Comparison
CIS v8.1 vs CPS 234
CIS Controls v8.1 · APRA CPS 234 Information Security · data 2026-10-27
Requirement-level comparison of CIS Controls v8.1 and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 24 APRA CPS 234 Information Security requirements, 15 map to something in CIS v8.1, 2 are only loosely related, and 7 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to CIS v8.1 (7)
| CPS 234 | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Information security capability · 1 | ||||
| Para 15 | Maintain a capability commensurate with threats | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Para 19 | Policies direct everyone with security obligations | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Testing control effectiveness · 2 | ||||
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Para 31 | Review the testing programme at least annually | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Internal audit · 2 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Para 33 | Assurance provided by appropriately skilled personnel | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (2)
| CPS 234 | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 2 | ||||
| Para 13 | Board ultimately responsible for information security | CIS 14.1CIS 14.9 | Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
| Para 14 | Define information security roles and responsibilities | CIS 14.1CIS 14.9 | Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
Mapped (15)
| CPS 234 | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Information security capability · 2 | ||||
| Para 16 | Assess third parties' information security capability | Editorial | CIS 15.1CIS 15.2CIS 15.3+4 | Same topic: Vendor Risk Mgmt, Supply Chain Risk (editorial pick) |
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | CIS 1.1CIS 1.2CIS 1.3+9 | Same topic: Asset Management (editorial pick) |
| Implementation of controls · 2 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | CIS 3.1CIS 3.4CIS 3.5+2 | Same topic: Data Protection (editorial pick) |
| Para 22 | Evaluate the design of third parties' controls | Editorial | CIS 15.1CIS 15.2CIS 15.3+4 | Same topic: Vendor Risk Mgmt, Supply Chain Risk (editorial pick) |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | Editorial | CIS 13.2CIS 13.3CIS 13.7+6 | Same topic: Intrusion Detection (editorial pick) |
| Para 24 | Maintain information security response plans | Editorial | CIS 17.1CIS 17.4CIS 17.5+2 | Same topic: Incident Response (editorial pick) |
| Para 25 | Response plans cover all stages and escalation | Editorial | CIS 17.1CIS 17.2CIS 17.4+5 | Same topic: Incident Response, Communication (editorial pick) |
| Para 26 | Review and test response plans annually | Editorial | CIS 17.1CIS 17.4CIS 17.5+2 | Same topic: Incident Response (editorial pick) |
| Testing control effectiveness · 3 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 28 | Check third parties' control testing is adequate | Editorial | CIS 15.1CIS 15.3CIS 15.4+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Internal audit · 1 | ||||
| Para 34 | Internal audit assesses third-party assurance relied on | Editorial | CIS 15.1CIS 15.3CIS 15.4+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | Editorial | CIS 17.3 | Same topic: Reporting (editorial pick) |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | Editorial | CIS 17.3 | Same topic: Reporting (editorial pick) |
Of 153 CIS Controls v8.1 requirements, 48 map to something in CPS 234, 18 are only loosely related, and 87 have no mapping in our data.
CIS's own published crosswalk covers 49 of 153 safeguards; ControlMapping mapped the rest editorially, with a reason for each, so check those links before relying on them.
Likely new work: CIS v8.1 requirements with no mapping to CPS 234 (87)
| CIS v8.1 | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| 2. Inventory and Control of Software Assets · 4 | ||||
| CIS 2.2 | Ensure Authorized Software is Currently Supported | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 2.5 | Allowlist Authorized Software | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 2.6 | Allowlist Authorized Libraries | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 2.7 | Allowlist Authorized Scripts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 3. Data Protection · 2 | ||||
| CIS 3.3 | Configure Data Access Control Lists | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 3.14 | Log Sensitive Data Access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 4. Secure Configuration of Enterprise Assets and Software · 11 | ||||
| CIS 4.1 | Establish and Maintain a Secure Configuration Process | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.2 | Establish and Maintain a Secure Configuration Process for Network Infrastructure | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.3 | Configure Automatic Session Locking on Enterprise Assets | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.4 | Implement and Manage a Firewall on Servers | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.5 | Implement and Manage a Firewall on End-User Devices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.6 | Securely Manage Enterprise Assets and Software | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.7 | Manage Default Accounts on Enterprise Assets and Software | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 4.12 | Separate Enterprise Workspaces on Mobile End-User Devices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 5. Account Management · 6 | ||||
| CIS 5.1 | Establish and Maintain an Inventory of Accounts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 5.2 | Use Unique Passwords | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 5.3 | Disable Dormant Accounts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 5.5 | Establish and Maintain an Inventory of Service Accounts | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 5.6 | Centralize Account Management | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 6. Access Control Management · 8 | ||||
| CIS 6.1 | Establish an Access Granting Process | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 6.2 | Establish an Access Revoking Process | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 6.3 | Require MFA for Externally-Exposed Applications | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 6.4 | Require MFA for Remote Network Access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 6.5 | Require MFA for Administrative Access | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 6.6 | Establish and Maintain an Inventory of Authentication and Authorization Systems | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 6.7 | Centralize Access Control | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 6.8 | Define and Maintain Role-Based Access Control | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 7. Continuous Vulnerability Management · 2 | ||||
