CIS Top 20 Controls

What is CIS Top 20?

The CIS Top 20 is a set of critical security controls created by the Center for Internet Security (CIS) to assist organizations in safeguarding their information systems against cyber threats. The CIS Top 20 provides an actionable and prioritized set of best practices for organizations to improve their cybersecurity posture and mitigate the risk of cyber-attacks and data breaches. These controls include areas such as inventory and control of hardware and software assets, vulnerability management, secure configuration of systems, continuous monitoring, and incident response. By implementing the CIS Top 20 controls, organizations can improve their security posture and safeguard their assets from cyber threats. Below are the 20 controls defined by the CIS:

  • Inventory and Control of Hardware Assets
  • Inventory and Control of Software Assets
  • Continuous Vulnerability Management
  • Controlled Use of Administrative Privileges
  • Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
  • Maintenance, Monitoring, and Analysis of Audit Logs
  • Email and Web Browser Protections
  • Malware Defenses
  • Limitation and Control of Network Ports, Protocols, and Services
  • Data Recovery Capability
  • Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches
  • Boundary Defense
  • Data Protection
  • Controlled Access Based on the Need to Know
  • Wireless Access Control
  • Account Monitoring and Control
  • Implement a Security Awareness and Training Program
  • Application Software Security
  • Incident Response and Management
  • Penetration Tests and Red Team Exercises

 

Creating a Strong Cybersecurity Framework: A Step-by-Step Guide to CIS Compliance

Cyber threats are constantly evolving, and organizations need to stay ahead of the curve to protect their information systems from potential attacks. Creating a CIS (Center for Internet Security) framework and managing compliance with it is an effective way to enhance cybersecurity posture and reduce the risk of cyber attacks and data breaches. In this article, we’ll outline the steps organizations can take to create a CIS framework and manage compliance with it, helping them stay ahead of cyber threats and protect their valuable assets.

To create a CIS (Center for Internet Security) framework and manage compliance with it, follow these steps:

  • Understand the CIS Controls, which provide a set of best practices for protecting information systems from cyber threats.
  • Assess your current security posture and prioritize your security efforts based on the results.
  • Develop a plan to implement the CIS Controls, including specific actions, timelines, and responsible parties.
  • Implement the CIS Controls, which may involve deploying new security technologies, updating policies and procedures, and training employees.
  • Monitor and measure compliance regularly to identify areas for improvement and make adjustments to your plan.
  • Conduct regular security assessments to ensure compliance and identify new areas for improvement.
  • Stay up-to-date with changes to the CIS Controls and new security threats to stay ahead of cyber-attacks.