Critical Security Controls Version 7.1

The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 20 controls included in the set are intended to be the basis for any information security program.

Critical Security Controls Version 7.1
IDNameImplementation GroupsThreats
IG1IG2IG3
18.7Apply Static and Dynamic Code Analysis Tools ••STRIDE-LM
18.8Establish a Process to Accept and Address Reports of Software Vulnerabilities ••STRIDE-LM
18.9Separate Production and Non-Production Systems ••STRIDE-LM
18.10Deploy Web Application Firewalls ••STRIDE-LM
18.11Use Standard Hardening Configuration Templates for Databases ••STRIDE-LM
19.1Document Incident Response Procedures•••STRIDE-LM
19.2Assign Job Titles and Duties for Incident Response ••STRIDE-LM
19.3Designate Management Personnel to Support Incident Handling•••STRIDE-LM
19.4Devise Organization-wide Standards for Reporting Incidents ••STRIDE-LM
19.5Maintain Contact Information For Reporting Security Incidents•••STRIDE-LM
19.6Publish Information Regarding Reporting Computer Anomalies and Incidents•••STRIDE-LM
19.7Conduct Periodic Incident Scenario Sessions for Personnel ••STRIDE-LM
19.8Create Incident Scoring and Prioritization Schema  •STRIDE-LM
20.1Establish a Penetration Testing Program ••STRIDE-LM
20.2Conduct Regular External and Internal Penetration Tests ••STRIDE-LM
20.3Perform Periodic Red Team Exercises  •STRIDE-LM
20.4Include Tests for Presence of Unprotected System Information and Artifacts ••STRIDE-LM
20.5Create Test Bed for Elements Not Typically Tested in Production ••STRIDE-LM
20.6Use Vulnerability Scanning and Penetration Testing Tools in Concert ••STRIDE-LM
20.7Ensure Results from Penetration Test are Documented Using Open, Machine-readable Standards  •STRIDE-LM
20.8Control and Monitor Accounts Associated with Penetration Testing ••STRIDE-LM