Comparison
CIS v8.1 vs Essential Eight
CIS Controls v8.1 · ASD Essential Eight · data 2026-10-27
Requirement-level comparison of CIS Controls v8.1 and ASD Essential Eight, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 126 ASD Essential Eight requirements, 57 map to something in CIS v8.1, 69 are only loosely related, and 0 have no mapping in our data.
Essential Eight here means the ISM controls ASD tags for Maturity Levels One to Three; each row shows its levels (ML1–ML3). ASD publishes no crosswalk to other frameworks, so every match is ControlMapping editorial.
Check these: only loosely related (a shared CSF outcome, not a mapping) (69)
| Essential Eight | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-0304 | ML3 Applications other than office productivity suites, web browsers and their extensions… | CIS 2.2CIS 2.3CIS 7.1+5 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1690 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… | CIS 2.2CIS 2.3CIS 7.1+5 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1692 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… | CIS 2.2CIS 2.3CIS 7.1+5 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1700 | ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… | CIS 2.2CIS 2.3CIS 7.1+5 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1901 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when… | CIS 2.2CIS 2.3CIS 7.1+5 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1905 | ML1, ML2, ML3 Online services that are no longer supported by vendors are removed | CIS 2.2CIS 2.3CIS 7.1+5 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| Patch operating systems · 10 | ||||
| ISM-1407 | ML3 The latest release, or the previous release, of operating systems are used | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1694 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1696 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1697 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1703 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1879 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release… | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1900 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1902 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of… | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1903 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release… | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| ISM-1904 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release… | CIS 1.2CIS 2.2CIS 2.3+5 | Only shares CSF PR.PS-03, PR.PS-02: related, not a mapping | |
| Multi-factor authentication · 9 | ||||
| ISM-1505 | ML3 Multi-factor authentication is used to authenticate human users of data repositories | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1680 | ML1, ML2, ML3 Multi-factor authentication (where available) is used to authenticate human users to… | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1681 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate customers to online customer… | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1682 | ML2, ML3 Multi-factor authentication used for authenticating human users of systems is… | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1873 | ML2 Multi-factor authentication used for authenticating customers of online customer services provides a… | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1874 | ML3 Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1892 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that… | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1893 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online customer services that process… | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1894 | ML3 Multi-factor authentication used for authenticating human users of data repositories is… | CIS 6.3CIS 6.4CIS 6.5+4 | Only shares CSF PR.AA-03: related, not a mapping | |
| Restrict administrative privileges · 11 | ||||
| ISM-1649 | ML3 Just-in-time administration is used for the administration of systems and their resources | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1650 | ML2, ML3 Privileged user account and security group management events are centrally logged | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1685 | ML2, ML3 Credentials for break glass accounts, local administrator accounts and service accounts… | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1686 | ML3 Credential Guard functionality is enabled | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1687 | ML2, ML3 Privileged operating environments are not virtualised within unprivileged operating… | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1688 | ML1, ML2, ML3 Unprivileged user accounts cannot be used to log on to privileged operating environments | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1689 | ML1, ML2, ML3 Privileged user accounts (excluding local administrator accounts) cannot be used to log… | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1861 | ML3 Local Security Authority protection functionality is enabled | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1883 | ML1, ML2, ML3 Privileged user accounts explicitly authorised to access online services are strictly… | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1897 | ML3 Remote Credential Guard functionality is enabled | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1898 | ML3 Secure Admin Workstations are used in the performance of administrative activities | CIS 3.3CIS 4.10CIS 4.11+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| Application control · 5 | ||||
