CIS Controls 1-18 Flashcards
Control 1 Inventory and control of enterprise assets
Helps organizations actively track and manage all IT assets connected to a company’s IT infrastructure physically or virtually.
2 Inventory and control of software assets
Provides recommendations for organizations to track and actively manage all software applications so that only authorized software is installed on company devices.
Data Protection
Helps organizations develop ways to securely manage the entire life cycle of their data, from initial identification and classification data to its disposal.
Secure configuration of enterprise assets and software
Helps organizations establish and maintain secure baseline configurations for their enterprise assets
Account management
This control outlines best practices for companies to manage credentials and authorization for user accounts, privileged user accoutns, and service accounts for the company hardware and software applications
Access control management
Specifies the type of access that the user account should have.
Continuous vulnerability management
Helps identify and track vulnerabilities within its infrastructure so that it can remediate and eliminate weak points or windows of opportunity for bad actors.
Audit log management
Establishes an enterprise log management process so that organizations can be altered and recover from an attack in real-time, or near real time, using log collection and analytic features.
Email and Web browse protection
Provides recommendations on how to detect and protect against cybercrime attempted through email or the internet by directly engaging employees.
Data recovery
Established data backup, testing, and restoration processes that allow organizations to effectively recover company assets to a pre-incident state
Malware defenses
Assists companies in preventing the installation and propagation of malware onto company assets and its network
Network infrastructure management
Established procedures and tools for managing and securing a company’s network infrastructure. Network infostructure included both physical and virtual devices, such as firewalls, gateways, routers, etc
Network monitoring and defense
Establishes processes for monitoring and defending a company’s network infrastructure against internal and external security threats.
Security Awareness and skill training
Guides organizations in establishing a security awareness and training program to reduce cybersecurity risk
Service provider management
Helps organizations develop processes to evaluate third-party service providers that have access to sensitive data or that are responsible for managing some or all of a company’s IT functions.
