Comparison
CIS v8.1 vs NIS2
CIS Controls v8.1 · NIS2 Implementing Regulation (EU) 2024/2690 · data 2026-10-27
Requirement-level comparison of CIS Controls v8.1 and NIS2 Implementing Regulation (EU) 2024/2690, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 34 map to something in CIS v8.1, 7 are only loosely related, and 8 have no mapping in our data.
NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.
Likely new work: NIS2 requirements with no mapping to CIS v8.1 (8)
| NIS2 | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| 2. Risk management policy · 2 | ||||
| 2.2 | Compliance monitoring | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| 2.3 | Independent review of information and network security | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| 6. Security in acquisition, development and maintenance · 1 | ||||
| 6.4 | Change management, repairs and maintenance | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | ||||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| 10. Human resources security · 1 | ||||
| 10.4 | Disciplinary process | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| 12. Asset management · 1 | ||||
| 12.5 | Deposit, return or deletion of assets upon termination of employment | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| 13. Environmental and physical security · 2 | ||||
| 13.2 | Protection against physical and environmental threats | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| 13.3 | Perimeter and physical access control | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (7)
| NIS2 | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | ||||
| 1.1 | Policy on the security of network and information systems | CIS 14.9CIS 14.2CIS 14.3+5 | Only shares CSF PR.AT-02: related, not a mapping | |
| 1.2 | Roles, responsibilities and authorities | CIS 14.9CIS 15.4CIS 14.2+5 | Only shares CSF GV.RR-02, PR.AT-02, GV.SC-02: related, not a mapping | |
| 2. Risk management policy · 1 | ||||
| 2.1 | Risk management framework | CIS 7.1CIS 7.5CIS 7.6+5 | Only shares CSF ID.RA-01: related, not a mapping | |
| 10. Human resources security · 3 | ||||
| 10.1 | Human resources security | CIS 6.1CIS 6.2CIS 14.9+5 | Only shares CSF GV.RR-04, PR.AT-02: related, not a mapping | |
| 10.2 | Verification of Background | CIS 6.1CIS 6.2 | Only shares CSF GV.RR-04: related, not a mapping | |
| 10.3 | Termination or change of employment procedures | CIS 6.1CIS 6.2 | Only shares CSF GV.RR-04: related, not a mapping | |
| 13. Environmental and physical security · 1 | ||||
| 13.1 | Supporting utilities | CIS 15.2CIS 15.6CIS 15.4+1 | Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping | |
Mapped (34)
| NIS2 | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| 3. Incident handling · 6 | ||||
| 3.1 | Incident handling policy | Crosswalk | CIS 17.4CIS 17.1CIS 17.5+2 | Same topic: Incident Response |
| 3.2 | Monitoring and logging | Crosswalk | CIS 8.2CIS 13.1CIS 3.14+15 | Same topic: Logging & Audit, Cont. Monitoring, SIEM / SOC |
| 3.3 | Event reporting | Editorial | CIS 17.3 | Same topic: Reporting (editorial pick) |
| 3.4 | Event assessment and classification | Crosswalk | CIS 8.11CIS 8.9CIS 13.1+1 | Same topic: Anomaly Detection, SIEM / SOC |
| 3.5 | Incident response | Crosswalk | CIS 17.4CIS 17.1CIS 17.5+2 | Same topic: Incident Response |
| 3.6 | Post-incident reviews | Editorial | CIS 17.8 | Same topic: Lessons Learned (editorial pick) |
| 4. Business continuity and crisis management · 3 | ||||
| 4.1 | Business continuity and disaster recovery plan | Editorial | CIS 11.1 | Same topic: Recovery Planning, Disaster Recovery (editorial pick) |
