框架
CIS Controls v8.1
概述
互联网安全中心（Center for Internet Security）制定的优先级控制集，包含 18 项控制措施和 153 项保障措施，分为三个实施组（IG1 至 IG3）。IG1 是“基础网络卫生”基线。8.1 版（2024 年）使控制措施与 NIST CSF 2.0 的治理（Govern）功能保持一致。
适用人群
适用于希望获得规范化、有优先级的技术基线的组织，尤其是从 IG1 起步的中小型组织。
评估方式
不提供认证。组织可自行评估，通常使用 CIS 自有的评估工具，或聘请第三方评估机构。
153
保障措施
153
映射到其他框架
76%
已覆盖主题（38/50）
CIS 自己发布的对照表覆盖 153 项安全措施中的 49 项；ControlMapping 对其余各项进行了编辑映射，并为每项提供理由，因此请在依赖这些关联前先核对。
对比分析
要求
要求编号和标题均按各框架官方发布的英文原文显示。
| ID | 要求 | 主题 | 映射于 |
|---|---|---|---|
| 1. Inventory and Control of Enterprise Assets · 5 | |||
| CIS 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory | 资产管理 | 13 / 13 |
| CIS 1.2 | Address Unauthorized Assets | 资产管理 | 13 / 13 |
| CIS 1.3 | Utilize an Active Discovery Tool | 资产管理 | 13 / 13 |
| CIS 1.4 | Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory | 资产管理 | 13 / 13 |
| CIS 1.5 | Use a Passive Asset Discovery Tool | 资产管理 | 13 / 13 |
| 2. Inventory and Control of Software Assets · 7 | |||
| CIS 2.1 | Establish and Maintain a Software Inventory | 资产管理 | 13 / 13 |
| CIS 2.2 | Ensure Authorized Software is Currently Supported | 补丁管理 | 10 / 13 |
| CIS 2.3 | Address Unauthorized Software | 资产管理 | 13 / 13 |
| CIS 2.4 | Utilize Automated Software Inventory Tools | 资产管理 | 13 / 13 |
| CIS 2.5 | Allowlist Authorized Software | 终端防护 | 10 / 13 |
| CIS 2.6 | Allowlist Authorized Libraries | 终端防护 | 10 / 13 |
| CIS 2.7 | Allowlist Authorized Scripts | 终端防护 | 10 / 13 |
| 3. Data Protection · 14 | |||
| CIS 3.1 | Establish and Maintain a Data Management Process | 数据保护 | 11 / 13 |
| CIS 3.2 | Establish and Maintain a Data Inventory | 数据分类 | 9 / 13 |
| CIS 3.3 | Configure Data Access Control Lists | 访问控制 | 11 / 13 |
| CIS 3.4 | Enforce Data Retention | 数据保护 | 11 / 13 |
| CIS 3.5 | Securely Dispose of Data | 数据保护 | 11 / 13 |
| CIS 3.6 | Encrypt Data on End-User Devices | 加密 | 10 / 13 |
| CIS 3.7 | Establish and Maintain a Data Classification Scheme | 数据分类 | 9 / 13 |
| CIS 3.8 | Document Data Flows | 数据分类 | 9 / 13 |
| CIS 3.9 | Encrypt Data on Removable Media | 加密 | 10 / 13 |
| CIS 3.10 | Encrypt Sensitive Data in Transit | 加密 | 10 / 13 |
| CIS 3.11 | Encrypt Sensitive Data at Rest | 加密, 数据保护 | 11 / 13 |
| CIS 3.12 | Segment Data Processing and Storage Based on Sensitivity | 数据保护 | 11 / 13 |
| CIS 3.13 | Deploy a Data Loss Prevention Solution | DLP | 7 / 13 |
| CIS 3.14 | Log Sensitive Data Access | 日志与审计 | 10 / 13 |
| 4. Secure Configuration of Enterprise Assets and Software · 12 | |||
| CIS 4.1 | Establish and Maintain a Secure Configuration Process | 安全配置 | 9 / 13 |
| CIS 4.2 | Establish and Maintain a Secure Configuration Process for Network Infrastructure | 安全配置 | 9 / 13 |
| CIS 4.3 | Configure Automatic Session Locking on Enterprise Assets | 安全配置 | 9 / 13 |
| CIS 4.4 | Implement and Manage a Firewall on Servers | 防火墙 / 网络分段 | 9 / 13 |
| CIS 4.5 | Implement and Manage a Firewall on End-User Devices | 防火墙 / 网络分段 | 9 / 13 |
| CIS 4.6 | Securely Manage Enterprise Assets and Software | 安全配置 | 9 / 13 |
| CIS 4.7 | Manage Default Accounts on Enterprise Assets and Software | 安全配置 | 9 / 13 |
| CIS 4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | 安全配置 | 9 / 13 |
| CIS 4.9 | Configure Trusted DNS Servers on Enterprise Assets | DNS 安全 | 3 / 13 |
| CIS 4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | 移动安全 | 7 / 13 |