| CIS 7.3 | Perform Automated Operating System Patch Management | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 7.4 | Perform Automated Application Patch Management | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 8. Audit Log Management · 10 | ||||
| CIS 8.1 | Establish and Maintain an Audit Log Management Process | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.2 | Collect Audit Logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.3 | Ensure Adequate Audit Log Storage | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.4 | Standardize Time Synchronization | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.5 | Collect Detailed Audit Logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.7 | Collect URL Request Audit Logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.8 | Collect Command-Line Audit Logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.9 | Centralize Audit Logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.10 | Retain Audit Logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 8.12 | Collect Service Provider Logs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 9. Email and Web Browser Protections · 1 | ||||
| CIS 9.3 | Maintain and Enforce Network-Based URL Filters | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 10. Malware Defenses · 7 | ||||
| CIS 10.1 | Deploy and Maintain Anti-Malware Software | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 10.2 | Configure Automatic Anti-Malware Signature Updates | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 10.3 | Disable Autorun and Autoplay for Removable Media | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 10.4 | Configure Automatic Anti-Malware Scanning of Removable Media | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 10.5 | Enable Anti-Exploitation Features | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 10.6 | Centrally Manage Anti-Malware Software | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 10.7 | Use Behavior-Based Anti-Malware Software | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 11. Data Recovery · 5 | ||||
| CIS 11.1 | Establish and Maintain a Data Recovery Process | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 11.2 | Perform Automated Backups | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 11.3 | Protect Recovery Data | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 11.4 | Establish and Maintain an Isolated Instance of Recovery Data | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 11.5 | Test Data Recovery | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 12. Network Infrastructure Management · 8 | ||||
| CIS 12.1 | Ensure Network Infrastructure is Up-to-Date | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 12.2 | Establish and Maintain a Secure Network Architecture | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 12.3 | Securely Manage Network Infrastructure | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 12.4 | Establish and Maintain Architecture Diagram(s) | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 12.5 | Centralize Network Authentication, Authorization, and Auditing (AAA) | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 12.6 | Use of Secure Network Management and Communication Protocols | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 13. Network Monitoring and Defense · 4 | ||||
| CIS 13.4 | Perform Traffic Filtering Between Network Segments | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 13.5 | Manage Access Control for Remote Assets | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 13.9 | Deploy Port-Level Access Control | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 13.11 | Tune Security Event Alerting Thresholds | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 14. Security Awareness and Skills Training · 7 | ||||
| CIS 14.2 | Train Workforce Members to Recognize Social Engineering Attacks | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 14.3 | Train Workforce Members on Authentication Best Practices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 14.4 | Train Workforce on Data Handling Best Practices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 14.5 | Train Workforce Members on Causes of Unintentional Data Exposure | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 14.6 | Train Workforce Members on Recognizing and Reporting Security Incidents | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 14.7 | Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 14.8 | Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks | No mapping in our data | — | No mapping to CPS 234 in our data. |
| 16. Application Software Security · 12 | ||||
| CIS 16.1 | Establish and Maintain a Secure Application Development Process | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.2 | Establish and Maintain a Process to Accept and Address Software Vulnerabilities | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.3 | Perform Root Cause Analysis on Security Vulnerabilities | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.5 | Use Up-to-Date and Trusted Third-Party Software Components | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.8 | Separate Production and Non-Production Systems | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.9 | Train Developers in Application Security Concepts and Secure Coding | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.10 | Apply Secure Design Principles in Application Architectures | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.11 | Leverage Vetted Modules or Services for Application Security Components | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.12 | Implement Code-Level Security Checks | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.13 | Conduct Application Penetration Testing | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CIS 16.14 | Conduct Threat Modeling | No mapping in our data | — | No mapping to CPS 234 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (18)
| CIS v8.1 | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| 3. Data Protection · 4 | ||||
| CIS 3.6 | Encrypt Data on End-User Devices | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| CIS 3.9 | Encrypt Data on Removable Media | Para 21 | Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| CIS 3.10 | Encrypt Sensitive Data in Transit | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 3.13 | Deploy a Data Loss Prevention Solution | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| 4. Secure Configuration of Enterprise Assets and Software · 1 | ||||
| CIS 4.9 | Configure Trusted DNS Servers on Enterprise Assets | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| 8. Audit Log Management · 2 | ||||
| CIS 8.6 | Collect DNS Query Audit Logs | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| CIS 8.11 | Conduct Audit Log Reviews | Para 23 | Only shares CSF DE.AE-02: related, not a mapping | |
| 9. Email and Web Browser Protections · 6 | ||||