| 4.2 | Backup management | Crosswalk | CIS 11.2CIS 11.3CIS 11.5+2 | Same topic: Backup & Recovery |
| 4.3 | Crisis management | Crosswalk | CIS 17.2CIS 17.6 | Same topic: Communication, Comms & Restore |
| 5. Supply chain security · 2 | ||||
| 5.1 | Supply chain security policy | Crosswalk | CIS 15.1CIS 15.2CIS 15.3+4 | Same topic: Vendor Risk Mgmt, Supply Chain Risk |
| 5.2 | Directory of suppliers and service providers | Crosswalk | CIS 15.1CIS 15.3CIS 15.5+3 | Same topic: Vendor Risk Mgmt |
| 6. Security in acquisition, development and maintenance · 9 | ||||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Crosswalk | CIS 15.1CIS 15.2CIS 15.3+4 | Same topic: Cloud Security, Vendor Risk Mgmt, Supply Chain Risk |
| 6.2 | Secure development life cycle | Crosswalk | CIS 16.1CIS 16.2CIS 16.3+7 | Same topic: Secure Development |
| 6.3 | Configuration management | Crosswalk | CIS 4.1CIS 4.2CIS 4.3+4 | Same topic: Secure Config |
| 6.5 | Security testing | Crosswalk | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt |
| 6.6 | Security patch management | Crosswalk | CIS 2.2CIS 7.3CIS 7.4+1 | Same topic: Patch Management |
| 6.7 | Network security | Crosswalk | CIS 12.2CIS 4.4CIS 4.5+5 | Same topic: Firewall / Net Seg |
| 6.8 | Network segmentation | Crosswalk | CIS 6.8CIS 12.2CIS 4.4+8 | Same topic: Zero Trust, Firewall / Net Seg |
| 6.9 | Protection against malicious and unauthorised software | Crosswalk | CIS 2.5CIS 10.1CIS 2.6+12 | Same topic: Endpoint Protection |
| 6.10 | Vulnerability handling and disclosure | Crosswalk | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt |
| 8. Basic cyber hygiene practices and security training · 2 | ||||
| 8.1 | Awareness raising and basic cyber hygiene practices | Crosswalk | CIS 14.1CIS 14.9CIS 14.2+6 | Same topic: Awareness & Training |
| 8.2 | Security training | Crosswalk | CIS 14.1CIS 14.9CIS 14.2+6 | Same topic: Awareness & Training |
| 9. Cryptography · 1 | ||||
| 9.1 | Cryptography | Crosswalk | CIS 3.10CIS 3.11CIS 3.6+1 | Same topic: Encryption |
| 11. Access control · 7 | ||||
| 11.1 | Access control policy | Crosswalk | CIS 3.3CIS 5.1CIS 5.6+12 | Same topic: Access Control |
| 11.2 | Management of access rights | Crosswalk | CIS 3.3CIS 5.1CIS 5.6+9 | Same topic: Access Control |
| 11.3 | Privileged accounts and system administration accounts | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| 11.4 | Administration systems | Editorial | CIS 5.4CIS 12.8 | Same topic: Privileged Access (editorial pick) |
| 11.5 | Identification | Crosswalk | CIS 3.3CIS 5.1CIS 5.6+9 | Same topic: Access Control |
| 11.6 | Authentication | Crosswalk | CIS 6.8CIS 12.2CIS 6.3+4 | Same topic: Zero Trust, Multi-Factor Auth |
| 11.7 | Multi-factor authentication | Editorial | CIS 6.3CIS 6.4CIS 6.5 | Same topic: Multi-Factor Auth (editorial pick) |
| 12. Asset management · 4 | ||||
| 12.1 | Asset classification | Crosswalk | CIS 3.2CIS 3.7CIS 3.8 | Same topic: Data Classification |
| 12.2 | Handling of assets | Crosswalk | CIS 3.11CIS 3.1CIS 3.4+2 | Same topic: Data Protection |
| 12.3 | Removable media policy | Crosswalk | CIS 3.11CIS 3.1CIS 3.4+3 | Same topic: Data Protection |
| 12.4 | Asset inventory | Crosswalk | CIS 1.1CIS 2.1CIS 1.2+6 | Same topic: Asset Management |
Of 153 CIS Controls v8.1 requirements, 144 map to something in NIS2, 9 are only loosely related, and 0 have no mapping in our data.
CIS's own published crosswalk covers 49 of 153 safeguards; ControlMapping mapped the rest editorially, with a reason for each, so check those links before relying on them.