| CIS 4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | 移动安全 | 7 / 13 |
| CIS 4.12 | Separate Enterprise Workspaces on Mobile End-User Devices | 移动安全 | 7 / 13 |
| 5. Account Management · 6 | |||
| CIS 5.1 | Establish and Maintain an Inventory of Accounts | 访问控制 | 11 / 13 |
| CIS 5.2 | Use Unique Passwords | 访问控制 | 11 / 13 |
| CIS 5.3 | Disable Dormant Accounts | 访问控制 | 11 / 13 |
| CIS 5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | 特权访问 | 10 / 13 |
| CIS 5.5 | Establish and Maintain an Inventory of Service Accounts | 访问控制 | 11 / 13 |
| CIS 5.6 | Centralize Account Management | 访问控制 | 11 / 13 |
| 6. Access Control Management · 8 | |||
| CIS 6.1 | Establish an Access Granting Process | 访问控制 | 11 / 13 |
| CIS 6.2 | Establish an Access Revoking Process | 访问控制 | 11 / 13 |
| CIS 6.3 | Require MFA for Externally-Exposed Applications | 多因素认证 | 10 / 13 |
| CIS 6.4 | Require MFA for Remote Network Access | 多因素认证 | 10 / 13 |
| CIS 6.5 | Require MFA for Administrative Access | 多因素认证 | 10 / 13 |
| CIS 6.6 | Establish and Maintain an Inventory of Authentication and Authorization Systems | 访问控制 | 11 / 13 |
| CIS 6.7 | Centralize Access Control | 访问控制 | 11 / 13 |
| CIS 6.8 | Define and Maintain Role-Based Access Control | 访问控制, 零信任 | 11 / 13 |
| 7. Continuous Vulnerability Management · 7 | |||
| CIS 7.1 | Establish and Maintain a Vulnerability Management Process | 漏洞管理 | 13 / 13 |
| CIS 7.2 | Establish and Maintain a Remediation Process | 漏洞管理 | 13 / 13 |
| CIS 7.3 | Perform Automated Operating System Patch Management | 补丁管理 | 10 / 13 |
| CIS 7.4 | Perform Automated Application Patch Management | 补丁管理 | 10 / 13 |
| CIS 7.5 | Perform Automated Vulnerability Scans of Internal Enterprise Assets | 漏洞管理 | 13 / 13 |
| CIS 7.6 | Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets | 漏洞管理 | 13 / 13 |
| CIS 7.7 | Remediate Detected Vulnerabilities | 漏洞管理 | 13 / 13 |
| 8. Audit Log Management · 12 | |||
| CIS 8.1 | Establish and Maintain an Audit Log Management Process | 日志与审计 | 10 / 13 |
| CIS 8.2 | Collect Audit Logs | 日志与审计 | 10 / 13 |
| CIS 8.3 | Ensure Adequate Audit Log Storage | 日志与审计 | 10 / 13 |
| CIS 8.4 | Standardize Time Synchronization | 日志与审计 | 10 / 13 |
| CIS 8.5 | Collect Detailed Audit Logs | 日志与审计 | 10 / 13 |
| CIS 8.6 | Collect DNS Query Audit Logs | DNS 安全 | 3 / 13 |
| CIS 8.7 | Collect URL Request Audit Logs | 日志与审计 | 10 / 13 |
| CIS 8.8 | Collect Command-Line Audit Logs | 日志与审计 | 10 / 13 |
| CIS 8.9 | Centralize Audit Logs | SIEM / SOC | 10 / 13 |
| CIS 8.10 | Retain Audit Logs | 日志与审计 | 10 / 13 |
| CIS 8.11 | Conduct Audit Log Reviews | 异常检测 | 9 / 13 |
| CIS 8.12 | Collect Service Provider Logs | 日志与审计 | 10 / 13 |
| 9. Email and Web Browser Protections · 7 | |||
| CIS 9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | 邮件安全 | 8 / 13 |
| CIS 9.2 | Use DNS Filtering Services | DNS 安全 | 3 / 13 |
| CIS 9.3 | Maintain and Enforce Network-Based URL Filters | Web 安全 | 6 / 13 |
| CIS 9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | 邮件安全 | 8 / 13 |
| CIS 9.5 | Implement DMARC | 邮件安全 | 8 / 13 |
| CIS 9.6 | Block Unnecessary File Types | 邮件安全 | 8 / 13 |
| CIS 9.7 | Deploy and Maintain Email Server Anti-Malware Protections | 邮件安全 | 8 / 13 |
| 10. Malware Defenses · 7 | |||
| CIS 10.1 | Deploy and Maintain Anti-Malware Software | 终端防护 | 10 / 13 |
