Critical Security Controls Version 7.1

The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 20 controls included in the set are intended to be the basis for any information security program.

  • xImplementation Group: IG2
IDNameImplementation GroupsThreats
IG1IG2IG3
1.1Utilize an Active Discovery Tool ••STRIDE-LM
1.3Use DHCP Logging to Update Asset Inventory ••STRIDE-LM
1.4Maintain Detailed Asset Inventory•••STRIDE-LM
1.5Maintain Asset Inventory Information ••STRIDE-LM
1.6Address Unauthorized Assets•••STRIDE-LM
1.7Deploy Port Level Access Control ••STRIDE-LM
2.1Maintain Inventory of Authorized Software•••STRIDE-LM
2.2Ensure Software is Supported by Vendor•••STRIDE-LM
2.3Utilize Software Inventory Tools ••STRIDE-LM
2.4Track Software Inventory Information ••STRIDE-LM
2.6Address unapproved software•••STRIDE-LM
3.1Run Automated Vulnerability Scanning Tools ••STRIDE-LM
3.2Perform Authenticated Vulnerability Scanning ••STRIDE-LM
3.3Protect Dedicated Assessment Accounts ••STRIDE-LM
3.4Deploy Automated Operating System Patch Management Tools•••STRIDE-LM
3.5Deploy Automated Software Patch Management Tools•••STRIDE-LM
3.6Compare Back-to-Back Vulnerability Scans ••STRIDE-LM
3.7Utilize a Risk-Rating Process ••STRIDE-LM
4.1Maintain Inventory of Administrative Accounts ••STRIDE-LM
4.2Change Default Passwords•••STRIDE-LM
4.3Ensure the Use of Dedicated Administrative Accounts•••STRIDE-LM
4.4Use Unique Passwords ••STRIDE-LM
4.5Use Multi-Factor Authentication for All Administrative Access ••STRIDE-LM
4.7Limit Access to Script Tools ••STRIDE-LM
4.8Log and Alert on Changes to Administrative Group Membership ••STRIDE-LM
4.9Log and Alert on Unsuccessful Administrative Account Login ••STRIDE-LM
5.1Establish Secure Configurations•••STRIDE-LM
5.2Maintain Secure Images ••STRIDE-LM
5.3Securely Store Master Images ••STRIDE-LM
5.4Deploy System Configuration Management Tools ••STRIDE-LM
5.5Implement Automated Configuration Monitoring Systems ••STRIDE-LM
6.1Utilize Three Synchronized Time Sources ••STRIDE-LM
6.2Activate Audit Logging•••STRIDE-LM
6.3Enable Detailed Logging ••STRIDE-LM
6.4Ensure Adequate Storage for Logs ••STRIDE-LM
6.5Central Log Management ••STRIDE-LM
6.6Deploy SIEM or Log Analytic Tools ••STRIDE-LM
6.7Regularly Review Logs ••STRIDE-LM
7.1Ensure Use of Only Fully Supported Browsers and Email Clients•••STRIDE-LM
7.2Disable Unnecessary or Unauthorized Browser or Email Client Plugins ••STRIDE-LM
7.3Limit Use of Scripting Languages in Web Browsers and Email Clients ••STRIDE-LM
7.4Maintain and Enforce Network-Based URL Filters ••STRIDE-LM
7.5Subscribe to URL-Categorization Service ••STRIDE-LM
7.6Log All URL requester ••STRIDE-LM
7.7Use of DNS Filtering Services•••STRIDE-LM
7.8Implement DMARC and Enable Receiver-Side Verification ••STRIDE-LM
7.9Block Unnecessary File Types ••STRIDE-LM
8.1Utilize Centrally Managed Anti-malware Software ••STRIDE-LM
8.2Ensure Anti-Malware Software and Signatures Are Updated•••STRIDE-LM
8.3Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit Technologies ••STRIDE-LM