Critical Security Controls Version 7.1

The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 20 controls included in the set are intended to be the basis for any information security program.

Critical Security Controls Version 7.1
IDNameImplementation GroupsThreats
IG1IG2IG3
3Continuous Vulnerability Management   STRIDE-LM
3.3Protect Dedicated Assessment Accounts ••STRIDE-LM
3.4Deploy Automated Operating System Patch Management Tools•••STRIDE-LM
3.5Deploy Automated Software Patch Management Tools•••STRIDE-LM
4Controlled Use of Administrative Privileges   STRIDE-LM
4.3Ensure the Use of Dedicated Administrative Accounts•••STRIDE-LM
4.5Use Multi-Factor Authentication for All Administrative Access ••STRIDE-LM
4.7Limit Access to Script Tools ••STRIDE-LM
4.8Log and Alert on Changes to Administrative Group Membership ••STRIDE-LM
5Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers   STRIDE-LM
5.1Establish Secure Configurations•••STRIDE-LM
8.3Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit Technologies ••STRIDE-LM
11.4Install the Latest Stable Version of Any Security-Related Updates on All Network Devices•••STRIDE-LM
16Account Monitoring and Control   STRIDE-LM
18Application Software Security   STRIDE-LM
18.4Only Use Up-to-Date and Trusted Third-Party Components  •STRIDE-LM
18.8Establish a Process to Accept and Address Reports of Software Vulnerabilities ••STRIDE-LM
18.11Use Standard Hardening Configuration Templates for Databases ••STRIDE-LM
20Penetration Tests and Red Team Exercises   STRIDE-LM
20.1Establish a Penetration Testing Program ••STRIDE-LM
20.2Conduct Regular External and Internal Penetration Tests ••STRIDE-LM
20.3Perform Periodic Red Team Exercises  •STRIDE-LM
20.6Use Vulnerability Scanning and Penetration Testing Tools in Concert ••STRIDE-LM