| CIS 10.2 | Configure Automatic Anti-Malware Signature Updates | 终端防护 | 10 / 13 |
| CIS 10.3 | Disable Autorun and Autoplay for Removable Media | 终端防护 | 10 / 13 |
| CIS 10.4 | Configure Automatic Anti-Malware Scanning of Removable Media | 终端防护 | 10 / 13 |
| CIS 10.5 | Enable Anti-Exploitation Features | 终端防护 | 10 / 13 |
| CIS 10.6 | Centrally Manage Anti-Malware Software | 终端防护 | 10 / 13 |
| CIS 10.7 | Use Behavior-Based Anti-Malware Software | 终端防护 | 10 / 13 |
| 11. Data Recovery · 5 | |||
| CIS 11.1 | Establish and Maintain a Data Recovery Process | 恢复规划, 灾难恢复 | 10 / 13 |
| CIS 11.2 | Perform Automated Backups | 备份与恢复 | 11 / 13 |
| CIS 11.3 | Protect Recovery Data | 备份与恢复 | 11 / 13 |
| CIS 11.4 | Establish and Maintain an Isolated Instance of Recovery Data | 备份与恢复 | 11 / 13 |
| CIS 11.5 | Test Data Recovery | 备份与恢复 | 11 / 13 |
| 12. Network Infrastructure Management · 8 | |||
| CIS 12.1 | Ensure Network Infrastructure is Up-to-Date | 补丁管理 | 10 / 13 |
| CIS 12.2 | Establish and Maintain a Secure Network Architecture | 防火墙 / 网络分段, 零信任 | 9 / 13 |
| CIS 12.3 | Securely Manage Network Infrastructure | 防火墙 / 网络分段 | 9 / 13 |
| CIS 12.4 | Establish and Maintain Architecture Diagram(s) | 防火墙 / 网络分段 | 9 / 13 |
| CIS 12.5 | Centralize Network Authentication, Authorization, and Auditing (AAA) | 访问控制 | 11 / 13 |
| CIS 12.6 | Use of Secure Network Management and Communication Protocols | 防火墙 / 网络分段 | 9 / 13 |
| CIS 12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | 零信任 | 7 / 13 |
| CIS 12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | 特权访问 | 10 / 13 |
| 13. Network Monitoring and Defense · 11 | |||
| CIS 13.1 | Centralize Security Event Alerting | 持续监控, SIEM / SOC | 10 / 13 |
| CIS 13.2 | Deploy a Host-Based Intrusion Detection Solution | 入侵检测 | 9 / 13 |
| CIS 13.3 | Deploy a Network Intrusion Detection Solution | 入侵检测 | 9 / 13 |
| CIS 13.4 | Perform Traffic Filtering Between Network Segments | 防火墙 / 网络分段 | 9 / 13 |
| CIS 13.5 | Manage Access Control for Remote Assets | 零信任 | 7 / 13 |
| CIS 13.6 | Collect Network Traffic Flow Logs | 持续监控 | 10 / 13 |
| CIS 13.7 | Deploy a Host-Based Intrusion Prevention Solution | 入侵检测 | 9 / 13 |
| CIS 13.8 | Deploy a Network Intrusion Prevention Solution | 入侵检测 | 9 / 13 |
| CIS 13.9 | Deploy Port-Level Access Control | 防火墙 / 网络分段 | 9 / 13 |
| CIS 13.10 | Perform Application Layer Filtering | Web 安全, WAF | 6 / 13 |
| CIS 13.11 | Tune Security Event Alerting Thresholds | SIEM / SOC | 10 / 13 |
| 14. Security Awareness and Skills Training · 9 | |||
| CIS 14.1 | Establish and Maintain a Security Awareness Program | 意识与培训 | 10 / 13 |
| CIS 14.2 | Train Workforce Members to Recognize Social Engineering Attacks | 意识与培训 | 10 / 13 |
| CIS 14.3 | Train Workforce Members on Authentication Best Practices | 意识与培训 | 10 / 13 |
| CIS 14.4 | Train Workforce on Data Handling Best Practices | 意识与培训 | 10 / 13 |
| CIS 14.5 | Train Workforce Members on Causes of Unintentional Data Exposure | 意识与培训 | 10 / 13 |
| CIS 14.6 | Train Workforce Members on Recognizing and Reporting Security Incidents | 意识与培训 | 10 / 13 |
| CIS 14.7 | Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates | 意识与培训 | 10 / 13 |
| CIS 14.8 | Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks | 意识与培训 | 10 / 13 |
| CIS 14.9 | Conduct Role-Specific Security Awareness and Skills Training | 意识与培训 | 10 / 13 |