| ISM-1582 | ML2, ML3 Application control rulesets are validated at least annually | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1656 | ML3 Application control is implemented on non-internet-facing servers | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1658 | ML3 Application control restricts the execution of drivers to an organisation-approved set | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1659 | ML3 Microsoft’s vulnerable driver blocklist is implemented | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1871 | ML2, ML3 Application control is applied to all locations other than user profiles and temporary… | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| Restrict Microsoft Office macros · 10 | ||||
| ISM-1487 | ML3 Only privileged human users responsible for checking that Microsoft Office macros are… | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1489 | ML1, ML2, ML3 Microsoft Office macro security settings cannot be changed by human users | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1671 | ML1, ML2, ML3 Microsoft Office macros are disabled for human users that do not have a demonstrated… | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1672 | ML1, ML2, ML3 Microsoft Office macro antivirus scanning is enabled | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1673 | ML2, ML3 Microsoft Office macros are blocked from making Win32 API calls | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1674 | ML3 Only Microsoft Office macros running from within a sandboxed environment, a Trusted… | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1675 | ML3 Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled… | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1676 | ML3 Microsoft Office’s list of trusted publishers is validated at least annually | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1890 | ML3 Microsoft Office macros are checked to ensure they are free of malicious code before… | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1891 | ML3 Microsoft Office macros digitally signed by signatures other than V3 signatures cannot… | CIS 2.5CIS 2.6CIS 2.7+5 | Only shares CSF PR.PS-05: related, not a mapping | |
| User application hardening · 13 | ||||
| ISM-1485 | ML1, ML2, ML3 Web browsers do not process web advertisements from the internet | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1486 | ML1, ML2, ML3 Web browsers do not process Java from the internet | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1542 | ML2, ML3 Microsoft Office is configured to prevent activation of Object Linking and Embedding… | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1622 | ML3 PowerShell is configured to use Constrained Language Mode | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1655 | ML3 .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1667 | ML2, ML3 Microsoft Office is blocked from creating child processes | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1668 | ML2, ML3 Microsoft Office is blocked from creating executable content | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1669 | ML2, ML3 Microsoft Office is blocked from injecting code into other processes | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1670 | ML2, ML3 PDF applications are blocked from creating child processes | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1823 | ML2, ML3 Office productivity suite security settings cannot be changed by human users | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1824 | ML2, ML3 PDF application security settings cannot be changed by human users | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1889 | ML2, ML3 Command line process creation events are centrally logged | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1896 | ML3 Memory integrity functionality is enabled | CIS 4.1CIS 4.2CIS 4.3+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| Regular backups · 5 | ||||
| ISM-1705 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) cannot access… | CIS 11.4CIS 11.5CIS 11.2+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1706 | ML3 Privileged user accounts (excluding backup administrator accounts) cannot access their… | CIS 11.4CIS 11.5CIS 11.2+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1708 | ML3 Backup administrator accounts are prevented from modifying and deleting backups during… | CIS 11.4CIS 11.5CIS 11.2+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1812 | ML1, ML2, ML3 Unprivileged user accounts cannot access backups belonging to other user accounts | CIS 11.4CIS 11.5CIS 11.2+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1813 | ML3 Unprivileged user accounts cannot access their own backups | CIS 11.4CIS 11.5CIS 11.2+1 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