Check these: only loosely related (a shared CSF outcome, not a mapping) (9)
| CIS v8.1 | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| 4. Secure Configuration of Enterprise Assets and Software · 4 | ||||
| CIS 4.9 | Configure Trusted DNS Servers on Enterprise Assets | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| CIS 4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | 6.311.111.2+3 | Only shares CSF PR.PS-01, PR.AA-05: related, not a mapping | |
| CIS 4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | 6.311.111.2+3 | Only shares CSF PR.PS-01, PR.AA-05: related, not a mapping | |
| CIS 4.12 | Separate Enterprise Workspaces on Mobile End-User Devices | 6.311.111.2+3 | Only shares CSF PR.PS-01, PR.AA-05: related, not a mapping | |
| 8. Audit Log Management · 1 | ||||
| CIS 8.6 | Collect DNS Query Audit Logs | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| 9. Email and Web Browser Protections · 2 | ||||
| CIS 9.2 | Use DNS Filtering Services | 6.74.36.8+1 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| CIS 9.3 | Maintain and Enforce Network-Based URL Filters | 6.26.76.8 | Only shares CSF PR.PS-06, PR.IR-01: related, not a mapping | |
| 13. Network Monitoring and Defense · 1 | ||||
| CIS 13.10 | Perform Application Layer Filtering | 6.74.36.2+2 | Only shares CSF DE.CM-01, PR.IR-01, PR.PS-06: related, not a mapping | |
| 16. Application Software Security · 1 | ||||
| CIS 16.10 | Apply Secure Design Principles in Application Architectures | 6.26.76.8+2 | Only shares CSF PR.PS-06, PR.IR-01: related, not a mapping | |
Mapped (144)
| CIS v8.1 | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| 1. Inventory and Control of Enterprise Assets · 5 | ||||
| CIS 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory | Crosswalk | 12.4 | Same topic: Asset Management |
| CIS 1.2 | Address Unauthorized Assets | Editorial | 12.4 | Same topic: Asset Management (editorial pick) |
| CIS 1.3 | Utilize an Active Discovery Tool | Editorial | 12.4 | Same topic: Asset Management (editorial pick) |
| CIS 1.4 | Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory | Editorial | 12.4 | Same topic: Asset Management (editorial pick) |
| CIS 1.5 | Use a Passive Asset Discovery Tool | Editorial | 12.4 | Same topic: Asset Management (editorial pick) |
| 2. Inventory and Control of Software Assets · 7 | ||||
| CIS 2.1 | Establish and Maintain a Software Inventory | Crosswalk | 12.4 | Same topic: Asset Management |
| CIS 2.2 | Ensure Authorized Software is Currently Supported | Crosswalk | 6.6 | Same topic: Patch Management |
| CIS 2.3 | Address Unauthorized Software | Editorial | 12.4 | Same topic: Asset Management (editorial pick) |
| CIS 2.4 | Utilize Automated Software Inventory Tools | Editorial | 12.4 | Same topic: Asset Management (editorial pick) |
| CIS 2.5 | Allowlist Authorized Software | Crosswalk | 6.9 | Same topic: Endpoint Protection |
| CIS 2.6 | Allowlist Authorized Libraries | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| CIS 2.7 | Allowlist Authorized Scripts | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| 3. Data Protection · 14 | ||||
| CIS 3.1 | Establish and Maintain a Data Management Process | Editorial | 12.212.3 | Same topic: Data Protection (editorial pick) |
| CIS 3.2 | Establish and Maintain a Data Inventory | Crosswalk | 12.1 | Same topic: Data Classification |
| CIS 3.3 | Configure Data Access Control Lists | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| CIS 3.4 | Enforce Data Retention | Editorial | 12.212.3 | Same topic: Data Protection (editorial pick) |
| CIS 3.5 | Securely Dispose of Data | Editorial | 12.212.3 | Same topic: Data Protection (editorial pick) |
| CIS 3.6 | Encrypt Data on End-User Devices | Editorial | 9.1 | Same topic: Encryption (editorial pick) |
| CIS 3.7 | Establish and Maintain a Data Classification Scheme | Crosswalk | 12.1 | Same topic: Data Classification |
| CIS 3.8 | Document Data Flows | Editorial | 12.1 | Same topic: Data Classification (editorial pick) |
| CIS 3.9 | Encrypt Data on Removable Media | Editorial | 9.1 | Same topic: Encryption (editorial pick) |
| CIS 3.10 | Encrypt Sensitive Data in Transit | Crosswalk | 9.1 | Same topic: Encryption |
| CIS 3.11 | Encrypt Sensitive Data at Rest | Crosswalk | 9.112.212.3 | Same topic: Encryption, Data Protection |
| CIS 3.12 | Segment Data Processing and Storage Based on Sensitivity | Editorial | 12.212.3 | Same topic: Data Protection (editorial pick) |
| CIS 3.13 | Deploy a Data Loss Prevention Solution | Editorial | 12.3 | Same topic: DLP (editorial pick) |
| CIS 3.14 | Log Sensitive Data Access | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| 4. Secure Configuration of Enterprise Assets and Software · 8 | ||||
| CIS 4.1 | Establish and Maintain a Secure Configuration Process | Crosswalk | 6.3 | Same topic: Secure Config |
