CIS Controls v8

Authorized software inventory, asset management, vulnerability management, secure coding.


Short name	CIS
Region	International
Country or scope	International
Sector	General
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CIS

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 18 controls from Safeguard's control catalog for CIS.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for CIS and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CIS-CTL-2.1` Software Asset Inventory	Establish and maintain a detailed inventory of all licensed software installed on enterprise assets (CIS Controls v8, Safeguard 2.1)	Scan
`CIS-CTL-2.1V` Inventory Records Version	The software inventory must document attributes including the version of each item so that authorised software can be distinguished from outdated software (CIS Controls v8, Safeguard 2.1 attributes)	Scan
`CIS-CTL-16.4` Third-Party Component Inventory	Establish and manage an inventory of third-party software components used in development, including supplier/source attribution for each component (CIS Controls v8, Safeguard 16.4)	Scan
`CIS-CTL-7.1` Vulnerability Management Correlation	A continuous vulnerability management process requires components to carry standard identifiers (PURL/CPE) so scan results and advisories can be matched to the inventory (CIS Controls v8, Control 7)	Scan
`CIS-CTL-2.2` Supported and Pinned Software	Ensure only currently supported software is authorised, which requires exact rather than vague version declarations to judge support status (CIS Controls v8, Safeguard 2.2)	Scan
`CIS-CTL-16.11` Trusted Component Integrity	Leverage vetted modules from trusted sources; verifying that a component is the vetted artefact requires published integrity hashes (CIS Controls v8, Safeguard 16.11)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CIS-1.1`	Establish and Maintain an Enterprise Asset Inventory
`CIS-2.1`	Establish and Maintain a Software Asset Inventory
`CIS-3.1`	Establish and Maintain a Data Management Process
`CIS-4.1`	Establish and Maintain a Secure Configuration Process
`CIS-5.1`	Establish and Maintain an Inventory of Accounts
`CIS-6.1`	Establish an Access Granting Process
`CIS-7.1`	Establish and Maintain a Vulnerability Management Process
`CIS-8.1`	Establish and Maintain an Audit Log Management Process
`CIS-9.1`	Ensure Use of Only Fully Supported Browsers and Email Clients
`CIS-10.1`	Deploy and Maintain Anti-Malware Software
`CIS-11.1`	Establish and Maintain a Data Recovery Practice
`CIS-12.1`	Ensure Network Infrastructure is Up-to-Date
`CIS-13.1`	Centralize Security Event Alerting
`CIS-14.1`	Establish and Maintain a Security Awareness Program
`CIS-15.1`	Establish and Maintain a Service Provider Inventory
`CIS-16.1`	Establish and Maintain a Secure Application Development Process
`CIS-17.1`	Establish and Maintain a Documented Incident Response Process
`CIS-18.1`	Establish and Maintain a Penetration Testing Program

Policy templates

Written for CIS:

Asset Management and Vulnerability Management Policy (CIS v8)
Access Control and Audit Logging Policy (CIS v8)

And 22 from the standard set, adapted to CIS.