CIS Critical Security Controls Implementation Checklist
This checklist is structured according to CIS Controls v8.1. It provides a structured approach to begin
implementing all 18 Controls, ensuring that your organization covers essential areas of cybersecurity.
Depending on your Implementation Group (IG), you may not need to implement them all.
1. Inventory and Control of Enterprise Assets
Maintain an up-to-date inventory of all hardware assets within the enterprise.
Ensure all devices are authorized and managed.
Remove or quarantine unauthorized devices.
2. Inventory and Control of Software Assets
Maintain an inventory of all software installed on devices.
Ensure only authorized software is installed.
Regularly audit software installations and usage.
3. Data Protection
Classify data based on sensitivity and criticality.
Implement data encryption for data at rest and in transit.
Enforce data access controls and monitor data usage.
4. Secure Configuration of Enterprise Assets and Software
Implement secure configurations for all hardware and software.
Regularly review and update configurations.
Utilize configuration management tools.
CIS Critical Security Controls Implementation Checklist
5. Account Management
Implement processes for account creation, management, and deletion.
Enforce the principle of least privilege.
Regularly review account permissions and access.
6. Access Control Management
Enforce multi-factor authentication.
Implement role-based access control (RBAC).
Regularly audit access control mechanisms.
7. Continuous Vulnerability Management
Regularly scan for vulnerabilities.
Prioritize and remediate vulnerabilities based on risk.
Implement automated vulnerability management tools.
8. Audit Log Management
Enable logging for all critical systems and applications.
Regularly review and analyze logs.
Implement centralized log management.
9. Email and Web Browser Protections
Implement email filtering and spam protection.
Configure web browsers with security best practices.
Use DNS filtering to block malicious websites.
CIS Critical Security Controls Implementation Checklist
10. Malware Defenses
Deploy anti-malware software on all devices.
Regularly update malware definitions.
Monitor and analyze malware incidents.
11. Data Recovery
Implement regular data backup procedures.
Store backups in a secure, offsite location.
Regularly test data recovery processes.
12. Network Infrastructure Management
Implement network segmentation.
Secure network devices and management interfaces.
Monitor network traffic for suspicious activity.
13. Network Monitoring and Defense
Centralize security event alerting.
Deploy host-based and network intrusion detection and prevention solutions.
Perform application level filtering.
14. Security Awareness and Skills Training
Conduct regular security awareness training for all employees.
Provide role-specific security training.
Regularly assess the effectiveness of training programs.
CIS Critical Security Controls Implementation Checklist
15. Service Provider Management
Evaluate the security practices of third-party service providers.
Include security requirements in contracts.
Regularly review third-party security practices.
16. Application Software Security
Implement secure software development practices.
Conduct regular security testing of applications.
Monitor and remediate application vulnerabilities.
17. Incident Response Management
Develop and maintain an incident response plan.
Conduct regular incident response exercises.
Establish an incident response team.
18. Penetration Testing
Conduct regular penetration tests.
Remediate identified vulnerabilities.
Use findings to improve security practices.
