# Cis Expert

> CIS Controls v8 expert for baseline security. Deep knowledge of 18 controls, 153 safeguards, Implementation Groups (IG1/IG2/IG3), and practical implementation guidance for organizations of all sizes.

- Skill: `grcengclub/cis-expert` (Agent Skill)
- Install (CLI): `npx skillmds@latest add grcengclub/cis-expert`
- Raw SKILL.md: https://api.skillmd.com/api/skills/grcengclub/cis-expert/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: grcengclub (https://skillmd.com/u/grcengclub)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/grcengclub/cis-expert

---


# CIS Controls Expert

Deep expertise in CIS Controls v8, the baseline cybersecurity framework developed by the Center for Internet Security.

> **License notice.** This skill incorporates content derived from **CIS Controls v8**, © Center for Internet Security, Inc., used under the [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/) license. This file and other CIS-derived content in `plugins/frameworks/cis-controls/` are licensed under CC BY-SA 4.0 (the rest of the repository is MIT). See [LICENSE-CIS.md](../../LICENSE-CIS.md).

## Expertise Areas

### CIS Controls Overview

**Purpose**: Prioritized set of actions to defend against the most pervasive cyber threats
**Authority**: Center for Internet Security (CIS) - global non-profit
**Current Version**: CIS Controls v8 (May 2021)
**Adoption**: Cross-industry standard, used globally by organizations of all sizes

**Key Principles**:

- Offense informs defense (based on real-world attack data)
- Prioritization (most impactful controls first)
- Measurements and metrics
- Continuous diagnostics and mitigation
- Automation where possible

**Evolution from v7 to v8**:

- Consolidated from 20 to 18 controls
- Better alignment with Implementation Groups
- Enhanced cloud and mobile coverage
- Stronger integration with NIST CSF
- More actionable safeguards (171 to 153 refined)

### Implementation Groups (IG1, IG2, IG3)

The core innovation of CIS Controls: tailored security based on organizational maturity and risk.

#### IG1 - Essential Cyber Hygiene

**Target Audience**:

- Small to medium businesses (typically <100 employees)
- Limited IT security resources (1-2 generalist IT staff)
- Organizations with low attack surface
- Standard business risk profile
- Minimal regulatory requirements

**Characteristics**:

- **Safeguards**: 56 essential controls
- **Resource Model**: Part-time security focus, leveraging generalist IT
- **Budget**: $10,000 - $50,000 annually
- **Expertise**: Basic IT competency, limited specialized security knowledge
- **Tools**: Commercial off-the-shelf, small business focused

**Attack Profile IG1 Defends Against**:

- Opportunistic attacks (phishing, commodity ransomware)
- Automated vulnerability scanning and exploitation
- Drive-by malware downloads
- Script kiddies and unsophisticated actors
- Social engineering targeting general workforce

**Example Organizations**:

- Local retail stores
- Small healthcare practices (1-3 doctors)
- Professional services (law firms, accounting)
- Regional nonprofits
- K-12 schools (individual schools, not districts)
- Small manufacturers

**Critical IG1 Safeguards**:

1. Asset and software inventory (1.1, 2.1)
2. Secure configurations (4.1, 4.2)
3. Account management (5.1, 5.3, 5.4)
4. Automated patching (7.3, 7.4)
5. Anti-malware (10.1, 10.2)
6. Backups (11.2, 11.3)
7. Security awareness (14.1)

#### IG2 - Enterprise Security

**Target Audience**:

- Medium to large organizations (100-1,000 employees)
- Dedicated IT team with security responsibilities
- Moderate risk environment
- Customer or patient data handling (PII, PHI)
- Regulatory compliance needs (HIPAA, PCI-DSS)

**Characteristics**:

- **Safeguards**: 128 total (56 from IG1 + 72 additional)
- **Resource Model**: 1-3 dedicated security FTEs, larger IT team
- **Budget**: $100,000 - $500,000 annually
- **Expertise**: Security specialists, some advanced training
- **Tools**: Enterprise-grade (SIEM, EDR, vulnerability management)

**Attack Profile IG2 Defends Against**:

- Targeted phishing and spear-phishing campaigns
- Ransomware-as-a-Service (RaaS) operators
- Financially motivated cybercriminal groups
- Business email compromise (BEC)
- Credential stuffing and password spraying
- Industrial espionage (mid-tier)
- Supply chain attacks (lower sophistication)

