CIS Controls v8.1 control library

Every control CMDash tracks for CIS Controls v8.1, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.

153 controls18 families19 mapped to other frameworksIdentifiers and titles only — text is licensed

Why the control text is not on this page

CIS publishes the Controls at no cost under a Creative Commons licence whose NoDerivatives and NonCommercial terms rule out embedding the safeguard text in this product.

CMDash publishes the identifiers, titles and cross-framework mappings so you can see the shape of what is tracked, and links you to Center for Internet Security for the document itself. A tenant that holds its own licence can load the real text through the framework import.

Download free from CIS →

Families

Enterprise Asset Inventory · 5 Software Asset Inventory · 7 Data Protection · 14 Secure Configuration · 12 Account Management · 6 Access Control Management · 8 Vulnerability Management · 7 Audit Log Management · 12 Email & Browser Protection · 7 Malware Defenses · 7 Data Recovery · 5 Network Infrastructure · 8 Network Monitoring · 11 Security Awareness · 9 Service Provider Management · 7 Application Security · 14 Incident Response · 9 Penetration Testing · 5

Enterprise Asset Inventory · 5

1.1	Establish and maintain detailed enterprise asset inventory Maps to NIST Cybersecurity Framework (1.1, legacy)
1.2	Address unauthorized assets
1.3	Utilize DHCP logging to update enterprise asset inventory
1.4	Use dynamic host configuration protocol to update asset inventory
1.5	Use a passive asset discovery tool

Software Asset Inventory · 7

2.1	Establish and maintain a software inventory Maps to NIST Cybersecurity Framework (1.1, legacy)
2.2	Ensure authorized software is currently supported
2.3	Address unauthorized software
2.4	Utilize automated software inventory tools
2.5	Allowlist authorized software
2.6	Allowlist authorized libraries
2.7	Allowlist authorized scripts

Data Protection · 14

3.1	Establish and maintain a data management process Maps to NIST Cybersecurity Framework (1.1, legacy)
3.2	Establish and maintain a data inventory
3.3	Configure data access control lists
3.4	Enforce data retention
3.5	Securely dispose of data
3.6	Encrypt data on end-user devices
3.7	Establish and maintain a data classification scheme
3.8	Document data flows
3.9	Encrypt data on removable media
3.10	Encrypt sensitive data in transit
3.11	Encrypt sensitive data at rest Maps to NIST Cybersecurity Framework (1.1, legacy)
3.12	Segment data processing and storage
3.13	Deploy a data loss prevention solution Maps to NIST Cybersecurity Framework (1.1, legacy)
3.14	Log sensitive data access

Secure Configuration · 12

4.1	Establish and maintain a secure configuration process Maps to NIST Cybersecurity Framework (1.1, legacy)
4.2	Establish and maintain a secure configuration for network infrastructure
4.3	Configure automatic session locking
4.4	Implement and manage a firewall on servers
4.5	Implement and manage a firewall on end-user devices
4.6	Securely manage enterprise assets and software
4.7	Manage default accounts on enterprise assets
4.8	Uninstall or disable unnecessary services
4.9	Configure trusted DNS servers
4.10	Enforce automatic device lockout
4.11	Enforce remote wipe capability
4.12	Separate enterprise workspaces on mobile devices

Account Management · 6

5.1	Establish and maintain an inventory of accounts Maps to NIST Cybersecurity Framework (1.1, legacy)
5.2	Use unique passwords
5.3	Disable dormant accounts
5.4	Restrict administrator privileges
5.5	Establish and maintain an inventory of service accounts
5.6	Centralize account management

Access Control Management · 8

6.1	Establish an access granting process
6.2	Establish an access revoking process
6.3	Require MFA for externally-exposed applications Maps to NIST Cybersecurity Framework (1.1, legacy)
6.4	Require MFA for remote network access
6.5	Require MFA for administrative access Maps to NIST Cybersecurity Framework (1.1, legacy)
6.6	Establish and maintain an inventory of auth and authorization systems
6.7	Centralize access control
6.8	Define and maintain role-based access control

Vulnerability Management · 7

7.1	Establish and maintain a vulnerability management process Maps to NIST Cybersecurity Framework (1.1, legacy)
7.2	Establish and maintain a remediation process
7.3	Perform automated operating system patch management
7.4	Perform automated application patch management
7.5	Perform automated vulnerability scans of internal assets Maps to NIST Cybersecurity Framework (1.1, legacy)
7.6	Perform automated vulnerability scans of external assets
7.7	Remediate detected vulnerabilities

Audit Log Management · 12

8.1	Establish and maintain an audit log management process
8.2	Collect audit logs Maps to NIST Cybersecurity Framework (1.1, legacy)
8.3	Ensure adequate audit log storage
8.4	Standardize time synchronization
8.5	Collect detailed audit logs
8.6	Collect DNS query audit logs
8.7	Collect URL request audit logs
8.8	Collect command-line audit logs
8.9	Centralize audit logs Maps to NIST Cybersecurity Framework (1.1, legacy)
8.10	Retain audit logs
8.11	Conduct audit log reviews
8.12	Collect service provider logs

