CIS 1 Inventory and Control of Enterprise Assets
1.1 Establish and Maintain Detailed Enterprise Asset Inventory
Establish and maintain an accurate, detailed, and up-to-date inventory of all enterprise assets with the potential to store or process data, to include: end-user devices (including portable and mobile), network devices, non-computing/IoT devices, and servers. Ensure the inventory records the network address (if static), hardware address, machine name, enterprise asset owner, department for each asset, and whether the asset has been approved to connect to the network. Review and update the inventory of all enterprise assets bi-annually, or more frequently.
1.2 Address Unauthorized Assets
Ensure that a process exists to address unauthorized assets on a weekly basis. The enterprise may choose to remove the asset from the network, deny the asset from connecting remotely to the network, or quarantine the asset.
1.3 Utilize an Active Discovery Tool
Utilize an active discovery tool to identify assets connected to the enterprise's network. Configure the active discovery tool to execute daily, or more frequently.
1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory
Use DHCP logging on all DHCP servers or IP address management tools to update the enterprise's asset inventory. Review and use logs to update the enterprise's asset inventory weekly, or more frequently.
1.5 Use a Passive Asset Discovery Tool
Use a passive discovery tool to identify assets connected to the enterprise's network. Review and use scans to update the enterprise's asset inventory at least weekly, or more frequently.
CIS 2 Inventory and Control of Software Assets
2.1 Establish and Maintain a Software Inventory
Establish and maintain a detailed inventory of all licensed software installed on enterprise assets. The software inventory must document the title, publisher, initial install/use date, and business purpose for each entry. Review and update the software inventory bi-annually, or more frequently.
2.2 Ensure Authorized Software is Currently Supported
Ensure that only currently supported software is designated as authorized in the software inventory for enterprise assets. If software is unsupported yet necessary, document an exception detailing mitigating controls and residual risk acceptance. Review the software list to verify software support at least monthly, or more frequently.
2.3 Address Unauthorized Software
Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently.
2.4 Utilize Automated Software Inventory Tools
Utilize software inventory tools, when possible, throughout the enterprise to automate the discovery and documentation of installed software.
2.5 Allowlist Authorized Software
Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.
2.6 Allowlist Authorized Libraries
Use technical controls to ensure that only authorized software libraries (e.g., specific .dll, .ocx, .so files) are allowed to load into a system process. Block unauthorized libraries from loading. Reassess bi-annually, or more frequently.
2.7 Allowlist Authorized Scripts
Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts (e.g., specific .ps1, .py files) are allowed to execute. Block unauthorized scripts. Reassess bi-annually, or more frequently.
CIS 3 Data Protection
3.1 Establish and Maintain a Data Management Process
Establish and maintain a documented data management process addressing data sensitivity, data owner, handling of data, data retention limits, and disposal requirements. Review and update annually, or when significant enterprise changes occur.
3.2 Establish and Maintain a Data Inventory
Establish and maintain a data inventory based on the enterprise's data management process. Inventory sensitive data, at a minimum. Review and update annually, with a priority on sensitive data.
3.3 Configure Data Access Control Lists
Configure data access control lists based on a user's need to know. Apply data access control lists to local and remote file systems, databases, and applications.
3.4 Enforce Data Retention
Retain data according to the enterprise's documented data management process. Data retention must include both minimum and maximum timelines.
3.5 Securely Dispose of Data
Securely dispose of data as outlined in the enterprise's documented data management process. Ensure the disposal process and method are commensurate with the data sensitivity.
3.6 Encrypt Data on End-User Devices
Encrypt data on end-user devices containing sensitive data (e.g., Windows BitLocker, Apple FileVault, Linux dm-crypt).
3.7 Establish and Maintain a Data Classification Scheme
Establish and maintain an overall data classification scheme for the enterprise (e.g., labels such as Sensitive, Confidential, Public). Review and update annually, or when significant enterprise changes occur.
3.8 Document Data Flows
Document data flows, including service provider data flows, based on the enterprise's data management process. Review and update annually, or when significant enterprise changes occur.
3.9 Encrypt Data on Removable Media
Encrypt data on removable media.
