Critical Security Controls Version 7.1

The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 20 controls included in the set are intended to be the basis for any information security program.

Critical Security Controls Version 7.1
IDNameImplementation GroupsThreats
IG1IG2IG3
1.4Maintain Detailed Asset Inventory•••STRIDE-LM
1.6Address Unauthorized Assets•••STRIDE-LM
2.1Maintain Inventory of Authorized Software•••STRIDE-LM
2.2Ensure Software is Supported by Vendor•••STRIDE-LM
2.6Address unapproved software•••STRIDE-LM
3.4Deploy Automated Operating System Patch Management Tools•••STRIDE-LM
3.5Deploy Automated Software Patch Management Tools•••STRIDE-LM
4.2Change Default Passwords•••STRIDE-LM
4.3Ensure the Use of Dedicated Administrative Accounts•••STRIDE-LM
5.1Establish Secure Configurations•••STRIDE-LM
6.2Activate Audit Logging•••STRIDE-LM
7.1Ensure Use of Only Fully Supported Browsers and Email Clients•••STRIDE-LM
7.7Use of DNS Filtering Services•••STRIDE-LM
8.2Ensure Anti-Malware Software and Signatures Are Updated•••STRIDE-LM
8.4Configure Anti-Malware Scanning of Removable Devices•••STRIDE-LM
8.5Configure Devices to Not Auto-Run Content•••STRIDE-LM
9.4Apply Host-Based Firewalls or Port-Filtering•••STRIDE-LM
10.1Ensure Regular Automated BackUps•••STRIDE-LM
10.2Perform Complete System Backups•••STRIDE-LM
10.4Protect Backups•••STRIDE-LM
10.5Ensure All Backups Have at Least One Offline Backup Destination•••STRIDE-LM
11.4Install the Latest Stable Version of Any Security-Related Updates on All Network Devices•••STRIDE-LM
12.1Maintain an Inventory of Network Boundaries•••STRIDE-LM
12.4Deny Communication Over Unauthorized Ports•••STRIDE-LM
13.1Maintain an Inventory of Sensitive Information•••STRIDE-LM
13.2Remove Sensitive Data or Systems Not Regularly Accessed by Organization•••STRIDE-LM
13.6Encrypt Mobile Device Data•••STRIDE-LM
14.6Protect Information Through Access Control Lists•••STRIDE-LM
15.7Leverage the Advanced Encryption Standard (AES) to Encrypt Wireless Data•••STRIDE-LM
15.10Create Separate Wireless Network for Personal and Untrusted Devices•••STRIDE-LM
16.8Disable Any Unassociated Accounts•••STRIDE-LM
16.9Disable Dormant Accounts•••STRIDE-LM
16.11Lock Workstation Sessions After Inactivity•••STRIDE-LM
17.3Implement a Security Awareness Program•••STRIDE-LM
17.5Train Workforce on Secure Authentication•••STRIDE-LM
17.6Train Workforce on Identifying Social Engineering Attacks•••STRIDE-LM
17.7Train Workforce on Sensitive Data Handling•••STRIDE-LM
17.8Train Workforce on Causes of Unintentional Data Exposure•••STRIDE-LM
17.9Train Workforce Members on Identifying and Reporting Incidents•••STRIDE-LM
19.1Document Incident Response Procedures•••STRIDE-LM
19.3Designate Management Personnel to Support Incident Handling•••STRIDE-LM
19.5Maintain Contact Information For Reporting Security Incidents•••STRIDE-LM
19.6Publish Information Regarding Reporting Computer Anomalies and Incidents•••STRIDE-LM