Mapped (57)
| Essential Eight | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-1691 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release | Editorial | CIS 2.2CIS 7.3CIS 7.4+1 | Same topic: Patch Management (editorial pick) |
| ISM-1693 | ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in applications other… | Editorial | CIS 2.2CIS 7.3CIS 7.4+1 | Same topic: Patch Management (editorial pick) |
| ISM-1698 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1699 | ML1, ML2, ML3 A vulnerability scanner is used at least weekly to identify missing patches or updates… | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1704 | ML1, ML2, ML3 Office productivity suites, web browsers and their extensions, email clients, PDF… | Editorial | CIS 2.2CIS 7.3CIS 7.4+1 | Same topic: Patch Management (editorial pick) |
| ISM-1876 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of… | Editorial | CIS 2.2CIS 7.3CIS 7.4+1 | Same topic: Patch Management (editorial pick) |
| Patch applications & Patch operating systems · 2 | ||||
| ISM-1807 | ML1, ML2, ML3 An automated method of asset discovery is used at least fortnightly to support the… | Editorial | CIS 1.1CIS 1.2CIS 1.3+17 | Same topic: Asset Management (editorial pick) |
| ISM-1808 | ML1, ML2, ML3 A vulnerability scanner with an up-to-date vulnerability database is used for… | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Patch operating systems · 5 | ||||
| ISM-1501 | ML1, ML2, ML3 Operating systems that are no longer supported by vendors are replaced | Editorial | CIS 2.2CIS 7.3CIS 7.4+1 | Same topic: Patch Management (editorial pick) |
| ISM-1695 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release | Editorial | CIS 2.2CIS 7.3CIS 7.4+1 | Same topic: Patch Management (editorial pick) |
| ISM-1701 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1702 | ML1, ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1877 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours… | Editorial | CIS 2.2CIS 7.3CIS 7.4+1 | Same topic: Patch Management (editorial pick) |
| Multi-factor authentication · 7 | ||||
| ISM-0974 | ML2, ML3 Multi-factor authentication is used to authenticate unprivileged human users of systems | Editorial | CIS 6.3CIS 6.4CIS 6.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1173 | ML2, ML3 Multi-factor authentication is used to authenticate privileged human users of systems | Editorial | CIS 6.3CIS 6.4CIS 6.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1401 | ML1, ML2, ML3 Multi-factor authentication uses either: something people have and something people… | Editorial | CIS 6.3CIS 6.4CIS 6.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1504 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… | Editorial | CIS 6.3CIS 6.4CIS 6.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1679 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online services that process, store or… | Editorial | CIS 6.3CIS 6.4CIS 6.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1683 | ML2, ML3 Successful and unsuccessful multi-factor authentication events are centrally logged | Editorial | CIS 3.14CIS 8.1CIS 8.2+7 | Same topic: Logging & Audit (editorial pick) |
| ISM-1872 | ML2, ML3 Multi-factor authentication used for authenticating human users of online services is… | Editorial | CIS 6.3CIS 6.4CIS 6.5 | Same topic: Multi-Factor Auth (editorial pick) |
| Restrict administrative privileges · 9 | ||||
| ISM-0445 | ML1, ML2, ML3 Privileged human users are assigned a dedicated privileged user account to be used… | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| ISM-1175 | ML1, ML2, ML3 Privileged user accounts (excluding those explicitly authorised to access online… | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| ISM-1380 | ML1, ML2, ML3 Privileged human users use separate privileged and unprivileged operating environments | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| ISM-1387 | ML2, ML3 Administrative activities are conducted through jump servers | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| ISM-1507 | ML1, ML2, ML3 Requests for privileged access to systems and their resources are validated when first… | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| ISM-1508 | ML3 Privileged access to systems and their resources is limited to only what is required… | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| ISM-1509 | ML2, ML3 Privileged access events are centrally logged | Editorial | CIS 3.14CIS 8.1CIS 8.2+7 | Same topic: Logging & Audit (editorial pick) |