| CIS 4.2 | Establish and Maintain a Secure Configuration Process for Network Infrastructure | Crosswalk | 6.3 | Same topic: Secure Config |
| CIS 4.3 | Configure Automatic Session Locking on Enterprise Assets | Editorial | 6.3 | Same topic: Secure Config (editorial pick) |
| CIS 4.4 | Implement and Manage a Firewall on Servers | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 4.5 | Implement and Manage a Firewall on End-User Devices | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 4.6 | Securely Manage Enterprise Assets and Software | Editorial | 6.3 | Same topic: Secure Config (editorial pick) |
| CIS 4.7 | Manage Default Accounts on Enterprise Assets and Software | Editorial | 6.3 | Same topic: Secure Config (editorial pick) |
| CIS 4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | Editorial | 6.3 | Same topic: Secure Config (editorial pick) |
| 5. Account Management · 6 | ||||
| CIS 5.1 | Establish and Maintain an Inventory of Accounts | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| CIS 5.2 | Use Unique Passwords | Editorial | 11.111.211.5 | Same topic: Access Control (editorial pick) |
| CIS 5.3 | Disable Dormant Accounts | Editorial | 11.111.211.5 | Same topic: Access Control (editorial pick) |
| CIS 5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | Editorial | 11.311.4 | Same topic: Privileged Access (editorial pick) |
| CIS 5.5 | Establish and Maintain an Inventory of Service Accounts | Editorial | 11.111.211.5 | Same topic: Access Control (editorial pick) |
| CIS 5.6 | Centralize Account Management | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| 6. Access Control Management · 8 | ||||
| CIS 6.1 | Establish an Access Granting Process | Editorial | 11.111.211.5 | Same topic: Access Control (editorial pick) |
| CIS 6.2 | Establish an Access Revoking Process | Editorial | 11.111.211.5 | Same topic: Access Control (editorial pick) |
| CIS 6.3 | Require MFA for Externally-Exposed Applications | Editorial | 11.611.7 | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.4 | Require MFA for Remote Network Access | Editorial | 11.611.7 | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.5 | Require MFA for Administrative Access | Editorial | 11.611.7 | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.6 | Establish and Maintain an Inventory of Authentication and Authorization Systems | Editorial | 11.111.211.5 | Same topic: Access Control (editorial pick) |
| CIS 6.7 | Centralize Access Control | Crosswalk | 11.111.211.5 | Same topic: Access Control |
| CIS 6.8 | Define and Maintain Role-Based Access Control | Crosswalk | 6.811.111.2+2 | Same topic: Zero Trust, Access Control |
| 7. Continuous Vulnerability Management · 7 | ||||
| CIS 7.1 | Establish and Maintain a Vulnerability Management Process | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| CIS 7.2 | Establish and Maintain a Remediation Process | Crosswalk | 6.56.10 | Same topic: Vulnerability Mgmt |
| CIS 7.3 | Perform Automated Operating System Patch Management | Editorial | 6.6 | Same topic: Patch Management (editorial pick) |
| CIS 7.4 | Perform Automated Application Patch Management | Editorial | 6.6 | Same topic: Patch Management (editorial pick) |
| CIS 7.5 | Perform Automated Vulnerability Scans of Internal Enterprise Assets | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.6 | Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.7 | Remediate Detected Vulnerabilities | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| 8. Audit Log Management · 11 | ||||
| CIS 8.1 | Establish and Maintain an Audit Log Management Process | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.2 | Collect Audit Logs | Crosswalk | 3.2 | Same topic: Logging & Audit |
| CIS 8.3 | Ensure Adequate Audit Log Storage | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.4 | Standardize Time Synchronization | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.5 | Collect Detailed Audit Logs | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.7 | Collect URL Request Audit Logs | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.8 | Collect Command-Line Audit Logs | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.9 | Centralize Audit Logs | Editorial | 3.23.4 | Same topic: SIEM / SOC (editorial pick) |
| CIS 8.10 | Retain Audit Logs | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| CIS 8.11 | Conduct Audit Log Reviews | Crosswalk | 3.4 | Same topic: Anomaly Detection |
| CIS 8.12 | Collect Service Provider Logs | Editorial | 3.2 | Same topic: Logging & Audit (editorial pick) |
| 9. Email and Web Browser Protections · 5 | ||||
| CIS 9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | Editorial | 6.9 | Same topic: Email Security (editorial pick) |
| CIS 9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | Editorial | 6.9 | Same topic: Email Security (editorial pick) |
| CIS 9.5 | Implement DMARC | Editorial | 6.9 | Same topic: Email Security (editorial pick) |