3.10 Encrypt Sensitive Data in Transit
Encrypt sensitive data in transit (e.g., TLS and OpenSSH).
3.11 Encrypt Sensitive Data at Rest
Encrypt sensitive data at rest on servers, applications, and databases. Storage-layer (server-side) encryption meets the minimum requirement; application-layer (client-side) encryption may also be used.
3.12 Segment Data Processing and Storage Based on Sensitivity
Segment data processing and storage based on the sensitivity of the data. Do not process sensitive data on enterprise assets intended for lower sensitivity data.
3.13 Deploy a Data Loss Prevention Solution
Implement an automated tool, such as a host-based Data Loss Prevention (DLP) tool, to identify all sensitive data stored, processed, or transmitted through enterprise assets, and update the sensitive data inventory.
3.14 Log Sensitive Data Access
Log sensitive data access, including modification and disposal.
CIS 4 Secure Configuration of Enterprise Assets and Software
4.1 Establish and Maintain a Secure Configuration Process
Establish and maintain a documented secure configuration process for enterprise assets and software (operating systems and applications). Review and update annually, or when significant enterprise changes occur.
4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure
Establish and maintain a documented secure configuration process for network devices. Review and update annually, or when significant enterprise changes occur.
4.3 Configure Automatic Session Locking on Enterprise Assets
Configure automatic session locking after a defined period of inactivity. For general-purpose OSes the period must not exceed 15 minutes; for mobile end-user devices, 2 minutes.
4.4 Implement and Manage a Firewall on Servers
Implement and manage a firewall on servers, where supported (e.g., a virtual firewall, OS firewall, or third-party firewall agent).
4.5 Implement and Manage a Firewall on End-User Devices
Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except explicitly allowed services and ports.
4.6 Securely Manage Enterprise Assets and Software
Securely manage enterprise assets and software (e.g., version-controlled infrastructure-as-code, administrative access over secure protocols such as SSH and HTTPS). Do not use insecure management protocols such as Telnet and HTTP unless operationally essential.
4.7 Manage Default Accounts on Enterprise Assets and Software
Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts (e.g., disable them or make them unusable).
4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
Uninstall or disable unnecessary services on enterprise assets and software (e.g., an unused file-sharing service, web application module, or service function).
4.9 Configure Trusted DNS Servers on Enterprise Assets
Configure trusted DNS servers on enterprise assets (e.g., enterprise-controlled DNS servers and/or reputable externally accessible DNS servers).
4.10 Enforce Automatic Device Lockout on Portable End-User Devices
Enforce automatic device lockout after a threshold of local failed authentication attempts on portable end-user devices, where supported (laptops: no more than 20; tablets/smartphones: no more than 10).
4.11 Enforce Remote Wipe Capability on Portable End-User Devices
Enforce remote wipe capability on portable end-user devices, when appropriate such as lost or stolen devices, or when an individual no longer supports the enterprise.
4.12 Separate Enterprise Workspaces on Mobile End-User Devices
Ensure separate enterprise workspaces are used on mobile end-user devices, where supported (e.g., Apple Configuration Profile or Android Work Profile).
CIS 5 Account Management
5.1 Establish and Maintain an Inventory of Accounts
Establish and maintain an inventory of all accounts (user and administrator). At a minimum contain the person's name, username, start/stop dates, and department. Validate that all active accounts are authorized at least quarterly, or more frequently.
5.2 Use Unique Passwords
Use unique passwords for all enterprise assets. Best practice: at minimum an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA.
5.3 Disable Dormant Accounts
Delete or disable any dormant accounts after a period of 45 days of inactivity, where supported.
5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts
Restrict administrator privileges to dedicated administrator accounts. Conduct general computing activities from the user's primary, non-privileged account.
5.5 Establish and Maintain an Inventory of Service Accounts
Establish and maintain an inventory of service accounts (at minimum: department owner, review date, and purpose). Review at least quarterly, or more frequently.
5.6 Centralize Account Management
Centralize account management through a directory or identity service.
CIS 6 Access Control Management
6.1 Establish an Access Granting Process
Establish and follow a documented, preferably automated, process for granting access to enterprise assets upon new hire, rights grant, or role change.
