Critical Security Controls Version 7.1

The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 20 controls included in the set are intended to be the basis for any information security program.

Critical Security Controls Version 7.1
IDNameImplementation GroupsThreats
IG1IG2IG3
16.5Encrypt Transmittal of Username and Authentication Credentials ••STRIDE-LM
16.6Maintain an Inventory of Accounts ••STRIDE-LM
16.7Establish Process for Revoking Access ••STRIDE-LM
16.8Disable Any Unassociated Accounts•••STRIDE-LM
16.9Disable Dormant Accounts•••STRIDE-LM
16.10Ensure All Accounts Have An Expiration Date ••STRIDE-LM
16.11Lock Workstation Sessions After Inactivity•••STRIDE-LM
16.12Monitor Attempts to Access Deactivated Accounts ••STRIDE-LM
17.1Perform a Skills Gap Analysis ••STRIDE-LM
17.2Deliver Training to Fill the Skills Gap ••STRIDE-LM
17.3Implement a Security Awareness Program•••STRIDE-LM
17.4Update Awareness Content Frequently ••STRIDE-LM
17.5Train Workforce on Secure Authentication•••STRIDE-LM
17.6Train Workforce on Identifying Social Engineering Attacks•••STRIDE-LM
17.7Train Workforce on Sensitive Data Handling•••STRIDE-LM
17.8Train Workforce on Causes of Unintentional Data Exposure•••STRIDE-LM
17.9Train Workforce Members on Identifying and Reporting Incidents•••STRIDE-LM
18.1Establish Secure Coding Practices ••STRIDE-LM
18.2Ensure That Explicit Error Checking is Performed for All In-House Developed Software ••STRIDE-LM
18.3Verify That Acquired Software is Still Supported ••STRIDE-LM
18.5Use Only Standardized and Extensively Reviewed Encryption Algorithms ••STRIDE-LM
18.6Ensure Software Development Personnel are Trained in Secure Coding ••STRIDE-LM
18.7Apply Static and Dynamic Code Analysis Tools ••STRIDE-LM
18.8Establish a Process to Accept and Address Reports of Software Vulnerabilities ••STRIDE-LM
18.9Separate Production and Non-Production Systems ••STRIDE-LM
18.10Deploy Web Application Firewalls ••STRIDE-LM
18.11Use Standard Hardening Configuration Templates for Databases ••STRIDE-LM
19.1Document Incident Response Procedures•••STRIDE-LM
19.2Assign Job Titles and Duties for Incident Response ••STRIDE-LM
19.3Designate Management Personnel to Support Incident Handling•••STRIDE-LM
19.4Devise Organization-wide Standards for Reporting Incidents ••STRIDE-LM
19.5Maintain Contact Information For Reporting Security Incidents•••STRIDE-LM
19.6Publish Information Regarding Reporting Computer Anomalies and Incidents•••STRIDE-LM
19.7Conduct Periodic Incident Scenario Sessions for Personnel ••STRIDE-LM
20.1Establish a Penetration Testing Program ••STRIDE-LM
20.2Conduct Regular External and Internal Penetration Tests ••STRIDE-LM
20.4Include Tests for Presence of Unprotected System Information and Artifacts ••STRIDE-LM
20.5Create Test Bed for Elements Not Typically Tested in Production ••STRIDE-LM
20.6Use Vulnerability Scanning and Penetration Testing Tools in Concert ••STRIDE-LM
20.8Control and Monitor Accounts Associated with Penetration Testing ••STRIDE-LM