,2 Devices Detect Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported. x x
Detection Solution
Deploy a network intrusion detection solution on enterprise assets, where appropriate. Example implementations
Deploy a Network Intrusion
13 13,3 Network Detect include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) x x
Detection Solution
service.
Perform Traffic Filtering Between
13 13,4 Network Protect Perform traffic filtering between network segments, where appropriate. x x
Network Segments
Manage access control for assets remotely connecting to enterprise resources. Determine amount of access to
Manage Access Control for Remote
13 13,5 Devices Protect enterprise resources based on: up-to-date anti-malware software installed, configuration compliance with the x x
Assets
enterprise’s secure configuration process, and ensuring the operating system and applications are up-to-date.

13 13,6 Network Detect Collect Network Traffic Flow Logs Collect network traffic flow logs and/or network traffic to review and alert upon from network devices. x x

Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported.
Deploy a Host-Based Intrusion
13 13,7 Devices Protect Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS x
Prevention Solution
agent.
Deploy a Network Intrusion Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a
13 13,8 Network Protect x
Prevention Solution Network Intrusion Prevention System (NIPS) or equivalent CSP service.
Deploy port-level access control. Port-level access control utilizes 802.1x, or similar network access control
13 13,9 Devices Protect Deploy Port-Level Access Control x
protocols, such as certificates, and may incorporate user and/or device authentication.
Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or
13 13,10 Network Protect Perform Application Layer Filtering x
gateway.
Tune Security Event Alerting
13 13,11 Network Detect Tune security event alerting thresholds monthly, or more frequently. x
Thresholds
Security Awareness and Skills Establish and maintain a security awareness program to influence behavior among the workforce to be
14
Training security conscious and properly skilled to reduce cybersecurity risks to the enterprise.
Establish and maintain a security awareness program. The purpose of a security awareness program is to
Establish and Maintain a Security educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner.
14 14,1 N/A Protect x x x
Awareness Program Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant
enterprise changes occur that could impact this Safeguard.
Train Workforce Members to
14 14,2 N/A Protect Recognize Social Engineering Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating. x x x
Attacks
Train Workforce Members on Train workforce members on authentication best practices. Example topics include MFA, password composition,
14 14,3 N/A Protect x x x
Authentication Best Practices and credential management.
Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This
Train Workforce on Data Handling also includes training workforce members on clear screen and desk best practices, such as locking their screen
14 14,4 N/A Protect x x x
Best Practices when they step away from their enterprise asset, erasing physical and virtual whiteboards at the end of meetings,
and storing data and assets securely.
Train Workforce Members on
Train workforce members to be aware of causes for unintentional data exposure. Example topics include mis-
14 14,5 N/A Protect Causes of Unintentional Data x x x
delivery of sensitive data, losing a portable end-user device, or publishing data to unintended audiences.
Exposure
 Train Workforce Members on
14 14,6 N/A Protect Recognizing and Reporting Security Train workforce members to be able to recognize a potential incident and be able to report such an incident. x x x
Incidents
Train Workforce on How to Identify Train workforce to understand how to verify and report out-of-date software patches or any failures in automated
14 14,7 N/A Protect and Report if Their Enterprise processes and tools. Part of this training should include notifying IT personnel of any failures in automated x x x
Assets are Missing Security Updates processes and tools.
Train Workforce on the Dangers of
Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for
Connecting to and Transmitting
14 14,8 N/A Protect enterprise activities. If the enterprise has remote workers, training must include guidance to ensure that all users x x x
Enterprise Data Over Insecure
securely configure their home network infrastructure.
Networks
Conduct role-specific security awareness and skills training. Example implementations include secure system
Conduct Role-Specific Security
14 14,9 N/A Protect administration courses for IT professionals, OWASP® Top 10 vulnerability awareness and prevention training for x x
Awareness and Skills Training
web application developers, and advanced social engineering awareness training for high-profile roles.
Develop a process to evaluate service providers who hold sensitive data, or are responsible for an
15 Service Provider Management enterprise’s critical IT platforms or processes, to ensure these providers are protecting those platforms
and data appropriately.
Establish and maintain an inventory of service providers. The inventory is to list all known service providers,
Establish and Maintain an Inventory
15 15,1 N/A Identify include classification(s), and designate an enterprise contact for each service provider. Review and update the x x x
of Service Providers
inventory annually, or when significant enterprise changes occur that could impact this Safeguard.

Establish and maintain a service provider management policy. Ensure the policy addresses the classification,
Establish and Maintain a Service
15 15,2 N/A Identify inventory, assessment, monitoring, and decommissioning of service providers. Review and update the policy x x
Provider Management Policy
annually, or when significant enterprise changes occur that could impact this Safeguard.