6.2 Establish an Access Revoking Process
Establish and follow a process, preferably automated, for revoking access — disabling accounts immediately upon termination, rights revocation, or role change. Disabling (not deleting) preserves audit trails.
6.3 Require MFA for Externally-Exposed Applications
Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported (through a directory service or SSO provider is acceptable).
6.4 Require MFA for Remote Network Access
Require MFA for remote network access.
6.5 Require MFA for Administrative Access
Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether on-site or third-party.
6.6 Establish and Maintain an Inventory of Authentication and Authorization Systems
Establish and maintain an inventory of the enterprise's authentication and authorization systems, including those hosted on-site or at a service provider. Review at least annually.
6.7 Centralize Access Control
Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.
6.8 Define and Maintain Role-Based Access Control
Define and maintain role-based access control by documenting the access rights necessary for each role. Review access to validate privileges at least annually, or more frequently.
CIS 7 Continuous Vulnerability Management
7.1 Establish and Maintain a Vulnerability Management Process
Establish and maintain a documented vulnerability management process. Review and update annually, or when significant enterprise changes occur.
7.2 Establish and Maintain a Remediation Process
Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly or more frequent reviews.
7.3 Perform Automated Operating System Patch Management
Perform operating system updates through automated patch management on a monthly, or more frequent, basis.
7.4 Perform Automated Application Patch Management
Perform application updates through automated patch management on a monthly, or more frequent, basis.
7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
Perform automated vulnerability scans of internal enterprise assets quarterly or more frequently, using authenticated and unauthenticated SCAP-compliant scans.
7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
Perform automated vulnerability scans of externally-exposed enterprise assets monthly or more frequently, using a SCAP-compliant scanning tool.
7.7 Remediate Detected Vulnerabilities
Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.
CIS 8 Audit Log Management
8.1 Establish and Maintain an Audit Log Management Process
Establish and maintain a documented audit log management process defining logging requirements (collection, review, and retention). Review and update annually, or when significant enterprise changes occur.
8.2 Collect Audit Logs
Collect audit logs. Ensure logging has been enabled across enterprise assets per the audit log management process.
8.3 Ensure Adequate Audit Log Storage
Ensure that logging destinations maintain adequate storage to comply with the audit log management process.
8.4 Standardize Time Synchronization
Standardize time synchronization. Configure at least two synchronized time sources across enterprise assets, where supported.
8.5 Collect Detailed Audit Logs
Configure detailed audit logging for assets containing sensitive data, including event source, date, username, timestamp, source/destination addresses, and other useful forensic elements.
8.6 Collect DNS Query Audit Logs
Collect DNS query audit logs on enterprise assets, where appropriate and supported.
8.7 Collect URL Request Audit Logs
Collect URL request audit logs on enterprise assets, where appropriate and supported.
8.8 Collect Command-Line Audit Logs
Collect command-line audit logs (e.g., from PowerShell, BASH, and remote administrative terminals).
8.9 Centralize Audit Logs
Centralize audit log collection and retention across enterprise assets (e.g., leveraging a SIEM tool to centralize multiple log sources).
8.10 Retain Audit Logs
Retain audit logs across enterprise assets for a minimum of 90 days.
8.11 Conduct Audit Log Reviews
Conduct reviews of audit logs to detect anomalies or abnormal events on a weekly, or more frequent, basis.
8.12 Collect Service Provider Logs
Collect service provider logs, where supported (e.g., authentication/authorization events, data creation and disposal events, and user management events).
CIS 9 Email and Web Browser Protections
9.1 Ensure Use of Only Fully Supported Browsers and Email Clients
Ensure only fully supported browsers and email clients are allowed to execute, only using the latest vendor-provided version.
9.2 Use DNS Filtering Services
Use DNS filtering services on all end-user devices, including remote and on-premises assets, to block access to known malicious domains.
9.3 Maintain and Enforce Network-Based URL Filters
Enforce and update network-based URL filters to limit connections to potentially malicious or unapproved websites (e.g., category-based, reputation-based, or block-list filtering). Enforce for all enterprise assets.
9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions
Restrict, through uninstalling or disabling, any unauthorized or unnecessary browser or email client plugins, extensions, and add-on applications.
