Critical Security Controls Version 7.1

The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 20 controls included in the set are intended to be the basis for any information security program.

Critical Security Controls Version 7.1
IDNameImplementation GroupsThreats
IG1IG2IG3
7.4Maintain and Enforce Network-Based URL Filters ••STRIDE-LM
7.5Subscribe to URL-Categorization Service ••STRIDE-LM
7.6Log All URL requester ••STRIDE-LM
7.7Use of DNS Filtering Services•••STRIDE-LM
7.8Implement DMARC and Enable Receiver-Side Verification ••STRIDE-LM
7.9Block Unnecessary File Types ••STRIDE-LM
7.10Sandbox All Email Attachments  •STRIDE-LM
8.1Utilize Centrally Managed Anti-malware Software ••STRIDE-LM
8.2Ensure Anti-Malware Software and Signatures Are Updated•••STRIDE-LM
8.3Enable Operating System Anti-Exploitation Features/Deploy Anti-Exploit Technologies ••STRIDE-LM
8.4Configure Anti-Malware Scanning of Removable Devices•••STRIDE-LM
8.5Configure Devices to Not Auto-Run Content•••STRIDE-LM
8.6Centralize Anti-Malware Logging ••STRIDE-LM
8.7Enable DNS Query Logging ••STRIDE-LM
8.8Enable Command-Line Audit Logging ••STRIDE-LM
9.1Associate Active Ports, Services, and Protocols to Asset Inventory ••STRIDE-LM
9.2Ensure Only Approved Ports, Protocols, and Services Are Running ••STRIDE-LM
9.3Perform Regular Automated Port Scans ••STRIDE-LM
9.4Apply Host-Based Firewalls or Port-Filtering•••STRIDE-LM
9.5Implement Application Firewalls  •STRIDE-LM
10.1Ensure Regular Automated BackUps•••STRIDE-LM
10.2Perform Complete System Backups•••STRIDE-LM
10.3Test Data on Backup Media ••STRIDE-LM
10.4Protect Backups•••STRIDE-LM
10.5Ensure All Backups Have at Least One Offline Backup Destination•••STRIDE-LM
11.1Maintain Standard Security Configurations for Network Devices ••STRIDE-LM
11.2Document Traffic Configuration Rules ••STRIDE-LM
11.3Use Automated Tools to Verify Standard Device Configurations and Detect Changes ••STRIDE-LM
11.4Install the Latest Stable Version of Any Security-Related Updates on All Network Devices•••STRIDE-LM
11.5Manage Network Devices Using Multi-Factor Authentication and Encrypted Sessions ••STRIDE-LM
11.6Use Dedicated Machines For All Network Administrative Tasks ••STRIDE-LM
11.7Manage Network Infrastructure Through a Dedicated Network ••STRIDE-LM
12.1Maintain an Inventory of Network Boundaries•••STRIDE-LM
12.2Scan for Unauthorized Connections Across Trusted Network Boundaries ••STRIDE-LM
12.3Deny Communications With Known Malicious IP Addresses ••STRIDE-LM
12.4Deny Communication Over Unauthorized Ports•••STRIDE-LM
12.5Configure Monitoring Systems to Record Network Packets ••STRIDE-LM
12.6Deploy Network-Based IDS Sensors ••STRIDE-LM
12.7Deploy Network-Based Intrusion Prevention Systems  •STRIDE-LM
12.8Deploy NetFlow Collection on Networking Boundary Devices ••STRIDE-LM
12.9Deploy Application Layer Filtering Proxy Server  •STRIDE-LM
12.10Decrypt Network Traffic at Proxy  •STRIDE-LM
12.11Require All Remote Login to Use Multi-Factor Authentication ••STRIDE-LM
12.12Manage All Devices Remotely Logging into Internal Network  •STRIDE-LM
13.1Maintain an Inventory of Sensitive Information•••STRIDE-LM
13.2Remove Sensitive Data or Systems Not Regularly Accessed by Organization•••STRIDE-LM
13.3Monitor and Block Unauthorized Network Traffic  •STRIDE-LM
13.4Only Allow Access to Authorized Cloud Storage or Email Providers ••STRIDE-LM
13.5Monitor and Detect Any Unauthorized Use of Encryption  •STRIDE-LM
13.6Encrypt Mobile Device Data•••STRIDE-LM