Classify service providers. Classification consideration may include one or more characteristics, such as data
15 15,3 N/A Identify Classify Service Providers sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. Update x x
and review classifications annually, or when significant enterprise changes occur that could impact this Safeguard.
Ensure service provider contracts include security requirements. Example requirements may include minimum
security program requirements, security incident and/or data breach notification and response, data encryption
Ensure Service Provider Contracts
15 15,4 N/A Protect requirements, and data disposal commitments. These security requirements must be consistent with the x x
Include Security Requirements
enterprise’s service provider management policy. Review service provider contracts annually to ensure contracts
are not missing security requirements.
Assess service providers consistent with the enterprise’s service provider management policy. Assessment scope
may vary based on classification(s), and may include review of standardized assessment reports, such as Service
15 15,5 N/A Identify Assess Service Providers Organization Control 2 (SOC 2) and Payment Card Industry (PCI) Attestation of Compliance (AoC), customized x
questionnaires, or other appropriately rigorous processes. Reassess service providers annually, at a minimum, or
with new and renewed contracts.
Monitor service providers consistent with the enterprise’s service provider management policy. Monitoring may
15 15,6 Data Detect Monitor Service Providers include periodic reassessment of service provider compliance, monitoring service provider release notes, and dark x
web monitoring.
Securely Decommission Service Securely decommission service providers. Example considerations include user and service account deactivation,
15 15,7 Data Protect x
Providers termination of data flows, and secure disposal of enterprise data within service provider systems.
Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect,
16 Application Software Security
and remediate security weaknesses before they can impact the enterprise.

Establish and maintain a secure application development process. In the process, address such items as: secure
Establish and Maintain a Secure
16 16,1 Applications Protect application design standards, secure coding practices, developer training, vulnerability management, security of x x
Application Development Process
third-party code, and application security testing procedures. Review and update documentation annually, or when
significant enterprise changes occur that could impact this Safeguard.
Establish and maintain a process to accept and address reports of software vulnerabilities, including providing a
means for external entities to report. The process is to include such items as: a vulnerability handling policy that
identifies reporting process, responsible party for handling vulnerability reports, and a process for intake,
assignment, remediation, and remediation testing. As part of the process, use a vulnerability tracking system that
Establish and Maintain a Process to
includes severity ratings, and metrics for measuring timing for identification, analysis, and remediation of
16 16,2 Applications Protect Accept and Address Software x x
vulnerabilities. Review and update documentation annually, or when significant enterprise changes occur that
Vulnerabilities
could impact this Safeguard.

Third-party application developers need to consider this an externally-facing policy that helps to set expectations
for outside stakeholders.
Perform root cause analysis on security vulnerabilities. When reviewing vulnerabilities, root cause analysis is the
Perform Root Cause Analysis on
16 16,3 Applications Protect task of evaluating underlying issues that create vulnerabilities in code, and allows development teams to move x x
Security Vulnerabilities
beyond just fixing individual vulnerabilities as they arise.
Establish and manage an updated inventory of third-party components used in development, often referred to as a
Establish and Manage an Inventory
“bill of materials,” as well as components slated for future use. This inventory is to include any risks that each third-
16 16,4 Applications Protect of Third-Party Software x x
party component could pose. Evaluate the list at least monthly to identify any changes or updates to these
Components
components, and validate that the component is still supported.
Use up-to-date and trusted third-party software components. When possible, choose established and proven
Use Up-to-Date and Trusted Third-
16 16,5 Applications Protect frameworks and libraries that provide adequate security. Acquire these components from trusted sources or x x
Party Software Components
evaluate the software for vulnerabilities before use.
Establish and maintain a severity rating system and process for application vulnerabilities that facilitates prioritizing
Establish and Maintain a Severity the order in which discovered vulnerabilities are fixed. This process includes setting a minimum level of security
16 16,6 Applications Protect Rating System and Process for acceptability for releasing code or applications. Severity ratings bring a systematic way of triaging vulnerabilities x x
Application Vulnerabilities that improves risk management and helps ensure the most severe bugs are fixed first. Review and update the
system and process annually.
Use standard, industry-recommended hardening configuration templates for application infrastructure
Use Standard Hardening
components. This includes underlying servers, databases, and web servers, and applies to cloud containers,
16 16,7 Applications Protect Configuration Templates for x x
Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to
Application Infrastructure
weaken configuration hardening.
Separate Production and Non-
16 16,8 Applications Protect Maintain separate environments for production and non-production systems. x x
Production Systems
Ensure that all software development personnel receive training in writing secure code for their specific
Train Developers in Application
development environment and responsibilities. Training can include general security principles and application
16 16,9 Applications Protect Security Concepts and Secure x x
security standard practices. Conduct training at least annually and design in a way to promote security within the
Coding
development team, and build a culture of security among the developers.
Apply secure design principles in application architectures. Secure design principles include the concept of least
privilege and enforcing mediation to validate every operation that the user makes, promoting the concept of "never
Apply Secure Design Principles in trust user input." Examples include ensuring that explicit error checking is performed and documented for all input,
16 16,10 Applications Protect x x
Application Architectures including for size, data type, and acceptable ranges or formats. Secure design also means minimizing the
application infrastructure attack surface, such as turning off unprotected ports and services, removing
unnecessary programs and files, and renaming or removing default accounts.

