[Day 3] 2. CIS Critical Security Controls (01, 02, 03)

Control 01: Inventory and Control of Enterprise Assets

Actively manage (inventory, track, and correct) all enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/Internet of Things (IoT) devices; and servers) connected to the infrastructure physically, virtually, remotely, and those within cloud environments, to accurately know the totality of assets that need to be monitored and protected within the enterprise. This will also support identifying unauthorised and unmanaged assets to remove or remediate.

Safeguards: 1.1 Establish and Maintain Detailed Enterprise Asset Inventory 1.2 Address Unauthorised Assets 1.3 Utilise an Active Discovery Tool 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory 1.5 Use a Passive Asset Discovery Tool

Control 02: Inventory and Control of Software Assets

Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that only authorised software is installed and can execute, and that unauthorised and unmanaged software is found and prevented from installation or execution.

Safeguards: 2.1 Establish and Maintain a Software Inventory 2.2 Ensure Authorised Software is Currently Supported 2.3 Address Unauthorised Software 2.4 Utilise Automated Software Inventory Tools 2.5 Allow list Authorised Software 2.6 Allow list Authorised Libraries 2.7 Allow list Authorised Scripts

Control 03: Data Protection

Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.

Safeguards: 3.1 Establish and Maintain a Data Management Process 3.2 Establish and Maintain a Data Inventory 3.3 Configure Data Access Control Lists 3.4 Enforce Data Retention 3.5 Securely Dispose of Data 3.6 Encrypt Data on End-User Devices 3.7 Establish and Maintain a Data Classification Scheme 3.8 Document Data Flows 3.9 Encrypt Data on Removable Media 3.10 Encrypt Sensitive Data in Transit 3.11 Encrypt Sensitive Data at Rest 3.12 Segment Data Processing and Storage Based on Sensitivity 3.13 Deploy a Data Loss Prevention Solution 3.14 Log Sensitive Data Access