Extra CreditCIS Critical Security Controls
Official docs outline
15 sections- Control 1 Inventory and Control of Enterprise Assets
Asset inventory of devices.
- Control 2 Inventory and Control of Software Assets
Authorized software inventory and allow-listing.
- Control 3 Data Protection
Data classification, encryption and retention.
- Control 4 Secure Configuration
Baseline configurations and hardening.
- Control 5 Account Management
Account inventory and lifecycle.
- Control 6 Access Control Management
Least privilege and MFA.
- Control 7 Continuous Vulnerability Management
Scanning and patching cadence.
- Control 8 Audit Log Management
Log collection and retention.
- Control 9 Email and Web Browser Protections
Filtering and browser hardening.
- Control 10 Malware Defenses
Anti-malware deployment.
- Control 11 Data Recovery
Backups and recovery testing.
- Control 12 Network Infrastructure Management
Network device configuration and segmentation.
- Control 13 Network Monitoring and Defense
Detection and response on network telemetry.
- Control 16 Application Software Security
Secure development lifecycle and vulnerability handling.
- Control 17 Incident Response Management
Incident response planning and exercises.
Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.