**Example Organizations**:

- Mid-sized healthcare systems (regional hospitals)
- Community banks and credit unions
- Manufacturing companies (100-500 employees)
- SaaS startups (Series B/C)
- School districts and community colleges
- MSPs and IT service providers

**Critical IG2 Safeguards** (beyond IG1):

1. Multi-factor authentication (5.5)
2. Encryption (3.6, 3.10, 3.11)
3. Centralized logging and SIEM (8.9, 8.11)
4. Vulnerability scanning (7.5, 7.6)
5. Network segmentation (12.2)
6. IDS/IPS (13.2, 13.3)
7. Secure SDLC (16.1, 16.2)
8. Penetration testing (18.1, 18.2)

#### IG3 - Advanced Security

**Target Audience**:

- Large enterprises (1,000+ employees)
- Critical infrastructure organizations
- High-value intellectual property
- Known targets of nation-state actors
- Stringent regulatory environments (CMMC Level 3, NERC CIP)

**Characteristics**:

- **Safeguards**: 153 total (128 from IG2 + 25 additional)
- **Resource Model**: Security Operations Center (SOC), 5+ security FTEs
- **Budget**: $1,000,000+ annually
- **Expertise**: Highly specialized (threat hunters, forensics, IR specialists)
- **Tools**: Advanced threat detection, threat intelligence, SOAR platforms

**Attack Profile IG3 Defends Against**:

- Advanced Persistent Threats (APTs)
- Nation-state sponsored cyber espionage
- Sophisticated ransomware groups (Conti, REvil successors)
- Zero-day exploit campaigns
- Insider threats (malicious and negligent)
- Supply chain compromise (SolarWinds-level)
- Living-off-the-land (LOTL) techniques
- Multi-stage attacks with custom malware

**Example Organizations**:

- Fortune 500 companies
- Defense industrial base contractors
- Major healthcare systems (multi-state)
- Large financial institutions (national/global banks)
- Energy sector (utilities, pipelines)
- Telecommunications providers
- Federal/state government agencies
- Universities with significant research programs

**Critical IG3 Safeguards** (beyond IG2):

1. Behavioral anti-malware and EDR (10.7)
2. Data loss prevention (3.13)
3. Privileged access workstations (12.8)
4. Application layer filtering / WAF (13.10)
5. Alert tuning and threat hunting (13.11)
6. Application penetration testing (16.13)
7. Internal penetration testing (18.5)
8. Post-incident reviews (17.8)

### The 18 CIS Controls (Detailed)

#### Control 1: Inventory and Control of Enterprise Assets

**Why It Matters**: You can't protect what you don't know exists.

**Asset Types**:

- End-user devices (laptops, desktops, tablets, smartphones)
- Servers (physical, virtual, cloud instances)
- Network infrastructure (routers, switches, firewalls, wireless APs)
- Network-attached storage (NAS)
- IoT and OT devices (printers, cameras, industrial control systems)

**Required Information**:

- Hardware make/model, serial number
- Network address (IP, MAC)
- Purpose/function
- Owner/custodian
- Physical/logical location
- Software/OS version
- Support status (vendor-supported, EOL)

**Implementation Approaches**:

- **Passive Discovery**: DHCP logs, network flow analysis, SPAN port monitoring
- **Active Scanning**: Nmap, Qualys, Rapid7, Lansweeper
- **Agent-Based**: Endpoint agents reporting to CMDB
- **Cloud**: AWS Config, Azure Resource Graph, GCP Asset Inventory
- **Manual**: Spreadsheets (only for very small orgs, IG1)

**Common Challenges**:

- Shadow IT (unapproved devices)
- BYOD (personal devices accessing corporate resources)
- Transient devices (visitor laptops, contractors)
- IoT proliferation (smart TVs, voice assistants, smart building tech)
- Cloud resource sprawl (forgotten EC2 instances)

---

#### Control 2: Inventory and Control of Software Assets

**Why It Matters**: Unauthorized software = unpatched vulnerabilities and compliance gaps.

**Software Categories**:

- Operating systems and firmware
- Business applications (ERP, CRM, productivity suites)
- Development tools and runtime environments
- Security tools
- Third-party libraries and dependencies
- Browser extensions and plugins

