Critical Security Controls Version 7.1

The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 20 controls included in the set are intended to be the basis for any information security program.

Critical Security Controls Version 7.1
IDNameImplementation GroupsThreats
IG1IG2IG3
13.7Manage USB Devices ••STRIDE-LM
13.8Manage System's External Removable Media's Read/Write Configurations  •STRIDE-LM
13.9Encrypt Data on USB Storage Devices  •STRIDE-LM
14.1Segment the Network Based on Sensitivity ••STRIDE-LM
14.2Enable Firewall Filtering Between VLANs ••STRIDE-LM
14.3Disable Workstation to Workstation Communication ••STRIDE-LM
14.4Encrypt All Sensitive Information in Transit ••STRIDE-LM
14.5Utilize an Active Discovery Tool to Identify Sensitive Data  •STRIDE-LM
14.6Protect Information Through Access Control Lists•••STRIDE-LM
14.7Enforce Access Control to Data Through Automated Tools  •STRIDE-LM
14.8Encrypt Sensitive Information at Rest  •STRIDE-LM
14.9Enforce Detail Logging for Access or Changes to Sensitive Data  •STRIDE-LM
15.1Maintain an Inventory of Authorized Wireless Access Points ••STRIDE-LM
15.2Detect Wireless Access Points Connected to the Wired Network ••STRIDE-LM
15.3Use a Wireless Intrusion Detection System ••STRIDE-LM
15.4Disable Wireless Access on Devices if Not Required  •STRIDE-LM
15.5Limit Wireless Access on Client Devices  •STRIDE-LM
15.6Disable Peer-to-Peer Wireless Network Capabilities on Wireless Clients ••STRIDE-LM
15.7Leverage the Advanced Encryption Standard (AES) to Encrypt Wireless Data•••STRIDE-LM
15.8Use Wireless Authentication Protocols That Require Mutual, Multi-Factor Authentication  •STRIDE-LM
15.9Disable Wireless Peripheral Access of Devices ••STRIDE-LM
15.10Create Separate Wireless Network for Personal and Untrusted Devices•••STRIDE-LM
16.1Maintain an Inventory of Authentication Systems ••STRIDE-LM
16.2Configure Centralized Point of Authentication ••STRIDE-LM
16.3Require Multi-Factor Authentication ••STRIDE-LM
16.4Encrypt or Hash all Authentication Credentials ••STRIDE-LM
16.5Encrypt Transmittal of Username and Authentication Credentials ••STRIDE-LM
16.6Maintain an Inventory of Accounts ••STRIDE-LM
16.7Establish Process for Revoking Access ••STRIDE-LM
16.8Disable Any Unassociated Accounts•••STRIDE-LM
16.9Disable Dormant Accounts•••STRIDE-LM
16.10Ensure All Accounts Have An Expiration Date ••STRIDE-LM
16.11Lock Workstation Sessions After Inactivity•••STRIDE-LM
16.12Monitor Attempts to Access Deactivated Accounts ••STRIDE-LM
16.13Alert on Account Login Behavior Deviation  •STRIDE-LM
17.1Perform a Skills Gap Analysis ••STRIDE-LM
17.2Deliver Training to Fill the Skills Gap ••STRIDE-LM
17.3Implement a Security Awareness Program•••STRIDE-LM
17.4Update Awareness Content Frequently ••STRIDE-LM
17.5Train Workforce on Secure Authentication•••STRIDE-LM
17.6Train Workforce on Identifying Social Engineering Attacks•••STRIDE-LM
17.7Train Workforce on Sensitive Data Handling•••STRIDE-LM
17.8Train Workforce on Causes of Unintentional Data Exposure•••STRIDE-LM
17.9Train Workforce Members on Identifying and Reporting Incidents•••STRIDE-LM
18.1Establish Secure Coding Practices ••STRIDE-LM
18.2Ensure That Explicit Error Checking is Performed for All In-House Developed Software ••STRIDE-LM
18.3Verify That Acquired Software is Still Supported ••STRIDE-LM
18.4Only Use Up-to-Date and Trusted Third-Party Components  •STRIDE-LM
18.5Use Only Standardized and Extensively Reviewed Encryption Algorithms ••STRIDE-LM
18.6Ensure Software Development Personnel are Trained in Secure Coding ••STRIDE-LM