| ISM-1647 | ML2, ML3 Privileged access to systems and their resources are disabled after 12 months unless… | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| ISM-1648 | ML2, ML3 Privileged access to systems and their resources are disabled after 45 days of inactivity | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| Application control · 6 | ||||
| ISM-0843 | ML1, ML2, ML3 Application control is implemented on workstations | Editorial | CIS 2.5CIS 2.6CIS 2.7+7 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1490 | ML2, ML3 Application control is implemented on internet-facing servers | Editorial | CIS 2.5CIS 2.6CIS 2.7+7 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1544 | ML2, ML3 Microsoft’s recommended application blocklist is implemented | Editorial | CIS 2.5CIS 2.6CIS 2.7+7 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1657 | ML1, ML2, ML3 Application control restricts the execution of executables, libraries, scripts… | Editorial | CIS 2.5CIS 2.6CIS 2.7+7 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1660 | ML2, ML3 Allowed and blocked application control events are centrally logged | Editorial | CIS 3.14CIS 8.1CIS 8.2+7 | Same topic: Logging & Audit (editorial pick) |
| ISM-1870 | ML1, ML2, ML3 Application control is applied to user profiles and temporary folders used by operating… | Editorial | CIS 2.5CIS 2.6CIS 2.7+7 | Same topic: Endpoint Protection (editorial pick) |
| Restrict Microsoft Office macros · 1 | ||||
| ISM-1488 | ML1, ML2, ML3 Microsoft Office macros in files originating from the internet are blocked | Editorial | CIS 2.5CIS 2.6CIS 2.7+12 | Same topic: Endpoint Protection (editorial pick) |
| User application hardening · 7 | ||||
| ISM-1412 | ML2, ML3 Web browsers are hardened using ASD and vendor hardening guidance, with the most… | Editorial | CIS 4.1CIS 4.2CIS 4.3+4 | Same topic: Secure Config (editorial pick) |
| ISM-1585 | ML1, ML2, ML3 Web browser security settings cannot be changed by human users | Editorial | CIS 4.1CIS 4.2CIS 4.3+4 | Same topic: Secure Config (editorial pick) |
| ISM-1621 | ML3 Windows PowerShell 2.0 is disabled or removed | Editorial | CIS 4.1CIS 4.2CIS 4.3+4 | Same topic: Secure Config (editorial pick) |
| ISM-1623 | ML2, ML3 PowerShell module logging, script block logging and transcription events are centrally… | Editorial | CIS 3.14CIS 8.1CIS 8.2+7 | Same topic: Logging & Audit (editorial pick) |
| ISM-1654 | ML1, ML2, ML3 Internet Explorer 11 is disabled or removed | Editorial | CIS 4.1CIS 4.2CIS 4.3+4 | Same topic: Secure Config (editorial pick) |
| ISM-1859 | ML2, ML3 Office productivity suites are hardened using ASD and vendor hardening guidance, with… | Editorial | CIS 4.1CIS 4.2CIS 4.3+4 | Same topic: Secure Config (editorial pick) |
| ISM-1860 | ML2, ML3 PDF applications are hardened using ASD and vendor hardening guidance, with the most… | Editorial | CIS 4.1CIS 4.2CIS 4.3+4 | Same topic: Secure Config (editorial pick) |
| Regular backups · 6 | ||||
| ISM-1511 | ML1, ML2, ML3 Backups of data, applications and settings are performed and retained in accordance… | Editorial | CIS 11.2CIS 11.3CIS 11.4+1 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1515 | ML1, ML2, ML3 Restoration of data, applications and settings from backups to a common point in time… | Editorial | CIS 11.1CIS 11.2CIS 11.3+2 | Same topic: Disaster Recovery, Backup & Recovery (editorial pick) |
| ISM-1707 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) are prevented from… | Editorial | CIS 11.2CIS 11.3CIS 11.4+1 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1810 | ML1, ML2, ML3 Backups of data, applications and settings are synchronised to enable restoration to a… | Editorial | CIS 11.2CIS 11.3CIS 11.4+1 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1811 | ML1, ML2, ML3 Backups of data, applications and settings are retained in a secure and resilient manner | Editorial | CIS 11.2CIS 11.3CIS 11.4+1 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1814 | ML1, ML2, ML3 Unprivileged user accounts are prevented from modifying and deleting backups | Editorial | CIS 11.2CIS 11.3CIS 11.4+1 | Same topic: Backup & Recovery (editorial pick) |
| Logging and incident response (all strategies) · 8 | ||||
| ISM-0109 | ML3 Event logs from workstations are analysed in a timely manner to detect cyber security… | Editorial | CIS 13.1CIS 13.6 | Same topic: Cont. Monitoring (editorial pick) |
| ISM-0123 | ML2, ML3 Cyber security incidents are reported to the chief information security officer, or one… | Editorial | CIS 17.3 | Same topic: Reporting (editorial pick) |
| ISM-0140 | ML2, ML3 Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | CIS 17.3 | Same topic: Reporting (editorial pick) |
| ISM-1228 | ML2, ML3 Cyber security events are analysed in a timely manner to identify cyber security incidents | Editorial | CIS 8.9CIS 8.11CIS 13.1+1 | Same topic: SIEM / SOC, Anomaly Detection (editorial pick) |
| ISM-1815 | ML2, ML3 Event logs are protected from unauthorised modification and deletion | Editorial | CIS 3.14CIS 8.1CIS 8.2+7 | Same topic: Logging & Audit (editorial pick) |