**Safeguard Highlights**:

- **2.1**: Software inventory (name, version, publisher, install date)
- **2.2**: Ensure software is vendor-supported (no EOL software)
- **2.3**: Address unauthorized software (removal or approval)
- **2.4**: Automated inventory tools (SCCM, Jamf, Ivanti)
- **2.5 (IG2)**: Application allowlisting (only approved software runs)
- **2.6 (IG2)**: Library allowlisting (approved DLLs, shared libraries)
- **2.7 (IG3)**: Script allowlisting (PowerShell, Python, Bash restrictions)

**Implementation Approaches**:

- **Endpoint agents**: Report installed software to central repository
- **Package managers**: Track software deployment (SCCM, Ansible, Puppet)
- **Application control**: AppLocker, Windows Defender Application Control, macOS Gatekeeper
- **Container registries**: Docker Hub controls, approved base images
- **SaaS discovery**: Cloud Access Security Broker (CASB) for shadow SaaS

**Common Challenges**:

- Developer workstations (require flexibility for tools)
- Open-source software tracking
- Software sprawl (users installing unauthorized apps)
- Legacy software (unsupported but business-critical)
- Cloud applications (SaaS discovery and control)

---

#### Control 3: Data Protection

**Why It Matters**: Data is the crown jewels. Protect it or lose competitive advantage, customer trust, and regulatory compliance.

**Data Lifecycle**:

1. **Creation**: How data enters the organization
2. **Storage**: Where data resides (databases, file shares, cloud)
3. **Use**: How data is accessed and processed
4. **Sharing**: Internal and external data transmission
5. **Archive**: Long-term retention
6. **Destruction**: Secure disposal

**Key Safeguards**:

- **3.1**: Data management process
- **3.2**: Data inventory (what sensitive data exists, where)
- **3.3**: Data access control lists (least privilege)
- **3.4**: Data retention policy and enforcement
- **3.5**: Secure data disposal (wiping, destruction)
- **3.6 (IG2)**: Encrypt data on end-user devices (full disk encryption)
- **3.7 (IG2)**: Data classification scheme (public, internal, confidential, restricted)
- **3.10 (IG2)**: Encrypt sensitive data in transit (TLS 1.2+)
- **3.11 (IG2)**: Encrypt sensitive data at rest (database encryption, file encryption)
- **3.12 (IG2)**: Segment data by sensitivity (network/storage isolation)
- **3.13 (IG3)**: Deploy DLP solution (prevent exfiltration)
- **3.14 (IG3)**: Log sensitive data access (who accessed what, when)

**Data Classification Examples**:

- **Public**: Marketing materials, public-facing website content
- **Internal**: Internal memos, policies, general business data
- **Confidential**: Customer PII, employee records, financial data
- **Restricted**: Trade secrets, M&A data, regulated data (HIPAA, ITAR)

**Encryption Standards**:

- **At Rest**: AES-256, database TDE (Transparent Data Encryption)
- **In Transit**: TLS 1.2+ (prefer TLS 1.3), VPN (IPsec, WireGuard)
- **Email**: S/MIME, PGP for highly sensitive
- **Cloud**: CSP-managed keys (AWS KMS, Azure Key Vault) or customer-managed (BYOK)

**Data Disposal Methods**:

- **Physical media**: Shredding (hard drives), degaussing, incineration
- **Digital**: Multi-pass overwrite (DoD 5220.22-M), cryptographic erasure
- **Cloud**: Delete + verify (ensure backups and snapshots deleted)
- **Certificates of destruction**: For regulated industries

---

#### Control 4: Secure Configuration of Enterprise Assets and Software

**Why It Matters**: Default configurations are insecure. Attackers exploit well-known weaknesses.

**Configuration Management Principles**:

1. **Least Functionality**: Disable unnecessary services, features, protocols
2. **Secure Defaults**: Harden before deployment (not after)
3. **Consistency**: Standard baselines for asset types
4. **Automation**: Configuration-as-code (Infrastructure as Code)
5. **Validation**: Regular audits and drift detection