9.5 Implement DMARC
Implement DMARC policy and verification to lower the chance of spoofed or modified email, starting with SPF and DKIM.
9.6 Block Unnecessary File Types
Block unnecessary file types attempting to enter the enterprise's email gateway.
9.7 Deploy and Maintain Email Server Anti-Malware Protections
Deploy and maintain email server anti-malware protections, such as attachment scanning and/or sandboxing.
CIS 10 Malware Defenses
10.1 Deploy and Maintain Anti-Malware Software
Deploy and maintain anti-malware software on all enterprise assets.
10.2 Configure Automatic Anti-Malware Signature Updates
Configure automatic updates for anti-malware signature files on all enterprise assets.
10.3 Disable Autorun and Autoplay for Removable Media
Disable autorun and autoplay auto-execute functionality for removable media.
10.4 Configure Automatic Anti-Malware Scanning of Removable Media
Configure anti-malware software to automatically scan removable media.
10.5 Enable Anti-Exploitation Features
Enable anti-exploitation features (e.g., Microsoft DEP, Windows Defender Exploit Guard, or Apple System Integrity Protection and Gatekeeper) where possible.
10.6 Centrally Manage Anti-Malware Software
Centrally manage anti-malware software.
10.7 Use Behavior-Based Anti-Malware Software
Use behavior-based anti-malware software.
CIS 11 Data Recovery
11.1 Establish and Maintain a Data Recovery Process
Establish and maintain a documented data recovery process addressing scope, recovery prioritization, and the security of backup data. Review and update annually, or when significant enterprise changes occur.
11.2 Perform Automated Backups
Perform automated backups of in-scope enterprise assets weekly or more frequently, based on the sensitivity of the data.
11.3 Protect Recovery Data
Protect recovery data with equivalent controls to the original data (e.g., encryption or data separation, based on requirements).
11.4 Establish and Maintain an Isolated Instance of Recovery Data
Establish and maintain an isolated instance of recovery data (e.g., version-controlled backup destinations through offline, cloud, or off-site systems).
11.5 Test Data Recovery
Test backup recovery quarterly, or more frequently, for a sampling of in-scope enterprise assets.
CIS 12 Network Infrastructure Management
12.1 Ensure Network Infrastructure is Up-to-Date
Ensure network infrastructure is kept up-to-date (e.g., latest stable software release and/or currently supported network-as-a-service). Review versions monthly or more frequently.
12.2 Establish and Maintain a Secure Network Architecture
Design and maintain a secure network architecture addressing segmentation, least privilege, and availability, at a minimum.
12.3 Securely Manage Network Infrastructure
Securely manage network infrastructure (e.g., version-controlled infrastructure-as-code and secure protocols such as SSH and HTTPS).
12.4 Establish and Maintain Architecture Diagram(s)
Establish and maintain architecture diagram(s) and/or other network system documentation. Review and update annually, or when significant enterprise changes occur.
12.5 Centralize Network Authentication, Authorization, and Auditing (AAA)
Centralize network authentication, authorization, and auditing (AAA).
12.6 Use of Secure Network Management and Communication Protocols
Use secure network management and communication protocols (e.g., 802.1X, WPA2 Enterprise or greater).
12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure
Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resources on end-user devices.
12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work
Establish and maintain dedicated computing resources, physically or logically separated, for all administrative tasks; segmented from the primary network and not allowed internet access.
CIS 13 Network Monitoring and Defense
13.1 Centralize Security Event Alerting
Centralize security event alerting across enterprise assets for log correlation and analysis (best practice: a SIEM with vendor-defined event correlation alerts).
13.2 Deploy a Host-Based Intrusion Detection Solution
Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.
13.3 Deploy a Network Intrusion Detection Solution
Deploy a network intrusion detection solution (e.g., NIDS or equivalent cloud service) on enterprise assets, where appropriate.
13.4 Perform Traffic Filtering Between Network Segments
Perform traffic filtering between network segments, where appropriate.
13.5 Manage Access Control for Remote Assets
Manage access control for assets remotely connecting to enterprise resources, based on up-to-date anti-malware, secure configuration compliance, and up-to-date OS/applications.
13.6 Collect Network Traffic Flow Logs
Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.
