CIS Critical Security Controls (CIS Controls) are a set of best practices and guidelines developed by the Center for Internet Security (CIS) to help organizations enhance their cybersecurity posture. These controls are designed to mitigate the most prevalent and dangerous cyber threats. The primary purpose of CIS Controls is to provide a prioritized, highly focused set of actions that organizations can follow to improve their cyber defenses.
In this blog, we'll cover:
CIS Controls are being increasingly adopted due to their practicality, effectiveness, and comprehensive nature in addressing contemporary cybersecurity threats. Developed through a collaborative, community-driven process involving experts from various sectors, these controls provide prioritized, actionable steps that are both practical and scalable, making them accessible to organizations of all sizes and resource levels.
Adopting CIS Controls offers several significant benefits for organizations seeking to enhance their cybersecurity posture.
CIS Controls Version 8 follows a structured approach organized around three "Implementation Groups" (IGs) and eighteen "Controls", with each Control broken down into specific "Safeguards". Every Safeguard has its targeted "Asset Type" pointing to a particular "Security Function", also, every Safeguard is categorised by the three IGs.
Implementation Groups (IGs) are aimed to prioritize cybersecurity efforts based on the organization's size, resources, and risk profile. These groups help organizations of different sizes and capabilities to implement the CIS Controls more effectively and efficiently. Organizations can benchmark their security posture and track progress as they implement controls within their assigned IG.
To determine which IG your organization falls into, consider the following factors:
Size and complexity: Small organizations with limited IT infrastructure and staff generally fit into IG1. Mid-sized organizations with more complex IT environments fit into IG2. Large organizations with complex, distributed environments and dedicated security teams fit into IG3.
The Controls in Version 8 provide a comprehensive framework for enhancing an organization's cybersecurity posture. Here is an overview of all the 18 Controls.
These Controls cover a wide range of security practices. Together, they provide a robust approach to securing an organization's digital environment. We'll dive into these Controls in greater detail in a minute.
"Asset Type" refers to the specific categories of assets that the Safeguard is aimed to protect and manage.
The six primary asset types within the Safeguards are:
| Devices | These include physical devices and systems such as servers, workstations, laptops, and other hardware components. |
| Applications | This category encompasses all software applications, including operating systems, business applications, and custom-developed software. |
| Network | This includes all network infrastructure components like routers, switches, firewalls, and other network-related devices. |
| Data | Refers to all forms of organizational data, including sensitive information that requires protection from unauthorized access and breaches. |
| Users | This includes users, employees, and other individuals who interact with and use the organization's IT resources. |
| N/A | N/A refers to controls that are not specific to any particular type of asset but rather apply broadly across multiple or all asset categories. |
"Security Function" refers to the primary purpose or role each Safeguard plays within an organization's cybersecurity strategy. It helps organizations understand the objective of the Safeguard and how it contributes to overall security.
The five key Security Functions within the Safeguards are:
| Identify | Understanding the business context, resources, and cybersecurity risks to prioritize efforts. |
| Protect | Safeguarding critical infrastructure services and information from cyber threats. |
| Detect | Implementing activities to quickly discover cybersecurity events. |
| Respond | Taking action regarding a detected cybersecurity incident. |
| Recover | Restoring capabilities or services impaired due to a cybersecurity incident. |
Safeguards in CIS Controls Version 8 are categorized by Implementation Groups to help organizations decide which safeguards to implement first based on their size and resources.
Organizations can allocate their cybersecurity budgets and efforts more effectively by ensuring that essential protections are implemented even with limited resources, and more advanced protections are pursued as resources and capabilities grow.
The 18 controls are a comprehensive set of security measures designed to safeguard organizations against cyber threats and vulnerabilities. Each control provides corresponding Safeguards for organizations to maintain the integrity and availability of their information systems and data.
Control 1, known as “Inventory and Control of Enterprise Assets”, focuses on the hardware assets. It aims to establish an accurate inventory of authorized and unauthorized devices within an organization's network and ensure that only approved devices are allowed access. Control 1 is crucial because it forms the foundation of an organization's cybersecurity strategy.
Control 2, known as "Inventory and Control of Software Assets," focuses on maintaining an accurate and current inventory of all software applications within the network. By doing so, organizations can ensure that only authorized and necessary software is installed, reducing the risk of vulnerabilities associated with unapproved or outdated applications.