**Key Safeguards**:

- **4.1**: Secure configuration process (baseline creation, approval, deployment)
- **4.2**: Secure configuration baselines (documented standards)
- **4.3**: Automatic session locking (screen lock after inactivity)
- **4.4**: Implement and manage firewalls (host-based firewalls enabled)
- **4.5 (IG2)**: Implement DMZ (demilitarized zone for internet-facing systems)
- **4.7**: Manage default accounts (disable or rename, change passwords)
- **4.8 (IG2)**: Uninstall or disable unnecessary services (reduce attack surface)

**Hardening Resources**:

- **CIS Benchmarks**: Free, consensus-developed standards (150+ benchmarks)
  - Operating systems (Windows, Linux, macOS)
  - Cloud platforms (AWS, Azure, GCP)
  - Applications (web servers, databases, containers)
  - Network devices (Cisco, Palo Alto)
- **DISA STIGs**: Security Technical Implementation Guides (DoD standard)
- **Vendor Hardening Guides**: Microsoft Security Baselines, Red Hat Security Guide
- **NIST Guidelines**: NIST 800-123 (general server security)

**Configuration Management Tools**:

- **Assessment**: CIS-CAT Pro, OpenSCAP, Nessus compliance checks
- **Enforcement**: Ansible, Puppet, Chef, SaltStack, PowerShell DSC
- **Cloud**: AWS Config, Azure Policy, GCP Security Command Center
- **Containers**: Docker Bench, Kubernetes CIS Benchmark

**Common Hardening Actions**:

- Disable unnecessary services (Telnet, FTP, SMBv1)
- Enable host firewall (Windows Firewall, iptables, pf)
- Configure session timeouts (15 minutes idle)
- Disable USB auto-run
- Set BIOS/UEFI passwords
- Enable Secure Boot
- Configure audit logging
- Disable guest accounts
- Rename or disable default admin accounts

---

#### Control 5: Account Management

**Why It Matters**: Accounts are the keys to the kingdom. Poor account hygiene = easy lateral movement for attackers.

**Account Types**:

- **Standard User Accounts**: Day-to-day work, limited privileges
- **Privileged Accounts**: Administrator, root, domain admin
- **Service Accounts**: Application/service authentication
- **Shared Accounts**: (Avoid! If necessary, tightly control and log)
- **Emergency Access Accounts**: Break-glass for emergencies

**Key Safeguards**:

- **5.1**: Account inventory (all user, admin, service accounts)
- **5.2**: Use unique passwords (no shared passwords)
- **5.3**: Disable dormant accounts (inactive 45-90 days)
- **5.4**: Restrict administrator privileges to dedicated accounts (separate admin and user accounts)
- **5.5 (IG2)**: Establish and maintain MFA (all users, especially admins)
- **5.6 (IG2)**: Centralize account management (SSO, directory services)

**Privileged Account Best Practices**:

- **Separate Accounts**: User account for email/browsing, admin account for administration
- **Just-in-Time (JIT) Access**: Temporary privilege elevation, time-boxed
- **Privileged Access Workstations (PAWs)**: Dedicated hardened systems for admin tasks (IG3)
- **Session Recording**: Record admin sessions for audit
- **Password Vaulting**: Store privileged credentials in vault (CyberArk, HashiCorp Vault, Keeper)

**Service Account Management**:

- Least privilege (only permissions needed)
- Unique per service (not shared across apps)
- Strong, randomly generated passwords (32+ characters)
- Regular password rotation (90-180 days, or eliminate with Managed Service Identities)
- Avoid interactive login rights

**Dormant Account Detection**:

- Last login date tracking
- Automated alerts after 30 days inactive
- Disable after 45-60 days inactive
- Delete after 90-120 days (or per retention policy)

**Multi-Factor Authentication (MFA)**:

- **Something you know**: Password, PIN
- **Something you have**: Hardware token (YubiKey, RSA SecurID), mobile app (Duo, Authenticator)
- **Something you are**: Biometrics (fingerprint, face, iris)

**MFA Strength Hierarchy** (strongest to weakest):

1. **FIDO2/WebAuthn** (hardware security keys, phishing-resistant)
2. **Certificate-based authentication** (PIV/CAC smart cards)
3. **Authenticator app with push notification** (Duo, Microsoft Authenticator)
4. **Time-based one-time password (TOTP)** (Google Authenticator, Authy)
5. **SMS/voice call** (weak, susceptible to SIM swapping - avoid if possible)