| ISM-1819 | ML2, ML3 Following the identification of a cyber security incident, the cyber security incident… | Editorial | CIS 17.1CIS 17.4CIS 17.5+2 | Same topic: Incident Response (editorial pick) |
| ISM-1906 | ML2, ML3 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… | Editorial | CIS 8.9CIS 13.1CIS 13.6+1 | Same topic: SIEM / SOC, Cont. Monitoring (editorial pick) |
| ISM-1907 | ML3 Event logs from non-internet-facing servers are analysed in a timely manner to detect… | Editorial | CIS 13.1CIS 13.6 | Same topic: Cont. Monitoring (editorial pick) |
Of 153 CIS Controls v8.1 requirements, 77 map to something in Essential Eight, 35 are only loosely related, and 41 have no mapping in our data.
CIS's own published crosswalk covers 49 of 153 safeguards; ControlMapping mapped the rest editorially, with a reason for each, so check those links before relying on them.
Likely new work: CIS v8.1 requirements with no mapping to Essential Eight (41)
| CIS v8.1 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| 3. Data Protection · 4 | ||||
| CIS 3.2 | Establish and Maintain a Data Inventory | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 3.7 | Establish and Maintain a Data Classification Scheme | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 3.8 | Document Data Flows | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 3.11 | Encrypt Sensitive Data at Rest | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 4. Secure Configuration of Enterprise Assets and Software · 2 | ||||
| CIS 4.4 | Implement and Manage a Firewall on Servers | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 4.5 | Implement and Manage a Firewall on End-User Devices | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 5. Account Management · 1 | ||||
| CIS 5.6 | Centralize Account Management | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 6. Access Control Management · 1 | ||||
| CIS 6.7 | Centralize Access Control | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 9. Email and Web Browser Protections · 1 | ||||
| CIS 9.3 | Maintain and Enforce Network-Based URL Filters | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 12. Network Infrastructure Management · 4 | ||||
| CIS 12.2 | Establish and Maintain a Secure Network Architecture | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 12.3 | Securely Manage Network Infrastructure | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 12.4 | Establish and Maintain Architecture Diagram(s) | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 12.6 | Use of Secure Network Management and Communication Protocols | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 13. Network Monitoring and Defense · 2 | ||||
| CIS 13.4 | Perform Traffic Filtering Between Network Segments | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 13.9 | Deploy Port-Level Access Control | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 14. Security Awareness and Skills Training · 9 | ||||
| CIS 14.1 | Establish and Maintain a Security Awareness Program | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 14.2 | Train Workforce Members to Recognize Social Engineering Attacks | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 14.3 | Train Workforce Members on Authentication Best Practices | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 14.4 | Train Workforce on Data Handling Best Practices | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 14.5 | Train Workforce Members on Causes of Unintentional Data Exposure | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 14.6 | Train Workforce Members on Recognizing and Reporting Security Incidents | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 14.7 | Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 14.8 | Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 14.9 | Conduct Role-Specific Security Awareness and Skills Training | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 15. Service Provider Management · 6 | ||||
| CIS 15.2 | Establish and Maintain a Service Provider Management Policy | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 15.3 | Classify Service Providers | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 15.4 | Ensure Service Provider Contracts Include Security Requirements | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 15.5 | Assess Service Providers | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 15.6 | Monitor Service Providers | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 15.7 | Securely Decommission Service Providers | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 16. Application Software Security · 9 | ||||
