Comparison
CIS v8.1 vs Cyber Essentials
CIS Controls v8.1 · UK Cyber Essentials (NCSC) · data 2026-10-27
Requirement-level comparison of CIS Controls v8.1 and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 5 UK Cyber Essentials (NCSC) requirements, 5 map to something in CIS v8.1, 0 are only loosely related, and 0 have no mapping in our data.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Mapped (5)
| Cyber Essentials | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Technical controls · 5 | ||||
| CE 1 | Firewalls | Editorial | CIS 4.4CIS 4.5CIS 12.2+5 | Same topic: Firewall / Net Seg (editorial pick) |
| CE 2 | Secure Configuration | Editorial | CIS 4.1CIS 4.2CIS 4.3+7 | Same topic: Secure Config (editorial pick) |
| CE 3 | Security Update Management | Editorial | CIS 1.1CIS 1.2CIS 1.3+21 | Same topic: Asset Management (editorial pick) |
| CE 4 | User Access Control | Editorial | CIS 3.3CIS 5.1CIS 5.2+15 | Same topic: Access Control (editorial pick) |
| CE 5 | Malware protection | Editorial | CIS 2.5CIS 2.6CIS 2.7+7 | Same topic: Endpoint Protection (editorial pick) |
Of 153 CIS Controls v8.1 requirements, 70 map to something in Cyber Essentials, 18 are only loosely related, and 65 have no mapping in our data.
CIS's own published crosswalk covers 49 of 153 safeguards; ControlMapping mapped the rest editorially, with a reason for each, so check those links before relying on them.
Likely new work: CIS v8.1 requirements with no mapping to Cyber Essentials (65)
| CIS v8.1 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| 3. Data Protection · 10 | ||||
| CIS 3.1 | Establish and Maintain a Data Management Process | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.2 | Establish and Maintain a Data Inventory | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.4 | Enforce Data Retention | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.6 | Encrypt Data on End-User Devices | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.7 | Establish and Maintain a Data Classification Scheme | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.9 | Encrypt Data on Removable Media | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.10 | Encrypt Sensitive Data in Transit | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.11 | Encrypt Sensitive Data at Rest | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.13 | Deploy a Data Loss Prevention Solution | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 3.14 | Log Sensitive Data Access | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| 8. Audit Log Management · 11 | ||||
| CIS 8.1 | Establish and Maintain an Audit Log Management Process | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.2 | Collect Audit Logs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.3 | Ensure Adequate Audit Log Storage | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.4 | Standardize Time Synchronization | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.5 | Collect Detailed Audit Logs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.7 | Collect URL Request Audit Logs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.8 | Collect Command-Line Audit Logs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.9 | Centralize Audit Logs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.10 | Retain Audit Logs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.11 | Conduct Audit Log Reviews | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 8.12 | Collect Service Provider Logs | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| 11. Data Recovery · 5 | ||||
| CIS 11.1 | Establish and Maintain a Data Recovery Process | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 11.2 | Perform Automated Backups | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 11.3 | Protect Recovery Data | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 11.4 | Establish and Maintain an Isolated Instance of Recovery Data | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 11.5 | Test Data Recovery | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| 13. Network Monitoring and Defense · 6 | ||||
| CIS 13.1 | Centralize Security Event Alerting | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 13.2 | Deploy a Host-Based Intrusion Detection Solution | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 13.3 | Deploy a Network Intrusion Detection Solution | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 13.7 | Deploy a Host-Based Intrusion Prevention Solution | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 13.8 | Deploy a Network Intrusion Prevention Solution | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 13.11 | Tune Security Event Alerting Thresholds | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| 14. Security Awareness and Skills Training · 9 | ||||
| CIS 14.1 | Establish and Maintain a Security Awareness Program | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 14.2 | Train Workforce Members to Recognize Social Engineering Attacks | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 14.3 | Train Workforce Members on Authentication Best Practices | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 14.4 | Train Workforce on Data Handling Best Practices | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 14.5 | Train Workforce Members on Causes of Unintentional Data Exposure | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 14.6 | Train Workforce Members on Recognizing and Reporting Security Incidents | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 14.7 | Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 14.8 | Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 14.9 | Conduct Role-Specific Security Awareness and Skills Training | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| 15. Service Provider Management · 6 | ||||
| CIS 15.2 | Establish and Maintain a Service Provider Management Policy | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 15.3 | Classify Service Providers | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 15.4 | Ensure Service Provider Contracts Include Security Requirements | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 15.5 | Assess Service Providers | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 15.6 | Monitor Service Providers | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 15.7 | Securely Decommission Service Providers | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| 16. Application Software Security · 9 | ||||