| 15. Service Provider Management · 7 | |||
| CIS 15.1 | Establish and Maintain an Inventory of Service Providers | 云安全, 供应商风险管理 | 12 / 13 |
| CIS 15.2 | Establish and Maintain a Service Provider Management Policy | 供应链风险 | 9 / 13 |
| CIS 15.3 | Classify Service Providers | 供应商风险管理 | 10 / 13 |
| CIS 15.4 | Ensure Service Provider Contracts Include Security Requirements | 供应商风险管理 | 10 / 13 |
| CIS 15.5 | Assess Service Providers | 供应商风险管理 | 10 / 13 |
| CIS 15.6 | Monitor Service Providers | 供应商风险管理 | 10 / 13 |
| CIS 15.7 | Securely Decommission Service Providers | 供应商风险管理 | 10 / 13 |
| 16. Application Software Security · 14 | |||
| CIS 16.1 | Establish and Maintain a Secure Application Development Process | 安全开发 | 8 / 13 |
| CIS 16.2 | Establish and Maintain a Process to Accept and Address Software Vulnerabilities | 安全开发 | 8 / 13 |
| CIS 16.3 | Perform Root Cause Analysis on Security Vulnerabilities | 安全开发 | 8 / 13 |
| CIS 16.4 | Establish and Manage an Inventory of Third-Party Software Components | 资产管理 | 13 / 13 |
| CIS 16.5 | Use Up-to-Date and Trusted Third-Party Software Components | 安全开发 | 8 / 13 |
| CIS 16.6 | Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities | 漏洞管理 | 13 / 13 |
| CIS 16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | 安全配置 | 9 / 13 |
| CIS 16.8 | Separate Production and Non-Production Systems | 安全开发 | 8 / 13 |
| CIS 16.9 | Train Developers in Application Security Concepts and Secure Coding | 安全开发 | 8 / 13 |
| CIS 16.10 | Apply Secure Design Principles in Application Architectures | Web 安全, API 安全 | 6 / 13 |
| CIS 16.11 | Leverage Vetted Modules or Services for Application Security Components | 安全开发 | 8 / 13 |
| CIS 16.12 | Implement Code-Level Security Checks | 安全开发, API 安全 | 8 / 13 |
| CIS 16.13 | Conduct Application Penetration Testing | 安全开发 | 8 / 13 |
| CIS 16.14 | Conduct Threat Modeling | 安全开发 | 8 / 13 |
| 17. Incident Response Management · 9 | |||
| CIS 17.1 | Designate Personnel to Manage Incident Handling | 事件响应 | 12 / 13 |
| CIS 17.2 | Establish and Maintain Contact Information for Reporting Security Incidents | 沟通 | 8 / 13 |
| CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | 报告 | 12 / 13 |
| CIS 17.4 | Establish and Maintain an Incident Response Process | 事件响应 | 12 / 13 |
| CIS 17.5 | Assign Key Roles and Responsibilities | 事件响应 | 12 / 13 |
| CIS 17.6 | Define Mechanisms for Communicating During Incident Response | 沟通, 沟通与恢复 | 9 / 13 |
| CIS 17.7 | Conduct Routine Incident Response Exercises | 事件响应 | 12 / 13 |
| CIS 17.8 | Conduct Post-Incident Reviews | 经验教训 | 9 / 13 |
| CIS 17.9 | Establish and Maintain Security Incident Thresholds | 事件响应 | 12 / 13 |
| 18. Penetration Testing · 5 | |||
| CIS 18.1 | Establish and Maintain a Penetration Testing Program | 漏洞管理 | 13 / 13 |
| CIS 18.2 | Perform Periodic External Penetration Tests | 漏洞管理 | 13 / 13 |
| CIS 18.3 | Remediate Penetration Test Findings | 漏洞管理 | 13 / 13 |
| CIS 18.4 | Validate Security Measures | 漏洞管理 | 13 / 13 |
| CIS 18.5 | Perform Periodic Internal Penetration Tests | 漏洞管理 | 13 / 13 |
主题覆盖情况
已映射 CIS v8.1 要求的主题（38）：
意识与培训供应链风险资产管理数据分类漏洞管理访问控制多因素认证加密数据保护备份与恢复特权访问防火墙 / 网络分段终端防护补丁管理安全配置安全开发邮件安全Web 安全零信任移动安全云安全DNS 安全WAFDLP持续监控日志与审计入侵检测异常检测SIEM / SOC事件响应沟通报告恢复规划经验教训沟通与恢复灾难恢复API 安全供应商风险管理
本站数据中无映射 无 CIS v8.1 要求（12）：