Leverage vetted modules or services for application security components, such as identity management,
encryption, and auditing and logging. Using platform features in critical security functions will reduce developers’
Leverage Vetted Modules or
workload and minimize the likelihood of design or implementation errors. Modern operating systems provide
16 16,11 Applications Protect Services for Application Security x x
effective mechanisms for identification, authentication, and authorization and make those mechanisms available to
Components
applications. Use only standardized, currently accepted, and extensively reviewed encryption algorithms.
Operating systems also provide mechanisms to create and maintain secure audit logs.
Implement Code-Level Security Apply static and dynamic analysis tools within the application life cycle to verify that secure coding practices are
16 16,12 Applications Protect x
Checks being followed.
Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited
Conduct Application Penetration to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing
16 16,13 Applications Protect x
Testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated
user.
Conduct threat modeling. Threat modeling is the process of identifying and addressing application security design
flaws within a design, before code is created. It is conducted through specially trained individuals who evaluate the
16 16,14 Applications Protect Conduct Threat Modeling x
application design and gauge security risks for each entry point and access level. The goal is to map out the
application, architecture, and infrastructure in a structured way to understand its weaknesses.
Establish a program to develop and maintain an incident response capability (e.g., policies, plans,
17 Incident Response Management procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an
attack.
 Designate one key person, and at least one backup, who will manage the enterprise’s incident handling process.
Management personnel are responsible for the coordination and documentation of incident response and recovery
Designate Personnel to Manage
17 17,1 N/A Respond efforts and can consist of employees internal to the enterprise, third-party vendors, or a hybrid approach. If using a x x x
Incident Handling
third-party vendor, designate at least one person internal to the enterprise to oversee any third-party work. Review
annually, or when significant enterprise changes occur that could impact this Safeguard.
Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may
Establish and Maintain Contact
include internal staff, third-party vendors, law enforcement, cyber insurance providers, relevant government
17 17,2 N/A Respond Information for Reporting Security x x x
agencies, Information Sharing and Analysis Center (ISAC) partners, or other stakeholders. Verify contacts
Incidents
annually to ensure that information is up-to-date.
Establish and maintain an enterprise process for the workforce to report security incidents. The process includes
Establish and Maintain an Enterprise reporting timeframe, personnel to report to, mechanism for reporting, and the minimum information to be
17 17,3 N/A Respond x x x
Process for Reporting Incidents reported. Ensure the process is publicly available to all of the workforce. Review annually, or when significant
enterprise changes occur that could impact this Safeguard.
Establish and maintain an incident response process that addresses roles and responsibilities, compliance
Establish and Maintain an Incident
17 17,4 N/A Respond requirements, and a communication plan. Review annually, or when significant enterprise changes occur that x x
Response Process
could impact this Safeguard.
Assign key roles and responsibilities for incident response, including staff from legal, IT, information security,
Assign Key Roles and
17 17,5 N/A Respond facilities, public relations, human resources, incident responders, and analysts, as applicable. Review annually, or x x
Responsibilities
when significant enterprise changes occur that could impact this Safeguard.
Determine which primary and secondary mechanisms will be used to communicate and report during a security
Define Mechanisms for
incident. Mechanisms can include phone calls, emails, or letters. Keep in mind that certain mechanisms, such as
17 17,6 N/A Respond Communicating During Incident x x
emails, can be affected during a security incident. Review annually, or when significant enterprise changes occur
Response
that could impact this Safeguard.
Plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident
Conduct Routine Incident Response
17 17,7 N/A Recover response process to prepare for responding to real-world incidents. Exercises need to test communication x x
Exercises
channels, decision making, and workflows. Conduct testing on an annual basis, at a minimum.
Conduct post-incident reviews. Post-incident reviews help prevent incident recurrence through identifying lessons
17 17,8 N/A Recover Conduct Post-Incident Reviews x x
learned and follow-up action.
Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident
Establish and Maintain Security and an event. Examples can include: abnormal activity, security vulnerability, security weakness, data breach,
17 17,9 N/A Recover x
Incident Thresholds privacy incident, etc. Review annually, or when significant enterprise changes occur that could impact this
Safeguard.
Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses
18 Penetration Testing in controls (people, processes, and technology), and simulating the objectives and actions of an
attacker.
Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the
enterprise. Penetration testing program characteristics include scope, such as network, web application,
Establish and Maintain a Penetration
18 18,1 N/A Identify Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, x x
Testing Program
such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how
findings will be routed internally; and retrospective requirements.
Perform periodic external penetration tests based on program requirements, no less than annually. External
Perform Periodic External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information.
18 18,2 Network Identify x x
Penetration Tests Penetration testing requires specialized skills and experience and must be conducted through a qualified party.
The testing may be clear box or opaque box.
Remediate Penetration Test
18 18,3 Network Protect Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization. x x
Findings
Validate security measures after each penetration test. If deemed necessary, modify rulesets and capabilities to
18 18,4 Network Protect Validate Security Measures x
detect the techniques used during testing.
Perform Periodic Internal Perform periodic internal penetration tests based on program requirements, no less than annually. The testing
18 18,5 N/A Identify x
Penetration Tests may be clear box or opaque box.