**Account Lifecycle**:

1. **Provisioning**: Manager request, HR approval, role-based access
2. **Modification**: Role changes, promotions, transfers
3. **Review**: Quarterly access reviews, recertification
4. **Deprovisioning**: Immediate upon termination, documented process

---

#### Control 6: Access Control Management

**Why It Matters**: Principle of least privilege prevents lateral movement and limits blast radius.

**Access Control Models**:

- **Role-Based Access Control (RBAC)**: Access based on job function
- **Attribute-Based Access Control (ABAC)**: Access based on attributes (department, clearance, location)
- **Mandatory Access Control (MAC)**: System-enforced, label-based (government/military)
- **Discretionary Access Control (DAC)**: Owner controls access (traditional file permissions)

**Key Safeguards**:

- **6.1**: Access granting process (documented, approved)
- **6.2**: Access revoking process (terminations, role changes)
- **6.3**: Require MFA for externally-exposed applications
- **6.4**: Require MFA for remote access
- **6.5 (IG2)**: Require MFA for administrative access
- **6.7 (IG2)**: Centralize access control (single authoritative source)
- **6.8 (IG2)**: Define and maintain RBAC (standardized roles)

**RBAC Implementation**:

- Define roles based on job functions (not individuals)
- Group permissions into roles (Finance-User, HR-Admin, Developer)
- Assign users to roles (not direct permissions)
- Regular role reviews and updates

**Least Privilege Principles**:

- Default deny (no access unless explicitly granted)
- Need-to-know basis
- Time-limited access (expire elevated access)
- Minimal effective permissions
- Separation of duties (no single person has end-to-end control)

**Remote Access Security**:

- VPN required (no direct internet exposure of internal resources)
- MFA for VPN access
- Split-tunnel vs full-tunnel (consider data sensitivity)
- Device posture checking (Endpoint compliance before access)
- Zero Trust Network Access (ZTNA) for modern approach

**Access Review Process**:

- Quarterly manager reviews of team access
- Annual comprehensive access recertification
- Automated alerts for dormant permissions
- Immediate revocation upon termination
- Audit trail of access changes

---

#### Control 7: Continuous Vulnerability Management

**Why It Matters**: Unpatched vulnerabilities are the #1 attack vector. Speed matters.

**Vulnerability Management Lifecycle**:

1. **Discovery**: Identify assets and vulnerabilities
2. **Prioritization**: Risk-based ranking (not just CVSS)
3. **Remediation**: Patch, mitigate, or accept risk
4. **Verification**: Confirm vulnerability closed
5. **Reporting**: Metrics and trends

**Key Safeguards**:

- **7.1**: Vulnerability management process
- **7.2**: Remediation process (SLAs by severity)
- **7.3**: Automated OS patch management
- **7.4**: Automated application patch management
- **7.5 (IG2)**: Automated vulnerability scans of internal assets
- **7.6 (IG2)**: Automated vulnerability scans of externally-facing assets
- **7.7 (IG3)**: Remediate detected vulnerabilities (risk-based SLAs)

**Vulnerability Scanning**:

- **Frequency**: Weekly internal, monthly external (minimum)
- **Scope**: All internet-facing, all critical internal assets
- **Scan Types**:
  - **Unauthenticated**: External attacker perspective
  - **Authenticated/Credentialed**: Deeper visibility, detect missing patches
  - **Agent-based**: Continuous assessment
- **Tools**: Qualys VMDR, Tenable.io, Rapid7 InsightVM, Nessus

**Patch Management**:

- **Critical Patches**: 15 days (CISA: 15 days for KEV)
- **High Patches**: 30 days
- **Medium Patches**: 60-90 days
- **Low Patches**: Next maintenance window
- **Exceptions**: Document compensating controls, business justification, executive approval

**Prioritization Factors** (beyond CVSS):

- **Exploit availability**: Is there a public exploit? (CISA KEV, Metasploit)
- **Asset criticality**: Production vs dev, customer-facing vs internal
- **Exposure**: Internet-facing vs internal
- **Compensating controls**: Firewall rules, WAF, IPS signatures
- **EPSS Score**: Exploit Prediction Scoring System (probability of exploit)

**Common Challenges**:

- Legacy systems (can't patch without breaking)
- Change control bureaucracy
- Patching windows (maintenance downtime)
- Testing requirements (QA before production)
- Third-party/vendor software (delayed patches)
- Cloud and container patching (immutable infrastructure, redeploy)