13.7 Deploy a Host-Based Intrusion Prevention Solution
Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported (e.g., an EDR client or host-based IPS agent).
13.8 Deploy a Network Intrusion Prevention Solution
Deploy a network intrusion prevention solution, where appropriate (e.g., NIPS or equivalent cloud service).
13.9 Deploy Port-Level Access Control
Deploy port-level access control using 802.1x or similar network access control protocols, which may incorporate user and/or device authentication.
13.10 Perform Application Layer Filtering
Perform application layer filtering (e.g., a filtering proxy, application-layer firewall, or gateway).
13.11 Tune Security Event Alerting Thresholds
Tune security event alerting thresholds monthly, or more frequently.
CIS 14 Security Awareness and Skills Training
14.1 Establish and Maintain a Security Awareness Program
Establish and maintain a security awareness program to educate the workforce on interacting with enterprise assets and data securely. Conduct training at hire and at least annually; review content annually.
14.2 Train Workforce Members to Recognize Social Engineering Attacks
Train workforce members to recognize social engineering attacks, such as phishing, business email compromise (BEC), pretexting, and tailgating.
14.3 Train Workforce Members on Authentication Best Practices
Train workforce members on authentication best practices (e.g., MFA, password composition, and credential management).
14.4 Train Workforce Members on Data Handling Best Practices
Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data, including clear-screen and clear-desk best practices.
14.5 Train Workforce Members on Causes of Unintentional Data Exposure
Train workforce members to be aware of causes for unintentional data exposure (e.g., mis-delivery of sensitive data, losing a portable device, or publishing to unintended audiences).
14.6 Train Workforce Members on Recognizing and Reporting Security Incidents
Train workforce members to recognize a potential incident and be able to report such an incident.
14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
Train workforce members to verify and report out-of-date software patches or any failures in automated processes and tools.
14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks
Train workforce members on the dangers of connecting to, and transmitting enterprise data over, insecure networks; for remote workers, include home network security guidance.
14.9 Conduct Role-Specific Security Awareness and Skills Training
Conduct role-specific security awareness and skills training (e.g., secure administration for IT, OWASP Top 10 for developers, advanced social-engineering awareness for high-profile roles).
CIS 15 Service Provider Management
15.1 Establish and Maintain an Inventory of Service Providers
Establish and maintain an inventory of service providers, listing all known providers, their classification(s), and an enterprise contact for each. Review annually, or when significant enterprise changes occur.
15.2 Establish and Maintain a Service Provider Management Policy
Establish and maintain a service provider management policy addressing classification, inventory, assessment, monitoring, and decommissioning. Review annually, or when significant enterprise changes occur.
15.3 Classify Service Providers
Classify service providers based on characteristics such as data sensitivity, data volume, availability requirements, applicable regulations, and inherent/mitigated risk. Review annually.
15.4 Ensure Service Provider Contracts Include Security Requirements
Ensure service provider contracts include security requirements (e.g., minimum security program, incident/breach notification, encryption, and data disposal). Review contracts annually.
15.5 Assess Service Providers
Assess service providers consistent with the enterprise's policy (e.g., SOC 2, PCI AoC, questionnaires). Reassess at least annually or with new/renewed contracts.
15.6 Monitor Service Providers
Monitor service providers consistent with the enterprise's policy (e.g., periodic reassessment, release-note monitoring, and dark-web monitoring).
15.7 Securely Decommission Service Providers
Securely decommission service providers (e.g., account deactivation, termination of data flows, and secure disposal of enterprise data within provider systems).
CIS 16 Application Software Security
16.1 Establish and Maintain a Secure Application Development Process
Establish and maintain a secure application development process addressing secure design standards, secure coding, developer training, vulnerability management, third-party code security, and testing. Review annually.
16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities
Establish and maintain a process to accept and address reports of software vulnerabilities, including a means for external entities to report, intake/assignment/remediation steps, and a tracking system with severity ratings. Review annually.
16.3 Perform Root Cause Analysis on Security Vulnerabilities
Perform root cause analysis on security vulnerabilities to move beyond fixing individual vulnerabilities toward the underlying issues that create them.
