Establish and Maintain a Secure Network Architecture

frameworkCIS Controls v8.1 section12. Network Infrastructure Management csf 2.0PR.IR-01 topicsFirewall / Net Seg, Zero Trust frameworks6 3 2

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 12.2 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-03 PR.AA-03 PR.AA-04 PR.AA-05 PR.IR-01	Representations of the organization's authorized network communication and internal and external network data flows are maintained; Users, services, and hardware are authenticated…	Crosswalk	Same topic: Firewall / Net Seg, Zero Trust
ISO 27001	A.5.15 A.8.5 A.8.20 A.8.21 A.8.22	Access control; Secure authentication…	Crosswalk	Same topic: Zero Trust, Firewall / Net Seg 1 loosely related (not mappings) A.8.23 Web filtering Loosely related Only shares CSF PR.IR-01: related, not a mapping
SOC 2	CC6.6	Protection against threats from outside system boundaries	Editorial	Same topic: Firewall / Net Seg, Zero Trust (editorial pick) 1 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF PR.IR-01: related, not a mapping
PCI DSS	1.2.3 7.2.1 8.3.1 1.2.1 1.3.1 1.4.1	Accurate network diagram maintained; Access control model defined…	Crosswalk	Same topic: Firewall / Net Seg, Zero Trust 11 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.1 Anti-malware deployed on system components Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.2 Anti-malware detects, removes or contains known malware Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.3 Systems without anti-malware periodically re-evaluated Loosely related Only shares CSF PR.IR-01: related, not a mapping 5.2.3.1 Re-evaluation frequency set by targeted risk analysis Loosely related Only shares CSF PR.IR-01: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF PR.IR-01: related, not a mapping 11.2.1 Wireless access points detected and unauthorised ones handled Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 3 more in the downloads
CMMC	AC.L2-3.1.1 SC.L2-3.13.1 SC.L2-3.13.5 SC.L2-3.13.6	Authorized Access Control; Boundary Protection…	Crosswalk	Same topic: Zero Trust, Firewall / Net Seg 5 loosely related (not mappings) AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.IR-01: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.IR-01: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.IR-01: related, not a mapping SC.L2-3.13.3 Role Separation Loosely related Only shares CSF PR.IR-01: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.IR-01: related, not a mapping
800-53	AC-3 AC-4 AC-6 IA-2 SC-7	Access Enforcement; Information Flow Enforcement…	Crosswalk	Same topic: Zero Trust, Firewall / Net Seg 6 loosely related (not mappings) SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.IR-01: related, not a mapping SC-5 Denial-of-service Protection Loosely related Only shares CSF PR.IR-01: related, not a mapping SC-20 Secure Name/Address Resolution Service (Authoritative Source) Loosely related Only shares CSF PR.IR-01: related, not a mapping SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) Loosely related Only shares CSF PR.IR-01: related, not a mapping SC-22 Architecture and Provisioning for Name/Address Resolution Service Loosely related Only shares CSF PR.IR-01: related, not a mapping SI-10 Information Input Validation Loosely related Only shares CSF PR.IR-01: related, not a mapping
HIPAA	§164.308(a)(3)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B)§164.310(b)	Workforce Security; Authorization and/or Supervision…	Loosely related	No mapping. Only shares CSF PR.IR-01: related, not a mapping +3 more loosely related (not mappings) §164.312(a) Access Control Loosely related Only shares CSF PR.IR-01: related, not a mapping §164.312(a)(2)(i) Unique User Identification Loosely related Only shares CSF PR.IR-01: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Loosely related Only shares CSF PR.IR-01: related, not a mapping
GDPR	Art.28(1)	Processor	Loosely related	No mapping. Only shares CSF PR.IR-01: related, not a mapping
NIS2	6.7 6.8 11.1 11.6	Network security; Network segmentation…	Crosswalk	Same topic: Firewall / Net Seg, Zero Trust
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.9(4)(b)	Protection and prevention	Editorial	Same topic: Firewall / Net Seg (editorial pick) 2 loosely related (not mappings) Art.28(8) General principles Loosely related Only shares CSF PR.IR-01: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF PR.IR-01: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	CE 1	Firewalls	Editorial	Same topic: Firewall / Net Seg (editorial pick) 1 loosely related (not mappings) CE 4 User Access Control Loosely related Only shares CSF PR.IR-01: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.