| CIS 9.6 | Block Unnecessary File Types | Editorial | 6.9 | Same topic: Email Security (editorial pick) |
| CIS 9.7 | Deploy and Maintain Email Server Anti-Malware Protections | Editorial | 6.9 | Same topic: Email Security (editorial pick) |
| 10. Malware Defenses · 7 | ||||
| CIS 10.1 | Deploy and Maintain Anti-Malware Software | Crosswalk | 6.9 | Same topic: Endpoint Protection |
| CIS 10.2 | Configure Automatic Anti-Malware Signature Updates | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.3 | Disable Autorun and Autoplay for Removable Media | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.4 | Configure Automatic Anti-Malware Scanning of Removable Media | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.5 | Enable Anti-Exploitation Features | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.6 | Centrally Manage Anti-Malware Software | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| CIS 10.7 | Use Behavior-Based Anti-Malware Software | Editorial | 6.9 | Same topic: Endpoint Protection (editorial pick) |
| 11. Data Recovery · 5 | ||||
| CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | 4.14.2 | Same topic: Recovery Planning, Disaster Recovery (editorial pick) |
| CIS 11.2 | Perform Automated Backups | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| CIS 11.3 | Protect Recovery Data | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| CIS 11.4 | Establish and Maintain an Isolated Instance of Recovery Data | Editorial | 4.2 | Same topic: Backup & Recovery (editorial pick) |
| CIS 11.5 | Test Data Recovery | Crosswalk | 4.2 | Same topic: Backup & Recovery |
| 12. Network Infrastructure Management · 8 | ||||
| CIS 12.1 | Ensure Network Infrastructure is Up-to-Date | Editorial | 6.6 | Same topic: Patch Management (editorial pick) |
| CIS 12.2 | Establish and Maintain a Secure Network Architecture | Crosswalk | 6.76.811.1+1 | Same topic: Firewall / Net Seg, Zero Trust |
| CIS 12.3 | Securely Manage Network Infrastructure | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.4 | Establish and Maintain Architecture Diagram(s) | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.5 | Centralize Network Authentication, Authorization, and Auditing (AAA) | Editorial | 11.111.211.5 | Same topic: Access Control (editorial pick) |
| CIS 12.6 | Use of Secure Network Management and Communication Protocols | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | Editorial | 6.811.111.6 | Same topic: Zero Trust (editorial pick) |
| CIS 12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | Editorial | 11.311.4 | Same topic: Privileged Access (editorial pick) |
| 13. Network Monitoring and Defense · 10 | ||||
| CIS 13.1 | Centralize Security Event Alerting | Crosswalk | 3.23.4 | Same topic: Cont. Monitoring, SIEM / SOC |
| CIS 13.2 | Deploy a Host-Based Intrusion Detection Solution | Editorial | 3.2 | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.3 | Deploy a Network Intrusion Detection Solution | Editorial | 3.2 | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.4 | Perform Traffic Filtering Between Network Segments | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 13.5 | Manage Access Control for Remote Assets | Editorial | 6.811.111.6 | Same topic: Zero Trust (editorial pick) |
| CIS 13.6 | Collect Network Traffic Flow Logs | Editorial | 3.2 | Same topic: Cont. Monitoring (editorial pick) |
| CIS 13.7 | Deploy a Host-Based Intrusion Prevention Solution | Editorial | 3.2 | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.8 | Deploy a Network Intrusion Prevention Solution | Editorial | 3.2 | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.9 | Deploy Port-Level Access Control | Editorial | 6.76.8 | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 13.11 | Tune Security Event Alerting Thresholds | Editorial | 3.23.4 | Same topic: SIEM / SOC (editorial pick) |
| 14. Security Awareness and Skills Training · 9 | ||||
| CIS 14.1 | Establish and Maintain a Security Awareness Program | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| CIS 14.2 | Train Workforce Members to Recognize Social Engineering Attacks | Editorial | 8.18.2 | Same topic: Awareness & Training (editorial pick) |
| CIS 14.3 | Train Workforce Members on Authentication Best Practices | Editorial | 8.18.2 | Same topic: Awareness & Training (editorial pick) |
| CIS 14.4 | Train Workforce on Data Handling Best Practices | Editorial | 8.18.2 | Same topic: Awareness & Training (editorial pick) |
| CIS 14.5 | Train Workforce Members on Causes of Unintentional Data Exposure | Editorial | 8.18.2 | Same topic: Awareness & Training (editorial pick) |
| CIS 14.6 | Train Workforce Members on Recognizing and Reporting Security Incidents | Editorial | 8.18.2 | Same topic: Awareness & Training (editorial pick) |
| CIS 14.7 | Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates | Editorial | 8.18.2 | Same topic: Awareness & Training (editorial pick) |