Email & Browser Protection · 7

9.1	Ensure use of only fully supported browsers and email clients
9.2	Use DNS filtering services
9.3	Maintain and enforce URL filtering
9.4	Restrict unnecessary or unauthorized browser extensions
9.5	Implement DMARC
9.6	Block unnecessary file types
9.7	Deploy and maintain email server anti-malware protections

Malware Defenses · 7

10.1	Deploy and maintain anti-malware software Maps to NIST Cybersecurity Framework (1.1, legacy)
10.2	Configure automatic anti-malware signature updates
10.3	Disable autorun and autoplay
10.4	Configure automatic anti-malware scanning of removable media
10.5	Enable anti-exploitation features
10.6	Centrally manage anti-malware software
10.7	Use behavior-based anti-malware software

Data Recovery · 5

11.1	Establish and maintain a data recovery process Maps to NIST Cybersecurity Framework (1.1, legacy)
11.2	Perform automated backups
11.3	Protect recovery data
11.4	Establish and maintain an isolated instance of recovery data
11.5	Test data recovery

Network Infrastructure · 8

12.1	Ensure network infrastructure is up-to-date
12.2	Establish and maintain a secure network architecture
12.3	Securely manage network infrastructure
12.4	Establish and maintain architecture diagrams
12.5	Centralize network authentication, authorization, and auditing
12.6	Use secure network management and communication protocols
12.7	Ensure remote devices utilize a VPN and connecting to managed infrastructure
12.8	Establish and maintain dedicated computing resources

Network Monitoring · 11

13.1	Centralize security event alerting Maps to NIST Cybersecurity Framework (1.1, legacy)
13.2	Deploy a host-based intrusion detection solution
13.3	Deploy a network intrusion detection solution
13.4	Perform traffic filtering between network segments
13.5	Manage access control for remote assets
13.6	Collect network traffic flow logs
13.7	Deploy a host-based intrusion prevention solution
13.8	Deploy a network intrusion prevention solution
13.9	Deploy port-level access control
13.10	Perform application layer filtering
13.11	Tune security event alerting thresholds

Security Awareness · 9

14.1	Establish and maintain a security awareness program Maps to NIST Cybersecurity Framework (1.1, legacy)
14.2	Train workforce members to recognize social engineering attacks
14.3	Train workforce on authentication best practices
14.4	Train workforce on data handling best practices
14.5	Train workforce on causes of unintentional data exposure
14.6	Train workforce on recognizing and reporting security incidents
14.7	Train workforce on how to identify and report if assets are missing security updates
14.8	Train workforce on the dangers of connecting to unsecured networks
14.9	Conduct role-specific security awareness training

Service Provider Management · 7

15.1	Establish and maintain an inventory of service providers
15.2	Establish and maintain a service provider management policy
15.3	Classify service providers
15.4	Ensure service provider contracts include security requirements
15.5	Assess service providers
15.6	Monitor service providers
15.7	Securely decommission service providers

Application Security · 14

16.1	Establish and maintain a secure application development process
16.2	Establish and maintain a process to accept and address software vulnerabilities
16.3	Perform root cause analysis on security vulnerabilities
16.4	Establish and maintain a code-level vulnerability management program
16.5	Use up-to-date and trusted third-party software components
16.6	Establish and maintain a severity rating system for vulnerabilities
16.7	Use standard hardening configuration templates
16.8	Separate production and non-production systems
16.9	Train developers in application security concepts and secure coding
16.10	Apply secure design principles in application architectures
16.11	Leverage vetted modules or services for application security
16.12	Implement code-level security checks
16.13	Conduct application penetration testing
16.14	Conduct threat modeling

Incident Response · 9

17.1	Designate personnel to manage incident handling
17.2	Establish and maintain contact information for reporting incidents
17.3	Establish and maintain an enterprise process for reporting incidents
17.4	Establish and maintain an incident response process Maps to NIST Cybersecurity Framework (1.1, legacy)
17.5	Assign key roles and responsibilities
17.6	Define mechanisms for communicating during incident response
17.7	Conduct routine incident response exercises
17.8	Conduct post-incident reviews
17.9	Establish and maintain security incident thresholds

Penetration Testing · 5

18.1	Establish and maintain a penetration testing program Maps to NIST Cybersecurity Framework (1.1, legacy)
18.2	Perform periodic external penetration tests
18.3	Remediate penetration test findings
18.4	Validate security measures after each penetration test
18.5	Perform periodic internal penetration tests

Where this comes from

Control identifiers, families and titles are the rows CMDash’s own seed data writes for CIS Controls v8.1 8.1, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.

Track these controls in CMDash

Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.

Start free trial About CIS Controls v8.1