16.4 Establish and Manage an Inventory of Third-Party Software Components
Establish and manage an updated inventory of third-party components (a 'bill of materials'), including risks each could pose. Evaluate at least monthly for changes/support.
16.5 Use Up-to-Date and Trusted Third-Party Software Components
Use up-to-date and trusted third-party software components; choose established, proven frameworks and libraries and acquire from trusted sources or evaluate for vulnerabilities before use.
16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
Establish and maintain a severity rating system and process for application vulnerabilities to prioritize fixes and set a minimum acceptable security level for releasing code. Review annually.
16.7 Use Standard Hardening Configuration Templates for Application Infrastructure
Use standard, industry-recommended hardening configuration templates for application infrastructure components (servers, databases, web servers, containers, PaaS, SaaS).
16.8 Separate Production and Non-Production Systems
Maintain separate environments for production and non-production systems.
16.9 Train Developers in Application Security Concepts and Secure Coding
Ensure all software development personnel receive training in writing secure code for their environment and responsibilities, at least annually.
16.10 Apply Secure Design Principles in Application Architectures
Apply secure design principles in application architectures (e.g., least privilege, input validation/'never trust user input', explicit error checking, and minimizing attack surface).
16.11 Leverage Vetted Modules or Services for Application Security Components
Leverage vetted modules or services for application security components (identity management, encryption, auditing/logging) and use only standardized, currently accepted encryption algorithms.
16.12 Implement Code-Level Security Checks
Implement code-level security checks — apply static and dynamic analysis tools within the application life cycle to verify secure coding practices.
16.13 Conduct Application Penetration Testing
Conduct application penetration testing. For critical applications, authenticated penetration testing finds business logic flaws better than automated scanning.
16.14 Conduct Threat Modeling
Conduct threat modeling — identify and address application security design flaws before code is created, through trained individuals evaluating each entry point and access level.
CIS 17 Incident Response Management
17.1 Designate Personnel to Manage Incident Handling
Designate one key person, and at least one backup, to manage the enterprise's incident handling process; if using a third party, designate an internal overseer. Review annually.
17.2 Establish and Maintain Contact Information for Reporting Security Incidents
Establish and maintain contact information for parties that need to be informed of security incidents (internal staff, vendors, law enforcement, insurers, agencies, ISAC partners). Verify annually.
17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
Establish and maintain an enterprise process for the workforce to report security incidents, including timeframe, who to report to, mechanism, and minimum information. Review annually.
17.4 Establish and Maintain an Incident Response Process
Establish and maintain a documented incident response process addressing roles/responsibilities, compliance requirements, and a communication plan. Review annually.
17.5 Assign Key Roles and Responsibilities
Assign key roles and responsibilities for incident response, including legal, IT, information security, facilities, PR, HR, responders, and analysts, as applicable. Review annually.
17.6 Define Mechanisms for Communicating During Incident Response
Determine primary and secondary mechanisms to communicate and report during a security incident (some, such as email, may be affected during an incident). Review annually.
17.7 Conduct Routine Incident Response Exercises
Plan and conduct routine incident response exercises and scenarios for key personnel, testing communication channels, decision making, and workflows, at least annually.
17.8 Conduct Post-Incident Reviews
Conduct post-incident reviews to help prevent recurrence by identifying lessons learned and follow-up actions.
17.9 Establish and Maintain Security Incident Thresholds
Establish and maintain security incident thresholds, at minimum differentiating between an incident and an event. Review annually.
CIS 18 Penetration Testing
18.1 Establish and Maintain a Penetration Testing Program
Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise, addressing scope, frequency, limitations, points of contact, remediation, and retrospectives.
18.2 Perform Periodic External Penetration Tests
Perform periodic external penetration tests, no less than annually, including enterprise and environmental reconnaissance, conducted by a qualified party (clear box or opaque box).
18.3 Remediate Penetration Test Findings
Remediate penetration test findings based on the enterprise's policy for remediation scope and prioritization.
18.4 Validate Security Measures
Validate security measures after each penetration test; if necessary, modify rulesets and capabilities to detect the techniques used during testing.
18.5 Perform Periodic Internal Penetration Tests
Perform periodic internal penetration tests, no less than annually (clear box or opaque box).