| CIS 16.1 | Establish and Maintain a Secure Application Development Process | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 16.2 | Establish and Maintain a Process to Accept and Address Software Vulnerabilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 16.3 | Perform Root Cause Analysis on Security Vulnerabilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 16.5 | Use Up-to-Date and Trusted Third-Party Software Components | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 16.8 | Separate Production and Non-Production Systems | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 16.9 | Train Developers in Application Security Concepts and Secure Coding | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 16.11 | Leverage Vetted Modules or Services for Application Security Components | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 16.13 | Conduct Application Penetration Testing | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 16.14 | Conduct Threat Modeling | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| 17. Incident Response Management · 9 | ||||
| CIS 17.1 | Designate Personnel to Manage Incident Handling | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 17.2 | Establish and Maintain Contact Information for Reporting Security Incidents | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 17.4 | Establish and Maintain an Incident Response Process | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 17.5 | Assign Key Roles and Responsibilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 17.6 | Define Mechanisms for Communicating During Incident Response | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 17.7 | Conduct Routine Incident Response Exercises | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 17.8 | Conduct Post-Incident Reviews | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| CIS 17.9 | Establish and Maintain Security Incident Thresholds | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (18)
| CIS v8.1 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| 3. Data Protection · 3 | ||||
| CIS 3.5 | Securely Dispose of Data | CE 3 | Only shares CSF ID.AM-08: related, not a mapping | |
| CIS 3.8 | Document Data Flows | CE 1 | Only shares CSF ID.AM-03: related, not a mapping | |
| CIS 3.12 | Segment Data Processing and Storage Based on Sensitivity | CE 1CE 4 | Only shares CSF PR.IR-01: related, not a mapping | |
| 4. Secure Configuration of Enterprise Assets and Software · 1 | ||||
| CIS 4.9 | Configure Trusted DNS Servers on Enterprise Assets | CE 1CE 4 | Only shares CSF PR.IR-01: related, not a mapping | |
| 8. Audit Log Management · 1 | ||||
| CIS 8.6 | Collect DNS Query Audit Logs | CE 1CE 4 | Only shares CSF PR.IR-01: related, not a mapping | |
| 9. Email and Web Browser Protections · 7 | ||||
| CIS 9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 9.2 | Use DNS Filtering Services | CE 1CE 4 | Only shares CSF PR.IR-01: related, not a mapping | |
| CIS 9.3 | Maintain and Enforce Network-Based URL Filters | CE 1CE 4 | Only shares CSF PR.IR-01: related, not a mapping | |
| CIS 9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 9.5 | Implement DMARC | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 9.6 | Block Unnecessary File Types | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 9.7 | Deploy and Maintain Email Server Anti-Malware Protections | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| 12. Network Infrastructure Management · 1 | ||||
| CIS 12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | CE 4CE 1CE 2 | Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping | |
| 13. Network Monitoring and Defense · 3 | ||||
| CIS 13.5 | Manage Access Control for Remote Assets | CE 4CE 1CE 2 | Only shares CSF PR.AA-03, PR.AA-05, PR.IR-01: related, not a mapping | |
| CIS 13.6 | Collect Network Traffic Flow Logs | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 13.10 | Perform Application Layer Filtering | CE 1CE 4 | Only shares CSF PR.IR-01: related, not a mapping | |
| 16. Application Software Security · 2 | ||||
| CIS 16.10 | Apply Secure Design Principles in Application Architectures | CE 4CE 1 | Only shares CSF PR.AA-03, PR.IR-01: related, not a mapping | |
| CIS 16.12 | Implement Code-Level Security Checks | CE 4CE 1 | Only shares CSF PR.AA-03, PR.IR-01: related, not a mapping | |
Mapped (70)
| CIS v8.1 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| 1. Inventory and Control of Enterprise Assets · 5 | ||||
| CIS 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| CIS 1.2 | Address Unauthorized Assets | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| CIS 1.3 | Utilize an Active Discovery Tool | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| CIS 1.4 | Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| CIS 1.5 | Use a Passive Asset Discovery Tool | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| 2. Inventory and Control of Software Assets · 7 | ||||
| CIS 2.1 | Establish and Maintain a Software Inventory | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| CIS 2.2 | Ensure Authorized Software is Currently Supported | Editorial | CE 3 | Same topic: Patch Management (editorial pick) |
| CIS 2.3 | Address Unauthorized Software | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| CIS 2.4 | Utilize Automated Software Inventory Tools | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| CIS 2.5 | Allowlist Authorized Software | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CIS 2.6 | Allowlist Authorized Libraries | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CIS 2.7 | Allowlist Authorized Scripts | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| 3. Data Protection · 1 | ||||
| CIS 3.3 | Configure Data Access Control Lists | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| 4. Secure Configuration of Enterprise Assets and Software · 11 | ||||
| CIS 4.1 | Establish and Maintain a Secure Configuration Process | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CIS 4.2 | Establish and Maintain a Secure Configuration Process for Network Infrastructure | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CIS 4.3 | Configure Automatic Session Locking on Enterprise Assets | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CIS 4.4 | Implement and Manage a Firewall on Servers | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 4.5 | Implement and Manage a Firewall on End-User Devices | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 4.6 | Securely Manage Enterprise Assets and Software | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CIS 4.7 | Manage Default Accounts on Enterprise Assets and Software | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CIS 4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| CIS 4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | Editorial | CE 2 | Same topic: Mobile Security (editorial pick) |