---

#### Control 8: Audit Log Management

**Why It Matters**: Logs are the evidence. No logs = no incident detection, no forensics, no compliance.

**What to Log**:

- **Authentication events**: Successful/failed logins, logouts, privilege escalation
- **Account changes**: Creation, deletion, privilege modifications
- **System changes**: Configuration changes, software installation
- **File access**: Sensitive data access (read, write, delete)
- **Network connections**: Firewall logs, VPN, proxy
- **Security events**: AV detections, IDS/IPS alerts, DLP violations

**Key Safeguards**:

- **8.1**: Audit log management process
- **8.2**: Collect audit logs (all critical systems)
- **8.3**: Ensure adequate log storage (capacity planning)
- **8.5 (IG2)**: Collect detailed audit logs (enable verbose logging)
- **8.6 (IG2)**: Collect DNS query logs (detect C2, exfiltration)
- **8.9 (IG2)**: Centralize audit logs (SIEM, log aggregator)
- **8.10 (IG2)**: Retain audit logs (minimum 90 days, prefer 1 year)
- **8.11 (IG2)**: Conduct audit log reviews (manual or automated)
- **8.12 (IG3)**: Collect service provider logs (SaaS, IaaS, PaaS)

**Log Sources**:

- Operating systems (Windows Event Log, syslog)
- Applications (web servers, databases, business apps)
- Security tools (firewall, IDS/IPS, AV, DLP)
- Network devices (routers, switches, wireless)
- Cloud platforms (AWS CloudTrail, Azure Monitor, GCP Cloud Logging)
- Identity providers (Active Directory, Okta, Azure AD)

**Centralized Logging (SIEM)**:

- **Purpose**: Aggregate, correlate, alert, investigate
- **Tools**: Splunk, Elastic Stack (ELK), Microsoft Sentinel, IBM QRadar, Sumo Logic
- **Benefits**: Single pane of glass, correlation, long-term retention, compliance reporting

**Log Retention Requirements**:

- **CIS Baseline**: 90 days minimum (IG2), 1 year recommended
- **PCI DSS**: 1 year (3 months immediately available)
- **HIPAA**: 6 years
- **SOX**: 7 years
- **State breach laws**: Varies (typically 1-2 years)

**Log Review**:

- **Automated Alerting**: High-priority events trigger immediate alerts
- **Daily Review**: Security team reviews critical alerts
- **Weekly Review**: Trend analysis, anomaly detection
- **Monthly Reports**: Executive dashboards, compliance metrics

**Common Log Analysis Use Cases**:

- Failed login attempts (brute force detection)
- Privilege escalation
- After-hours access
- Geographically impossible travel
- Data exfiltration (large outbound transfers)
- Malware execution
- Policy violations

---

#### Control 9: Email and Web Browser Protections

**Why It Matters**: Email and web are the primary attack vectors (90%+ of breaches start with phishing).

**Email Threats**:

- Phishing (credential theft)
- Spear-phishing (targeted)
- Business email compromise (BEC)
- Malware attachments (ransomware, trojans)
- Link-based attacks (malicious URLs)

**Web Threats**:

- Drive-by downloads
- Malicious advertisements (malvertising)
- Exploit kits
- Watering hole attacks
- Compromised websites

**Key Safeguards**:

- **9.1**: Ensure use of fully supported browsers and email clients (no EOL)
- **9.2**: Use DNS filtering services (block malicious domains)
- **9.3**: Maintain network-based URL filters (web proxy, secure web gateway)
- **9.4**: Restrict unnecessary browser and email extensions
- **9.5 (IG2)**: Implement DMARC (email authentication)
- **9.6 (IG2)**: Block unnecessary file types (executables, scripts in email)
- **9.7 (IG2)**: Deploy email server anti-malware

**Email Security Stack**:

1. **Email Gateway**: Mimecast, Proofpoint, Cisco ESA, Microsoft Defender for Office 365
   - Anti-spam, anti-malware, anti-phishing
   - URL rewriting (time-of-click protection)
   - Attachment sandboxing
2. **DMARC/SPF/DKIM**: Email authentication
   - SPF: Sender Policy Framework (authorized sending IPs)
   - DKIM: DomainKeys Identified Mail (cryptographic signing)
   - DMARC: Domain-based Message Authentication, Reporting & Conformance (policy enforcement)
3. **User Reporting**: Phish Alert Button (let users report suspicious emails)
4. **Email Encryption**: S/MIME, PGP for sensitive communications

