/control-check

description: Verify specific CIS Control implementation from 18 controls

> _CIS Controls v8 content used under CC BY-SA 4.0 from the Center for Internet Security. This command's CIS-derived content is CC BY-SA 4.0. See [LICENSE-CIS.md](../LICENSE-CIS.md)._

CIS Control Implementation Check

Provides detailed implementation guidance and verification for specific CIS Controls v8 controls.

Arguments

• `$1` - Control number or name (required: 1-18 or control name)
• `$2` - Implementation Group level (optional: IG1, IG2, IG3)

The 18 CIS Controls

Control 1: Inventory and Control of Enterprise Assets

**IG Level**: IG1 | **Safeguards**: 5 (IG1: 5, IG2: 5, IG3: 5)

**Purpose**: Actively manage all enterprise assets connected to infrastructure

**Key Safeguards**:

• 1.1: Establish and maintain detailed enterprise asset inventory (IG1)
• 1.2: Address unauthorized assets (IG1)
• 1.3: Utilize asset management tool (IG1)
• 1.4: Use Dynamic Host Configuration Protocol (DHCP) logging (IG2)
• 1.5: Use Active Discovery Tools (IG3)

**Implementation**:

• Deploy asset discovery tools (CMDB, network scanner)
• Document all hardware (laptops, servers, network devices, IoT)
• Track location, owner, business purpose
• Automate unauthorized device detection

**Common Tools**: ServiceNow, Lansweeper, Qualys, Nessus

---

Control 2: Inventory and Control of Software Assets

**IG Level**: IG1 | **Safeguards**: 7 (IG1: 4, IG2: 6, IG3: 7)

**Purpose**: Actively manage all software on the network

**Key Safeguards**:

• 2.1: Establish and maintain software inventory (IG1)
• 2.2: Ensure authorized software is currently supported (IG1)
• 2.3: Address unauthorized software (IG1)
• 2.4: Utilize automated software inventory tools (IG1)
• 2.5: Allowlist authorized software (IG2)
• 2.6: Allowlist authorized libraries (IG2)
• 2.7: Allowlist authorized scripts (IG3)

**Implementation**:

• Software asset management (SAM) tool
• Application whitelisting/allowlisting
• Track version, vendor, support status
• Detect shadow IT

**Common Tools**: Microsoft Endpoint Manager, Flexera, Snow Software

---

Control 3: Data Protection

**IG Level**: IG1 | **Safeguards**: 14 (IG1: 3, IG2: 11, IG3: 14)

**Purpose**: Protect data at rest and in transit

**Key Safeguards**:

• 3.1: Establish and maintain data management process (IG1)
• 3.2: Establish and maintain data inventory (IG1)
• 3.3: Configure data access control lists (IG1)
• 3.4: Enforce data retention (IG1)
• 3.5: Securely dispose of data (IG1)
• 3.6: Encrypt data on end-user devices (IG2)
• 3.7: Establish and maintain data classification scheme (IG2)
• 3.10: Encrypt sensitive data in transit (IG2)
• 3.11: Encrypt sensitive data at rest (IG2)
• 3.12: Segment data processing and storage (IG2)

**Implementation**:

• Data classification policy
• Encryption (BitLocker, FileVault, TLS 1.2+)
• Data loss prevention (DLP)
• Secure deletion procedures

**Common Tools**: Microsoft Purview, Varonis, Symantec DLP

---

Control 4: Secure Configuration of Enterprise Assets and Software

**IG Level**: IG1 | **Safeguards**: 12 (IG1: 5, IG2: 10, IG3: 12)

**Purpose**: Establish and maintain secure configurations

**Key Safeguards**:

• 4.1: Establish and maintain secure configuration process (IG1)
• 4.2: Establish and maintain secure configuration baseline (IG1)
• 4.3: Configure automatic session locking (IG1)
• 4.4: Implement and manage firewall (IG1)
• 4.5: Implement and manage DMZ (IG2)
• 4.7: Manage default accounts (IG1)
• 4.8: Uninstall or disable unnecessary services (IG2)

**Implementation**:

• CIS Benchmarks, DISA STIGs
• Configuration management tools
• Hardening scripts
• Regular configuration audits

**Common Tools**: CIS-CAT Pro, Ansible, Puppet, Chef

---

Control 5: Account Management

**IG Level**: IG1 | **Safeguards**: 6 (IG1: 4, IG2: 6, IG3: 6)

**Purpose**: Manage lifecycle of system and application accounts

**Key Safeguards**:

• 5.1: Establish and maintain inventory of accounts (IG1)
• 5.2: Use unique passwords (IG1)
• 5.3: Disable dormant accounts (IG1)
• 5.4: Restrict administrator privileges (IG1)
• 5.5: Establish and maintain MFA (IG2)
• 5.6: Centralize account management (IG2)

**Implementation**:

• Identity and Access Management (IAM)
• Multi-factor authentication (MFA)
• Privileged Access Management (PAM)
• Regular access reviews

**Common Tools**: Active Directory, Okta, Duo, CyberArk

---

Control 6: Access Control Management

**IG Level**: IG1 | **Safeguards**: 8 (IG1: 3, IG2: 6, IG3: 8)

**Purpose**: Apply the principle of least privilege

**Key Safeguards**:

• 6.1: Establish access granting process (IG1)
• 6.2: Establish access revoking process (IG1)
• 6.3: Require MFA for externally-exposed applications (IG1)
• 6.4: Require MFA for remote access (IG1)
• 6.5: Require MFA for administrative access (IG2)
• 6.7: Centralize access control (IG2)
• 6.8: Define and maintain role-based access control (IG2)

**Implementation**:

• Role-based access control (RBAC)
• Just-in-time access
• Separation of duties
• Automated provisioning/deprovisioning

**Common Tools**: SailPoint, Saviynt, Azure AD

---

Control 7: Continuous Vulnerability Management

**IG Level**: IG1 | **Safeguards**: 7 (IG1: 3, IG2: 6, IG3: 7)

**Purpose**: Develop process to continuously identify and remediate vulnerabilities

**Key Safeguards**:

• 7.1: Establish and maintain vulnerability management process (IG1)
• 7.2: Establish and maintain remediation process (IG1)
• 7.3: Perform automated operating system patch management (IG1)
• 7.4: Perform automated application patch management (IG1)
• 7.5: Perform automated vulnerability scans (IG2)
• 7.6: Perform automated vulnerability scans of internal networks (IG2)
• 7.7: Remediate detected vulnerabilities (IG2)

**Implementation**:

• Vulnerability scanning (authenticated, unauthenticated)
• Patch management automation
• Risk-based prioritization
• SLA-based remediation

**Common Tools**: Qualys VMDR, Te