| CIS 16.1 | Establish and Maintain a Secure Application Development Process | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 16.2 | Establish and Maintain a Process to Accept and Address Software Vulnerabilities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 16.3 | Perform Root Cause Analysis on Security Vulnerabilities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 16.5 | Use Up-to-Date and Trusted Third-Party Software Components | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 16.8 | Separate Production and Non-Production Systems | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 16.9 | Train Developers in Application Security Concepts and Secure Coding | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 16.11 | Leverage Vetted Modules or Services for Application Security Components | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 16.13 | Conduct Application Penetration Testing | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 16.14 | Conduct Threat Modeling | No mapping in our data | — | No mapping to Essential Eight in our data. |
| 17. Incident Response Management · 2 | ||||
| CIS 17.6 | Define Mechanisms for Communicating During Incident Response | No mapping in our data | — | No mapping to Essential Eight in our data. |
| CIS 17.8 | Conduct Post-Incident Reviews | No mapping in our data | — | No mapping to Essential Eight in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (35)
| CIS v8.1 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| 3. Data Protection · 9 | ||||
| CIS 3.1 | Establish and Maintain a Data Management Process | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 3.3 | Configure Data Access Control Lists | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 3.4 | Enforce Data Retention | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 3.5 | Securely Dispose of Data | ISM-1488ISM-1807 | Only shares CSF PR.DS-02, ID.AM-08: related, not a mapping | |
| CIS 3.6 | Encrypt Data on End-User Devices | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 3.9 | Encrypt Data on Removable Media | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 3.10 | Encrypt Sensitive Data in Transit | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 3.12 | Segment Data Processing and Storage Based on Sensitivity | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| CIS 3.13 | Deploy a Data Loss Prevention Solution | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| 4. Secure Configuration of Enterprise Assets and Software · 4 | ||||
| CIS 4.9 | Configure Trusted DNS Servers on Enterprise Assets | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| CIS 4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 4.12 | Separate Enterprise Workspaces on Mobile End-User Devices | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 5. Account Management · 4 | ||||
| CIS 5.1 | Establish and Maintain an Inventory of Accounts | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 5.2 | Use Unique Passwords | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 5.3 | Disable Dormant Accounts | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 5.5 | Establish and Maintain an Inventory of Service Accounts | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 6. Access Control Management · 4 | ||||
| CIS 6.1 | Establish an Access Granting Process | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 6.2 | Establish an Access Revoking Process | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 6.6 | Establish and Maintain an Inventory of Authentication and Authorization Systems | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 6.8 | Define and Maintain Role-Based Access Control | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| 8. Audit Log Management · 1 | ||||
| CIS 8.6 | Collect DNS Query Audit Logs | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| 9. Email and Web Browser Protections · 1 | ||||
| CIS 9.2 | Use DNS Filtering Services | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| 12. Network Infrastructure Management · 2 | ||||
| CIS 12.5 | Centralize Network Authentication, Authorization, and Auditing (AAA) | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| CIS 12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | ISM-0445ISM-0974ISM-1173+5 | Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping | |
| 13. Network Monitoring and Defense · 6 | ||||
| CIS 13.2 | Deploy a Host-Based Intrusion Detection Solution | ISM-0109ISM-1906ISM-1907+1 | Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping | |
| CIS 13.3 | Deploy a Network Intrusion Detection Solution | ISM-0109ISM-1906ISM-1907+1 | Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping | |
| CIS 13.5 | Manage Access Control for Remote Assets | ISM-0445ISM-0974ISM-1173+5 | Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping | |
| CIS 13.7 | Deploy a Host-Based Intrusion Prevention Solution | ISM-0109ISM-1906ISM-1907+1 | Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping | |
| CIS 13.8 | Deploy a Network Intrusion Prevention Solution | ISM-0109ISM-1906ISM-1907+1 | Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping | |
| CIS 13.10 | Perform Application Layer Filtering | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-01: related, not a mapping | |
| 15. Service Provider Management · 1 | ||||