| CIS 9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 9.2 | Use DNS Filtering Services | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| CIS 9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 9.5 | Implement DMARC | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 9.6 | Block Unnecessary File Types | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 9.7 | Deploy and Maintain Email Server Anti-Malware Protections | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| 13. Network Monitoring and Defense · 3 | ||||
| CIS 13.1 | Centralize Security Event Alerting | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| CIS 13.6 | Collect Network Traffic Flow Logs | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| CIS 13.10 | Perform Application Layer Filtering | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| 14. Security Awareness and Skills Training · 2 | ||||
| CIS 14.1 | Establish and Maintain a Security Awareness Program | Para 13Para 14 | Only shares CSF GV.RR-01: related, not a mapping | |
| CIS 14.9 | Conduct Role-Specific Security Awareness and Skills Training | Para 13Para 14 | Only shares CSF GV.RR-02: related, not a mapping | |
Mapped (48)
| CIS v8.1 | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| 1. Inventory and Control of Enterprise Assets · 5 | ||||
| CIS 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| CIS 1.2 | Address Unauthorized Assets | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| CIS 1.3 | Utilize an Active Discovery Tool | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| CIS 1.4 | Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| CIS 1.5 | Use a Passive Asset Discovery Tool | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| 2. Inventory and Control of Software Assets · 3 | ||||
| CIS 2.1 | Establish and Maintain a Software Inventory | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| CIS 2.3 | Address Unauthorized Software | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| CIS 2.4 | Utilize Automated Software Inventory Tools | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| 3. Data Protection · 8 | ||||
| CIS 3.1 | Establish and Maintain a Data Management Process | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| CIS 3.2 | Establish and Maintain a Data Inventory | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| CIS 3.4 | Enforce Data Retention | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| CIS 3.5 | Securely Dispose of Data | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| CIS 3.7 | Establish and Maintain a Data Classification Scheme | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| CIS 3.8 | Document Data Flows | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| CIS 3.11 | Encrypt Sensitive Data at Rest | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| CIS 3.12 | Segment Data Processing and Storage Based on Sensitivity | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| 7. Continuous Vulnerability Management · 5 | ||||
| CIS 7.1 | Establish and Maintain a Vulnerability Management Process | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.2 | Establish and Maintain a Remediation Process | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.5 | Perform Automated Vulnerability Scans of Internal Enterprise Assets | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.6 | Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.7 | Remediate Detected Vulnerabilities | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| 13. Network Monitoring and Defense · 4 | ||||
| CIS 13.2 | Deploy a Host-Based Intrusion Detection Solution | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.3 | Deploy a Network Intrusion Detection Solution | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.7 | Deploy a Host-Based Intrusion Prevention Solution | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.8 | Deploy a Network Intrusion Prevention Solution | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| 15. Service Provider Management · 7 | ||||
| CIS 15.1 | Establish and Maintain an Inventory of Service Providers | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Editorial | Para 16Para 22 | Same topic: Supply Chain Risk (editorial pick) |
| CIS 15.3 | Classify Service Providers | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.4 | Ensure Service Provider Contracts Include Security Requirements | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.5 | Assess Service Providers | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.6 | Monitor Service Providers | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.7 | Securely Decommission Service Providers | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| 16. Application Software Security · 2 | ||||
| CIS 16.4 | Establish and Manage an Inventory of Third-Party Software Components | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| CIS 16.6 | Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| 17. Incident Response Management · 9 | ||||
| CIS 17.1 | Designate Personnel to Manage Incident Handling | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| CIS 17.2 | Establish and Maintain Contact Information for Reporting Security Incidents | Editorial | Para 25 | Same topic: Communication (editorial pick) |
| CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | Editorial | Para 35Para 36 | Same topic: Reporting (editorial pick) |
| CIS 17.4 | Establish and Maintain an Incident Response Process | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| CIS 17.5 | Assign Key Roles and Responsibilities | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| CIS 17.6 | Define Mechanisms for Communicating During Incident Response | Editorial | Para 25 | Same topic: Communication (editorial pick) |
| CIS 17.7 | Conduct Routine Incident Response Exercises | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| CIS 17.8 | Conduct Post-Incident Reviews | Editorial | Para 25 | Same topic: Lessons Learned (editorial pick) |
| CIS 17.9 | Establish and Maintain Security Incident Thresholds | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| 18. Penetration Testing · 5 | ||||
| CIS 18.1 | Establish and Maintain a Penetration Testing Program | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.2 | Perform Periodic External Penetration Tests | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.3 | Remediate Penetration Test Findings | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.4 | Validate Security Measures | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.5 | Perform Periodic Internal Penetration Tests | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
By topic
Both cover (11):
Supply Chain RiskAsset ManagementData ClassificationVulnerability MgmtData ProtectionIntrusion DetectionIncident ResponseCommunicationReportingLessons LearnedVendor Risk Mgmt
Only CIS v8.1 (27):
Awareness & TrainingAccess ControlMulti-Factor AuthEncryptionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityWeb SecurityZero TrustMobile SecurityCloud SecurityDNS SecurityWAFDLPCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCRecovery PlanningComms & RestoreDisaster RecoveryAPI Security
Only CPS 234 (6):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.