| CIS 14.8 | Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks | Editorial | 8.18.2 | Same topic: Awareness & Training (editorial pick) |
| CIS 14.9 | Conduct Role-Specific Security Awareness and Skills Training | Crosswalk | 8.18.2 | Same topic: Awareness & Training |
| 15. Service Provider Management · 7 | ||||
| CIS 15.1 | Establish and Maintain an Inventory of Service Providers | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt, Cloud Security |
| CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Crosswalk | 5.16.1 | Same topic: Supply Chain Risk |
| CIS 15.3 | Classify Service Providers | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| CIS 15.4 | Ensure Service Provider Contracts Include Security Requirements | Editorial | 5.15.26.1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.5 | Assess Service Providers | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| CIS 15.6 | Monitor Service Providers | Crosswalk | 5.15.26.1 | Same topic: Vendor Risk Mgmt |
| CIS 15.7 | Securely Decommission Service Providers | Editorial | 5.15.26.1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| 16. Application Software Security · 13 | ||||
| CIS 16.1 | Establish and Maintain a Secure Application Development Process | Crosswalk | 6.2 | Same topic: Secure Development |
| CIS 16.2 | Establish and Maintain a Process to Accept and Address Software Vulnerabilities | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| CIS 16.3 | Perform Root Cause Analysis on Security Vulnerabilities | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| CIS 16.4 | Establish and Manage an Inventory of Third-Party Software Components | Editorial | 12.4 | Same topic: Asset Management (editorial pick) |
| CIS 16.5 | Use Up-to-Date and Trusted Third-Party Software Components | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| CIS 16.6 | Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | Editorial | 6.3 | Same topic: Secure Config (editorial pick) |
| CIS 16.8 | Separate Production and Non-Production Systems | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| CIS 16.9 | Train Developers in Application Security Concepts and Secure Coding | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| CIS 16.11 | Leverage Vetted Modules or Services for Application Security Components | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| CIS 16.12 | Implement Code-Level Security Checks | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| CIS 16.13 | Conduct Application Penetration Testing | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| CIS 16.14 | Conduct Threat Modeling | Editorial | 6.2 | Same topic: Secure Development (editorial pick) |
| 17. Incident Response Management · 9 | ||||
| CIS 17.1 | Designate Personnel to Manage Incident Handling | Editorial | 3.13.5 | Same topic: Incident Response (editorial pick) |
| CIS 17.2 | Establish and Maintain Contact Information for Reporting Security Incidents | Crosswalk | 4.3 | Same topic: Communication |
| CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | Editorial | 3.3 | Same topic: Reporting (editorial pick) |
| CIS 17.4 | Establish and Maintain an Incident Response Process | Crosswalk | 3.13.5 | Same topic: Incident Response |
| CIS 17.5 | Assign Key Roles and Responsibilities | Editorial | 3.13.5 | Same topic: Incident Response (editorial pick) |
| CIS 17.6 | Define Mechanisms for Communicating During Incident Response | Crosswalk | 4.3 | Same topic: Communication, Comms & Restore |
| CIS 17.7 | Conduct Routine Incident Response Exercises | Editorial | 3.13.5 | Same topic: Incident Response (editorial pick) |
| CIS 17.8 | Conduct Post-Incident Reviews | Editorial | 3.6 | Same topic: Lessons Learned (editorial pick) |
| CIS 17.9 | Establish and Maintain Security Incident Thresholds | Editorial | 3.13.5 | Same topic: Incident Response (editorial pick) |
| 18. Penetration Testing · 5 | ||||
| CIS 18.1 | Establish and Maintain a Penetration Testing Program | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.2 | Perform Periodic External Penetration Tests | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.3 | Remediate Penetration Test Findings | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.4 | Validate Security Measures | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.5 | Perform Periodic Internal Penetration Tests | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
By topic
Both cover (33):
Awareness & TrainingSupply Chain RiskAsset ManagementData ClassificationVulnerability MgmtAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityZero TrustCloud SecurityDLPCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseCommunicationReportingRecovery PlanningLessons LearnedComms & RestoreDisaster RecoveryVendor Risk Mgmt
Only CIS v8.1 (5):
Only NIS2 (10):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.