CIS Controls Crosswalk: Concrete Actions per Control
StandardOCDFCIS Controls v8.1 as published; the actions per control are this framework's.
All 18 CIS Critical Security Controls v8 and v8.1 mapped to this framework, each with the concrete actions a CDC should drive or verify. Use it three ways: as a gap check asking which controls have no owner, as the business-facing prioritisation narrative of Start here, and as an implementation checklist per tier, since CIS Implementation Groups align with OCDF tiers: IG1≈Essential, IG2≈Standard, IG3≈Advanced. The CDC rarely operates all of these; it must require, verify and consume them instead.
| # | CIS Control | OCDF ref | Concrete actions |
|---|---|---|---|
| 1 | Enterprise asset inventory | ID-1 | Automated discovery on all networks and cloud tenants · weekly reconciliation against directory/DHCP/EDR/MDM · unknown-device process, detect then identify or block · measure accuracy by sampling, publish the % |
| 2 | Software asset inventory | ID-1, PR-4 | Software inventory from endpoint agent/package managers · unauthorized-software review cadence · allowlisting path: script control + block execution from user-writable paths at E → server allowlisting, audit-mode first, at S → workstation allowlisting at A; see Protect |
| 3 | Data protection | ID-2, PR-3 | Classification scheme with owners · map where classified data lives, reusing GDPR Art. 30 records · encrypt at rest/in transit per class · retention + secure disposal defined · egress/DLP proportionate to class · access logs on sensitive stores into the SIEM |
| 4 | Secure configuration | PR-4 | Adopt hardening baselines such as CIS Benchmarks per platform · golden images/IaC so systems arrive hardened · configuration-drift monitoring into DETECT · secure defaults verified at procurement · session lock, firewall-on, default-deny on servers |
| 5 | Account management | PR-1 | Full account inventory incl. service accounts with owners · joiner/mover/leaver with same-day disable · quarterly dormant-account review, disabling anything unused over 45 days · unique accounts, no shared admin · separate admin accounts from daily-driver identities |
| 6 | Access control management | PR-1 | MFA everywhere externally and for all admin access, phishing-resistant for privileged · role-based access with documented grant/revoke · annual access recertification on crown jewels · PAM for tier-0 · centralise authorisation through the IdP |
| 7 | Continuous vulnerability management | ID-4, PR-5 | Authenticated scans at least monthly, quarterly at E, plus external scans · risk-based remediation SLAs, measured in days for actively exploited and KEV items · emergency-patch process drilled · track SLA attainment as a KPI, report to GOVERN |
| 8 | Audit log management | DE-1 | Central collection per the priority list in Detect · time sync verified · retention meets legal and IR needs, typically ≥12 months hot or reachable · log-integrity protection · coverage check: every crown jewel emits telemetry · review DNS/URL/command-line audit enrichment at S/A |
| 9 | Email & web protections | PR-9, Protect | DMARC in enforcing mode, SPF, DKIM on all sending domains · mail gateway with attachment sandboxing/file-type blocking · protective DNS filtering for all endpoints incl. remote · browsers on supported versions with extension control · block/flag lookalike-domain and external-sender markers |
| 10 | Malware defenses | PR-4 | EDR on every supported endpoint and server, coverage measured at ≥95% · anti-malware signatures auto-update · disable autorun/autoplay on removable media · EDR telemetry into DETECT as source 2 · EDR tamper-protection on |
| 11 | Data recovery | PR-7, RC | Automated backups for all in-scope data · one offline/immutable copy · encryption of backups · quarterly restore tests, annual full-service recovery exercise, ransomware-scale at A · backup infrastructure isolated from production identity, with no domain-joined backup servers |
| 12 | Network infrastructure management | PR-6 | Network device inventory + supported versions only · management plane on a dedicated network/VLAN with MFA · configs in version control with diff alerts · default-deny between zones documented · decommission process removes stale rules |
| 13 | Network monitoring & defense | DE-1, DE-7 | Netflow/DNS/proxy logs central · IDS/NDR where unmanaged devices or flat segments exist, per Detect · alert on new device in critical segments · egress filtering + detection of denied-egress attempts · remote-access anomaly detection via IdP |
| 14 | Security awareness & skills training | PR-2, Roles & competences | Role-based annual training + onboarding module · phishing simulation with reporting culture as the metric rather than click-rate shaming · developer and admin-specific tracks · management training per NIS2 Art. 20 · CDC team skills matrix on ECSF, reviewed twice yearly |
| 15 | Service provider management | GV-6, MSSP checklist | Provider inventory with data/access classification · security requirements + incident-notification clauses in contracts · annual provider review against the checklist · offboarding revokes access same-day · monitor provider incidents, because they are your incidents |
| 16 | Application software security | PR-8 | Secure SDLC requirements for in-house code · dependency/SCA scanning in CI · secrets out of code via a vault plus scanning · pre-production security testing · vulnerability disclosure channel, also a NIS2 Art. 21(2)(e) expectation |
| 17 | Incident response management | RESPOND, playbooks | Named IR roles with deputies · IR plan + top-scenario playbooks approved · statutory reporting machinery drilled against the 24 h clock · annual exercise incl. management · post-incident reviews with tracked actions |
| 18 | Penetration testing | DE-6, Start here | Only after Controls 1–11 have substance. A pentest against no inventory, MFA or backups documents known gaps expensively · scope against crown jewels and the threat profile · rules of engagement signed before any test · findings enter the same backlog as ID-7 · A-tier: purple teaming and TLPT under DORA Art. 26 where applicable |
How to work with this crosswalk
- Assign an owner per control row; many sit outside the CDC, which is exactly the point of writing them down. Classify each external row with the dependency markers from Introduction: [GATE], [HARD] or [SOFT].
- Walk it in the annual calendar: one quarter per 4–5 controls keeps the review load sane.
- Tie evidence to the controls register in CSIRT community layer §4. CIS safeguard evidence and NIS2 Art. 21 evidence overlap heavily; collect once, use twice.
- Tier honestly: IG1/Essential rows first, in the Start here order. The bolded actions above are the ones most often missing in otherwise mature environments.
Sources
- CIS, CIS Critical Security Controls v8.1 and Implementation Groups. https://www.cisecurity.org/controls. © Center for Internet Security; control names referenced with attribution, safeguard texts paraphrased.
- Cross-references: NIS2 Art. 21(2); DORA Art. 26 on TLPT; NIST CSF 2.0.
Open CDC Framework, licensed CC BY 4.0.