CIS Controls, the practical security checklist

Keep an accurate, detailed inventory of all enterprise devices, reviewed at least twice a year.

Have a process to deal with unauthorised assets weekly.

Use an active discovery tool to find assets on the network.

Use DHCP logging to update the asset inventory.

Use a passive discovery tool to find assets.

Keep an inventory of all licensed software, reviewed at least twice a year.

Make sure only currently supported software is authorised, with documented exceptions.

Deal with unauthorised software promptly.

Use automated tools to discover and update the software inventory.

Use technical controls to allow only authorised software to run.

Allow only authorised software libraries to load into processes.

Allow only authorised scripts to run, using signatures where possible.

Have a secure configuration process for devices and software, reviewed yearly.

Have a secure configuration process for network devices.

Lock sessions automatically after inactivity.

Run a firewall on servers.

Run a firewall on end-user devices.

Manage assets and software using secure protocols.

Manage default accounts.

Uninstall or disable unnecessary services.

Use trusted DNS servers.

Lock portable devices automatically after failed sign-in attempts.

Be able to remotely wipe lost enterprise devices.

Keep separate work areas on mobile devices.

Have a vulnerability management process, reviewed yearly.

Have a risk-based remediation process, reviewed monthly.

Patch operating systems automatically.

Patch applications automatically.

Run automated vulnerability scans of internal assets quarterly.

Run automated vulnerability scans of externally exposed assets monthly.

Fix detected vulnerabilities in line with the process.

Have a documented data management process, reviewed yearly.

Keep an inventory of sensitive data.

Set access controls on data according to need to know.

Enforce data retention periods.

Dispose of data securely in line with its sensitivity.

Encrypt data on end-user devices.

Have a data classification scheme.

Document data flows, including with service providers.

Encrypt data on removable media.

Encrypt sensitive data in transit.

Encrypt sensitive data at rest.

Segment data processing and storage by sensitivity.

Deploy a data loss prevention solution.

Log access to sensitive data.

Keep network infrastructure up to date.

Establish and maintain a secure network architecture.

Manage network infrastructure securely.

Establish and maintain architecture diagrams, reviewed yearly.

Centralise network authentication, authorisation and auditing.

Use secure network management and communication protocols.

Make remote devices use a VPN and the enterprise security infrastructure.

Keep dedicated computing resources for all administrative work.

Have a secure application development process.

Have a process to accept and fix software vulnerability reports.

Perform root cause analysis on security vulnerabilities.

Keep an inventory of third-party software components.

Use up-to-date and trusted third-party components.

Establish a severity rating system for vulnerabilities.

Use standard hardening configuration templates for application infrastructure.

Separate production and non-production systems.

Train developers in secure coding.

Apply secure design principles in application architectures.

Use vetted modules or services for application security components.

Implement code-level security checks.

Conduct application penetration testing.

Conduct threat modelling.

Keep an inventory of all accounts, reviewed at least twice a year.

Use unique, strong passwords.

Disable dormant accounts after 45 days.

Restrict administrator privileges to dedicated admin accounts.

Keep an inventory of service accounts, reviewed at least twice a year.

Centralise account management through a directory or identity service.

Have a process to grant access when someone joins or changes role.

Have a process to revoke access when someone leaves or changes role.

Require MFA for externally exposed applications.

Require MFA for remote network access.

Require MFA for all administrative access.

Keep an inventory of authentication and authorisation systems.

Centralise access control through a directory or SSO service.

Define and maintain role-based access control.

Have a security awareness programme.

Train staff to recognise social engineering.

Train staff on authentication best practices.

Train staff on how to handle data safely.

Train staff on causes of unintentional data exposure.

Train staff to recognise and report incidents.

Train staff to spot and report missing security updates.

Train staff on the dangers of insecure networks.

Provide role-specific security training.

Have an audit log management process, reviewed yearly.

Collect audit logs from key systems.

Make sure there is enough log storage.

Standardise time synchronisation.

Collect detailed audit logs for sensitive data and systems.

Collect DNS query logs.

Collect URL request logs.

Collect command-line audit logs.

Centralise audit log collection.

Retain audit logs for at least 90 days.

Review audit logs weekly to spot anomalies.

Collect logs from service providers.

Use only fully supported browsers and email clients.

Use DNS filtering services.

Maintain and enforce network-based URL filters.

Restrict unnecessary or unauthorised browser and email add-ons.

Implement DMARC.

Block unnecessary file types at the mail gateway.

Deploy email server anti-malware protections.

Deploy and maintain anti-malware software on all assets.

Configure automatic anti-malware signature updates.

Disable autorun and autoplay for removable media.

Configure automatic anti-malware scanning of removable media.

Enable anti-exploitation features.

Centrally manage anti-malware software.

Use behaviour-based anti-malware software.

Centralise security event alerting.

Deploy a host-based intrusion detection solution.

Deploy a network intrusion detection solution.

Perform traffic filtering between network segments.

Manage access control for remote assets.

Collect network traffic flow logs.

Deploy a host-based intrusion prevention solution.

Deploy a network intrusion prevention solution.

Deploy port-level access control.

Perform application layer filtering.

Tune security event alerting thresholds.

Have a data recovery process, reviewed yearly.

Perform automated backups of in-scope assets weekly or more often.

Protect recovery data with controls equal to the original data.

Keep an isolated instance of recovery data.

Test data recovery quarterly.

Keep an inventory of service providers.

Have a service provider management policy, reviewed yearly.

Classify service providers.

Include security requirements in provider contracts.

Assess service providers.

Monitor service providers.

Decommission service providers securely.

Designate a person to manage incident handling.

Keep contact information for reporting security incidents.

Have an enterprise process for reporting incidents.

Have an incident response process, reviewed yearly.

Assign key roles and responsibilities.

Define mechanisms for communicating during incidents.

Run routine incident response exercises.

Conduct post-incident reviews.

Establish and maintain security incident thresholds.

Have a penetration testing programme.

Perform periodic external penetration tests.

Fix penetration testing findings.

Validate security measures.

Perform periodic internal penetration tests.