| CIS 15.1 | Establish and Maintain an Inventory of Service Providers | ISM-1807 | Only shares CSF ID.AM-04: related, not a mapping | |
| 16. Application Software Security · 2 | ||||
| CIS 16.10 | Apply Secure Design Principles in Application Architectures | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| CIS 16.12 | Implement Code-Level Security Checks | ISM-0974ISM-1173ISM-1401+5 | Only shares CSF PR.AA-03: related, not a mapping | |
| 17. Incident Response Management · 1 | ||||
| CIS 17.2 | Establish and Maintain Contact Information for Reporting Security Incidents | ISM-0123ISM-0140 | Only shares CSF RS.CO-02: related, not a mapping | |
Mapped (77)
| CIS v8.1 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| 1. Inventory and Control of Enterprise Assets · 5 | ||||
| CIS 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CIS 1.2 | Address Unauthorized Assets | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CIS 1.3 | Utilize an Active Discovery Tool | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CIS 1.4 | Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CIS 1.5 | Use a Passive Asset Discovery Tool | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| 2. Inventory and Control of Software Assets · 7 | ||||
| CIS 2.1 | Establish and Maintain a Software Inventory | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CIS 2.2 | Ensure Authorized Software is Currently Supported | Editorial | ISM-1501ISM-1691ISM-1693+4 | Same topic: Patch Management (editorial pick) |
| CIS 2.3 | Address Unauthorized Software | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CIS 2.4 | Utilize Automated Software Inventory Tools | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CIS 2.5 | Allowlist Authorized Software | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| CIS 2.6 | Allowlist Authorized Libraries | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| CIS 2.7 | Allowlist Authorized Scripts | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| 3. Data Protection · 1 | ||||
| CIS 3.14 | Log Sensitive Data Access | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| 4. Secure Configuration of Enterprise Assets and Software · 6 | ||||
| CIS 4.1 | Establish and Maintain a Secure Configuration Process | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| CIS 4.2 | Establish and Maintain a Secure Configuration Process for Network Infrastructure | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| CIS 4.3 | Configure Automatic Session Locking on Enterprise Assets | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| CIS 4.6 | Securely Manage Enterprise Assets and Software | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| CIS 4.7 | Manage Default Accounts on Enterprise Assets and Software | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| CIS 4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| 5. Account Management · 1 | ||||
| CIS 5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | Editorial | ISM-0445ISM-1175ISM-1380+5 | Same topic: Privileged Access (editorial pick) |
| 6. Access Control Management · 3 | ||||
| CIS 6.3 | Require MFA for Externally-Exposed Applications | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.4 | Require MFA for Remote Network Access | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.5 | Require MFA for Administrative Access | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| 7. Continuous Vulnerability Management · 7 | ||||
| CIS 7.1 | Establish and Maintain a Vulnerability Management Process | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.2 | Establish and Maintain a Remediation Process | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.3 | Perform Automated Operating System Patch Management | Editorial | ISM-1501ISM-1691ISM-1693+4 | Same topic: Patch Management (editorial pick) |
| CIS 7.4 | Perform Automated Application Patch Management | Editorial | ISM-1501ISM-1691ISM-1693+4 | Same topic: Patch Management (editorial pick) |
| CIS 7.5 | Perform Automated Vulnerability Scans of Internal Enterprise Assets | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.6 | Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.7 | Remediate Detected Vulnerabilities | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| 8. Audit Log Management · 11 | ||||
| CIS 8.1 | Establish and Maintain an Audit Log Management Process | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.2 | Collect Audit Logs | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.3 | Ensure Adequate Audit Log Storage | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.4 | Standardize Time Synchronization | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.5 | Collect Detailed Audit Logs | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.7 | Collect URL Request Audit Logs | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.8 | Collect Command-Line Audit Logs | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.9 | Centralize Audit Logs | Editorial | ISM-1228ISM-1906 | Same topic: SIEM / SOC (editorial pick) |