| CIS 4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | Editorial | CE 2 | Same topic: Mobile Security (editorial pick) |
| CIS 4.12 | Separate Enterprise Workspaces on Mobile End-User Devices | Editorial | CE 2 | Same topic: Mobile Security (editorial pick) |
| 5. Account Management · 6 | ||||
| CIS 5.1 | Establish and Maintain an Inventory of Accounts | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 5.2 | Use Unique Passwords | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 5.3 | Disable Dormant Accounts | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | Editorial | CE 4 | Same topic: Privileged Access (editorial pick) |
| CIS 5.5 | Establish and Maintain an Inventory of Service Accounts | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 5.6 | Centralize Account Management | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| 6. Access Control Management · 8 | ||||
| CIS 6.1 | Establish an Access Granting Process | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 6.2 | Establish an Access Revoking Process | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 6.3 | Require MFA for Externally-Exposed Applications | Editorial | CE 4 | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.4 | Require MFA for Remote Network Access | Editorial | CE 4 | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.5 | Require MFA for Administrative Access | Editorial | CE 4 | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.6 | Establish and Maintain an Inventory of Authentication and Authorization Systems | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 6.7 | Centralize Access Control | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 6.8 | Define and Maintain Role-Based Access Control | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| 7. Continuous Vulnerability Management · 7 | ||||
| CIS 7.1 | Establish and Maintain a Vulnerability Management Process | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.2 | Establish and Maintain a Remediation Process | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.3 | Perform Automated Operating System Patch Management | Editorial | CE 3 | Same topic: Patch Management (editorial pick) |
| CIS 7.4 | Perform Automated Application Patch Management | Editorial | CE 3 | Same topic: Patch Management (editorial pick) |
| CIS 7.5 | Perform Automated Vulnerability Scans of Internal Enterprise Assets | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.6 | Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.7 | Remediate Detected Vulnerabilities | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| 10. Malware Defenses · 7 | ||||
| CIS 10.1 | Deploy and Maintain Anti-Malware Software | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.2 | Configure Automatic Anti-Malware Signature Updates | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.3 | Disable Autorun and Autoplay for Removable Media | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.4 | Configure Automatic Anti-Malware Scanning of Removable Media | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.5 | Enable Anti-Exploitation Features | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.6 | Centrally Manage Anti-Malware Software | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.7 | Use Behavior-Based Anti-Malware Software | Editorial | CE 5 | Same topic: Endpoint Protection (editorial pick) |
| 12. Network Infrastructure Management · 7 | ||||
| CIS 12.1 | Ensure Network Infrastructure is Up-to-Date | Editorial | CE 3 | Same topic: Patch Management (editorial pick) |
| CIS 12.2 | Establish and Maintain a Secure Network Architecture | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.3 | Securely Manage Network Infrastructure | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.4 | Establish and Maintain Architecture Diagram(s) | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.5 | Centralize Network Authentication, Authorization, and Auditing (AAA) | Editorial | CE 4 | Same topic: Access Control (editorial pick) |
| CIS 12.6 | Use of Secure Network Management and Communication Protocols | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | Editorial | CE 4 | Same topic: Privileged Access (editorial pick) |
| 13. Network Monitoring and Defense · 2 | ||||
| CIS 13.4 | Perform Traffic Filtering Between Network Segments | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 13.9 | Deploy Port-Level Access Control | Editorial | CE 1 | Same topic: Firewall / Net Seg (editorial pick) |
| 15. Service Provider Management · 1 | ||||
| CIS 15.1 | Establish and Maintain an Inventory of Service Providers | Editorial | CE 4 | Same topic: Cloud Security (editorial pick) |
| 16. Application Software Security · 3 | ||||
| CIS 16.4 | Establish and Manage an Inventory of Third-Party Software Components | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| CIS 16.6 | Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | Editorial | CE 2 | Same topic: Secure Config (editorial pick) |
| 18. Penetration Testing · 5 | ||||
| CIS 18.1 | Establish and Maintain a Penetration Testing Program | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.2 | Perform Periodic External Penetration Tests | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.3 | Remediate Penetration Test Findings | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.4 | Validate Security Measures | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.5 | Perform Periodic Internal Penetration Tests | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
By topic
Both cover (11):
Asset ManagementVulnerability MgmtAccess ControlMulti-Factor AuthPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigMobile SecurityCloud Security
Only CIS v8.1 (27):
Awareness & TrainingSupply Chain RiskData ClassificationEncryptionData ProtectionBackup & RecoverySecure DevelopmentEmail SecurityWeb SecurityZero TrustDNS SecurityWAFDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseCommunicationReportingRecovery PlanningLessons LearnedComms & RestoreDisaster RecoveryAPI SecurityVendor Risk Mgmt
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.