Critical Security Controls Version 8

Formerly known as the SANS Critical Controls, the Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 18 controls included in the set are intended to be the basis for any information security program.

    IDNameImplementation GroupsThreats
    IG1IG2IG3
    6.1Establish an Access Granting Process•••STRIDE-LM
    6.2Establish an Access Revoking Process•••STRIDE-LM
    6.3Require MFA for Externally-Exposed Applications•••STRIDE-LM
    6.4Require MFA for Remote Network Access•••STRIDE-LM
    6.5Require MFA for Administrative Access•••STRIDE-LM
    6.6Establish and Maintain an Inventory of Authentication and Authorization Systems ••STRIDE-LM
    6.7Centralize Access Control ••STRIDE-LM
    6.8Define and Maintain Role-Based Access Control  •STRIDE-LM
    7Continuous Vulnerability Management   STRIDE-LM
    7.1Establish and Maintain a Vulnerability Management Process•••STRIDE-LM
    7.2Establish and Maintain a Remediation Process•••STRIDE-LM
    7.3Perform Automated Operating System Patch Management•••STRIDE-LM
    7.4Perform Automated Application Patch Management•••STRIDE-LM
    7.5Perform Automated Vulnerability Scans of Internal Enterprise Assets ••STRIDE-LM
    7.6Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets ••STRIDE-LM
    7.7Remediate Detected Vulnerabilities ••STRIDE-LM
    8Audit Log Management   STRIDE-LM
    8.1Establish and Maintain an Audit Log Management Process•••STRIDE-LM
    8.2Collect Audit Logs•••STRIDE-LM
    8.3Ensure Adequate Audit Log Storage•••STRIDE-LM
    8.4Standardize Time Synchronization ••STRIDE-LM
    8.5Collect Detailed Audit Logs ••STRIDE-LM
    8.6Collect DNS Query Audit Logs ••STRIDE-LM
    8.7Collect URL Request Audit Logs ••STRIDE-LM
    8.8Collect Command-Line Audit Logs ••STRIDE-LM
    8.9Centralize Audit Logs ••STRIDE-LM
    8.10Retain Audit Logs ••STRIDE-LM
    8.11Conduct Audit Log Reviews ••STRIDE-LM
    8.12Collect Service Provider Logs  •STRIDE-LM
    9Email and Web Browser Protections   STRIDE-LM
    9.1Ensure Use of Only Fully Supported Browsers and Email Clients•••STRIDE-LM
    9.2Use DNS Filtering Services•••STRIDE-LM
    9.3Maintain and Enforce Network-Based URL Filters ••STRIDE-LM
    9.4Restrict Unnecessary or Unauthorized Browser and Email Client Extensions ••STRIDE-LM
    9.5Implement DMARC ••STRIDE-LM
    9.6Block Unnecessary File Types ••STRIDE-LM
    9.7Deploy and Maintain Email Server Anti-Malware Protections  •STRIDE-LM
    10Malware Defenses   STRIDE-LM
    10.1Deploy and Maintain Anti-Malware Software•••STRIDE-LM
    10.2Configure Automatic Anti-Malware Signature Updates•••STRIDE-LM
    10.3Disable Autorun and Autoplay for Removable Media•••STRIDE-LM
    10.4Configure Automatic Anti-Malware Scanning of Removable Media ••STRIDE-LM
    10.5Enable Anti-Exploitation Features ••STRIDE-LM
    10.6Centrally Manage Anti-Malware Software ••STRIDE-LM
    10.7Use Behavior-Based Anti-Malware Software ••STRIDE-LM
    11Data Recovery   STRIDE-LM
    11.1Establish and Maintain a Data Recovery Process•••STRIDE-LM
    11.2Perform Automated Backups•••STRIDE-LM
    11.3Protect Recovery Data•••STRIDE-LM
    11.4Establish and Maintain an Isolated Instance of Recovery Data•••STRIDE-LM