| CIS 8.10 | Retain Audit Logs | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.11 | Conduct Audit Log Reviews | Editorial | ISM-1228 | Same topic: Anomaly Detection (editorial pick) |
| CIS 8.12 | Collect Service Provider Logs | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| 9. Email and Web Browser Protections · 5 | ||||
| CIS 9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
| CIS 9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
| CIS 9.5 | Implement DMARC | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
| CIS 9.6 | Block Unnecessary File Types | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
| CIS 9.7 | Deploy and Maintain Email Server Anti-Malware Protections | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
| 10. Malware Defenses · 7 | ||||
| CIS 10.1 | Deploy and Maintain Anti-Malware Software | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.2 | Configure Automatic Anti-Malware Signature Updates | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.3 | Disable Autorun and Autoplay for Removable Media | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.4 | Configure Automatic Anti-Malware Scanning of Removable Media | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.5 | Enable Anti-Exploitation Features | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.6 | Centrally Manage Anti-Malware Software | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.7 | Use Behavior-Based Anti-Malware Software | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| 11. Data Recovery · 5 | ||||
| CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| CIS 11.2 | Perform Automated Backups | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| CIS 11.3 | Protect Recovery Data | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| CIS 11.4 | Establish and Maintain an Isolated Instance of Recovery Data | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| CIS 11.5 | Test Data Recovery | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| 12. Network Infrastructure Management · 2 | ||||
| CIS 12.1 | Ensure Network Infrastructure is Up-to-Date | Editorial | ISM-1501ISM-1691ISM-1693+4 | Same topic: Patch Management (editorial pick) |
| CIS 12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | Editorial | ISM-0445ISM-1175ISM-1380+5 | Same topic: Privileged Access (editorial pick) |
| 13. Network Monitoring and Defense · 3 | ||||
| CIS 13.1 | Centralize Security Event Alerting | Editorial | ISM-0109ISM-1228ISM-1906+1 | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick) |
| CIS 13.6 | Collect Network Traffic Flow Logs | Editorial | ISM-0109ISM-1906ISM-1907 | Same topic: Cont. Monitoring (editorial pick) |
| CIS 13.11 | Tune Security Event Alerting Thresholds | Editorial | ISM-1228ISM-1906 | Same topic: SIEM / SOC (editorial pick) |
| 16. Application Software Security · 3 | ||||
| CIS 16.4 | Establish and Manage an Inventory of Third-Party Software Components | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| CIS 16.6 | Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| 17. Incident Response Management · 6 | ||||
| CIS 17.1 | Designate Personnel to Manage Incident Handling | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | Editorial | ISM-0123ISM-0140 | Same topic: Reporting (editorial pick) |
| CIS 17.4 | Establish and Maintain an Incident Response Process | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| CIS 17.5 | Assign Key Roles and Responsibilities | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| CIS 17.7 | Conduct Routine Incident Response Exercises | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| CIS 17.9 | Establish and Maintain Security Incident Thresholds | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| 18. Penetration Testing · 5 | ||||
| CIS 18.1 | Establish and Maintain a Penetration Testing Program | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.2 | Perform Periodic External Penetration Tests | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.3 | Remediate Penetration Test Findings | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.4 | Validate Security Measures | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.5 | Perform Periodic Internal Penetration Tests | Editorial | ISM-1698ISM-1699ISM-1701+3 | Same topic: Vulnerability Mgmt (editorial pick) |
By topic
Both cover (16):
Asset ManagementVulnerability MgmtMulti-Factor AuthBackup & RecoveryPrivileged AccessEndpoint ProtectionPatch ManagementSecure ConfigEmail SecurityCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCIncident ResponseReportingDisaster Recovery
Only CIS v8.1 (22):
Awareness & TrainingSupply Chain RiskData ClassificationAccess ControlEncryptionData ProtectionFirewall / Net SegSecure DevelopmentWeb SecurityZero TrustMobile SecurityCloud SecurityDNS SecurityWAFDLPIntrusion DetectionCommunicationRecovery PlanningLessons LearnedComms & RestoreAPI SecurityVendor Risk Mgmt
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.