18.5 Perform periodic internal penetration tests
What the standard requires
CIS publishes the Controls at no cost under a Creative Commons licence whose NoDerivatives and NonCommercial terms rule out embedding the safeguard text in this product.
A prioritised set of 18 controls and their safeguards, ordered so the earliest ones block the most common attack patterns. Safeguards are grouped into three Implementation Groups so smaller organizations can adopt a defensible subset.
Download free from CIS →If your organisation holds a licence for CIS Controls v8.1, CMDash can load the real text against every control through the framework import, where it is stamped as tenant-provided.
Cross-framework mappings
No cross-framework mapping is seeded for this control. That is stated rather than filled in: a mapping nobody authored is worse than a gap you can see.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.