Critical Security Controls Version 8.1

Formerly known as the SANS Critical Controls, the Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 18 controls included in the set are intended to be the basis for any information security program.

Critical Security Controls Version 8.1
IDNameImplementation GroupsThreats
IG1IG2IG3
6.7Centralize Access Control ••STRIDE-LM
6.8Define and Maintain Role-Based Access Control  •STRIDE-LM
7.1Establish and Maintain a Vulnerability Management Process•••STRIDE-LM
7.2Establish and Maintain a Remediation Process•••STRIDE-LM
7.3Perform Automated Operating System Patch Management•••STRIDE-LM
7.4Perform Automated Application Patch Management•••STRIDE-LM
7.5Perform Automated Vulnerability Scans of Internal Enterprise Assets ••STRIDE-LM
7.6Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets ••STRIDE-LM
7.7Remediate Detected Vulnerabilities ••STRIDE-LM
8.1Establish and Maintain an Audit Log Management Process•••STRIDE-LM
8.2Collect Audit Logs•••STRIDE-LM
8.3Ensure Adequate Audit Log Storage•••STRIDE-LM
8.4Standardize Time Synchronization ••STRIDE-LM
8.5Collect Detailed Audit Logs ••STRIDE-LM
8.6Collect DNS Query Audit Logs ••STRIDE-LM
8.7Collect URL Request Audit Logs ••STRIDE-LM
8.8Collect Command-Line Audit Logs ••STRIDE-LM
8.9Centralize Audit Logs ••STRIDE-LM
8.10Retain Audit Logs ••STRIDE-LM
8.11Conduct Audit Log Reviews ••STRIDE-LM
8.12Collect Service Provider Logs  •STRIDE-LM
9.1Ensure Use of Only Fully Supported Browsers and Email Clients•••STRIDE-LM
9.2Use DNS Filtering Services•••STRIDE-LM
9.3Maintain and Enforce Network-Based URL Filters ••STRIDE-LM
9.4Restrict Unnecessary or Unauthorized Browser and Email Client Extensions ••STRIDE-LM
9.5Implement DMARC ••STRIDE-LM
9.6Block Unnecessary File Types ••STRIDE-LM
9.7Deploy and Maintain Email Server Anti-Malware Protections  •STRIDE-LM
10.1Deploy and Maintain Anti-Malware Software•••STRIDE-LM
10.2Configure Automatic Anti-Malware Signature Updates•••STRIDE-LM
10.3Disable Autorun and Autoplay for Removable Media•••STRIDE-LM
10.4Configure Automatic Anti-Malware Scanning of Removable Media ••STRIDE-LM
10.5Enable Anti-Exploitation Features ••STRIDE-LM
10.6Centrally Manage Anti-Malware Software ••STRIDE-LM
10.7Use Behavior-Based Anti-Malware Software ••STRIDE-LM
11.1Establish and Maintain a Data Recovery Process•••STRIDE-LM
11.2Perform Automated Backups•••STRIDE-LM
11.3Protect Recovery Data•••STRIDE-LM
11.4Establish and Maintain an Isolated Instance of Recovery Data•••STRIDE-LM
11.5Test Data Recovery ••STRIDE-LM
12.1Ensure Network Infrastructure is Up-to-Date•••STRIDE-LM
12.2Establish and Maintain a Secure Network Architecture ••STRIDE-LM
12.3Securely Manage Network Infrastructure ••STRIDE-LM
12.4Establish and Maintain Architecture Diagram(s) ••STRIDE-LM
12.5Centralize Network Authentication, Authorization, and Auditing (AAA) ••STRIDE-LM
12.6Use of Secure Network Management and Communication Protocols ••STRIDE-LM
12.7Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure ••STRIDE-LM
12.8Establish and Maintain Dedicated Computing Resources for All Administrative Work  •STRIDE-LM
13.1Centralize Security Event Alerting ••STRIDE-LM
13.2Deploy a Host-Based Intrusion Detection Solution ••STRIDE-LM