Control 3, known as "Data Protection," focuses on implementing measures to safeguard organizational data from unauthorized access and potential breaches. This control emphasizes the importance of securing sensitive information through encryption, data masking, and other protective techniques both in transit and at rest.
Control 4, "Secure Configuration of Enterprise Assets and Software," emphasizes the importance of establishing and maintaining secure settings for all hardware and software within an organization. Adhering to Control 4 is crucial for mitigating risks associated with default settings and misconfigurations.
Control 4 has twelve Safeguards. They involve configuring systems to reduce vulnerabilities, removing unnecessary functions, and ensuring security settings are consistently applied across all devices and applications.
By implementing secure configurations, organizations can minimize the attack surface, prevent unauthorized access, and enhance overall security.
Control 5, "Account Management," is vital for ensuring the security and integrity of user accounts within an organization. This control focuses on establishing and maintaining processes for managing the lifecycle of user accounts, including their creation, use, and deletion.
Control 5 has six Safeguards. They emphasize the importance of enforcing strong authentication mechanisms, regularly reviewing account privileges, and promptly revoking access for inactive or unauthorized accounts.
By implementing account management practices, organizations can prevent unauthorized access, reduce the risk of insider threats, and maintain control over who has access to critical systems and data.
Control 6 Safeguards
Control 6 has eight Safeguards. They suggest implementing policies and mechanisms to manage user permissions effectively, ensuring that access is granted based on the principle of least privilege. It also suggests regular reviewing and adjusting access rights to reduce potential internal and external threats and protect sensitive data from compromise.Control 8, "Audit Log Management," promotes the importance of implementing effective audit log management, organizations can detect and investigate suspicious activities, and ensure accountability.
Control 9, "Email and Web Browser Protections," focuses on securing email safety and internet access within organizations. This control involves implementing measures to safeguard email and web browsers from cyber threats, such as phishing attacks, malware, and other malicious activities.
Control 11, "Data Recovery," focuses on ensuring the availability and integrity of an organization's data by implementing data backup and recovery solutions. It suggests setting up reliable data recovery mechanisms, so that organizations can quickly restore operations and minimize downtime in the event of data loss due to cyberattacks, hardware failures, or other disasters.
Control 12, "Network Infrastructure Management," focuses on securing and managing the organization's network infrastructure. Network infrastructure includes devices such as physical and virtualized gateways, firewalls, wireless access points, routers, and switches. This Control suggests an appropriate security architecture, addressing vulnerabilities that are introduced with default settings, monitoring for changes, and reassessment of current configurations.
Control 13, "Network Monitoring and Defense," focuses on the continuous surveillance and protection of an organization’s network to detect and respond to potential threats in real time.
Control 15, "Service Provider Management," focuses on ensuring that third-party service providers and vendors adhere to the organization's security policies and practices. By implementing Control 15, organizations can mitigate risks associated with outsourcing and third-party services, ensuring that external partners do not become weak links in their security chain.
Control 16, "Application Software Security," emphasizes the importance of securing applications throughout their development and deployment lifecycle. This control suggests ensuring that applications are designed, developed, and maintained with security in mind, organizations can prevent the exploitation of software vulnerabilities and protect sensitive data from unauthorized access.
The fourteen Safeguards of Control 16 involve incorporating security best practices into the software development process, conducting regular security testing, and addressing vulnerabilities promptly.
Control 17, "Incident Response Management," is focused on preparing organizations to effectively handle and mitigate the impact of cybersecurity incidents.
Control 18, "Penetration Testing," emphasizes the importance of regularly testing an organization's defenses through simulated cyberattacks. Implementing penetration testing as part of a comprehensive security strategy helps organizations proactively address potential threats, enhance their resilience, and ensure continuous improvement of their cybersecurity defenses.
CIS Controls are invaluable for your cybersecurity defense If you want to reduce the complexity of security management.
They not only provide you with a prioritized and effective framework for your organizations to prevent the most significant cyber threats, but they also aid you in meeting regulatory and compliance requirements, as they align with various legal and industry standards.
Get in touch with us now to learn more about CIS Controls with our security awareness program! Alternatively, you can take a look at our blog to learn how usecure could help you navigate regulations and standards around the world.