**DMARC Implementation**:

- Start with monitoring mode (p=none)
- Analyze reports, fix legitimate mail flows
- Move to quarantine (p=quarantine)
- Eventually reject (p=reject) unauthorized email

**Web Filtering**:

- **DNS Filtering**: Cisco Umbrella, Quad9, Cloudflare Gateway (lightweight)
- **Secure Web Gateway (SWG)**: Zscaler, Palo Alto Prisma Access, Menlo Security (deep inspection)
- **Categories to Block**: Malware, phishing, adult content, gambling, anonymizers/proxies

**Browser Security**:

- **Keep Updated**: Auto-update enabled (Chrome, Edge, Firefox)
- **Extension Control**: Allowlist approved extensions, block others
- **Isolation**: Browser isolation for high-risk browsing (Menlo, Ericom)
- **Configuration**: Disable Java, Flash (deprecated), restrict file downloads

---

#### Control 10: Malware Defenses

**Why It Matters**: Malware is pervasive. Defense-in-depth is essential.

**Malware Types**:

- **Ransomware**: Encrypts data, demands payment (REvil, Conti, LockBit)
- **Trojans**: Masquerades as legitimate software (remote access trojans - RATs)
- **Worms**: Self-propagating (WannaCry, NotPetya)
- **Spyware**: Steals information (keyloggers, infostealers)
- **Rootkits**: Hides presence, maintains persistence
- **Cryptominers**: Uses resources to mine cryptocurrency

**Key Safeguards**:

- **10.1**: Deploy anti-malware software (all endpoints)
- **10.2**: Configure automatic signature updates (daily or more)
- **10.3**: Disable autorun and autoplay (USB, CD/DVD)
- **10.4**: Configure automatic anti-malware scanning (real-time + scheduled)
- **10.5 (IG2)**: Enable anti-exploitation features (DEP, ASLR, EMET)
- **10.6 (IG2)**: Centrally manage anti-malware (console, reporting)
- **10.7 (IG3)**: Use behavioral anti-malware (EDR, machine learning)

**Endpoint Protection Evolution**:

1. **Traditional Antivirus (AV)**: Signature-based detection (legacy)
2. **Anti-Malware**: Enhanced AV with heuristics
3. **Endpoint Protection Platform (EPP)**: AV + firewall + device control
4. **Endpoint Detection and Response (EDR)**: Behavioral analysis, threat hunting, forensics
5. **Extended Detection and Response (XDR)**: EDR + network + email + cloud

**Leading Solutions**:

- **Next-Gen AV/EDR**: CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Carbon Black
- **Traditional**: Symantec Endpoint Protection, Trend Micro, Sophos

**Detection Methods**:

- **Signature-based**: Known malware patterns (fast, but misses new threats)
- **Heuristic**: Behavioral analysis (catches variants)
- **Sandboxing**: Execute in isolated environment, observe behavior
- **Machine Learning**: AI-based anomaly detection
- **Indicators of Attack (IoA)**: Detect tactics, techniques, procedures (TTPs)

**Anti-Exploitation Techniques**:

- **DEP (Data Execution Prevention)**: Prevent code execution in data regions
- **ASLR (Address Space Layout Randomization)**: Randomize memory addresses
- **Control Flow Guard (CFG)**: Validate indirect calls
- **Application Guard**: Isolate risky applications (Windows Defender Application Guard)

**Malware Response**:

1. **Isolate**: Quarantine infected endpoint (network isolation)
2. **Investigate**: Determine scope, root cause, lateral movement
3. **Eradicate**: Remove malware, rebuild if necessary
4. **Recover**: Restore from clean backup
5. **Lessons Learned**: Update defenses, user training

---

#### Control 11: Data Recovery

**Why It Matters**: Ransomware, hardware failure, disasters happen. Backups are your insurance policy.

**3-2-1 Backup Rule**:

- **3** copies of data (primary + 2 backups)
- **2** different media types (disk + tape/cloud)
- **1** copy offsite (protect against local disaster)

**Modern Update: 3-2-1-1-0**:

- **3-2-1** (as above)
- **1** immutable/air-gapped copy (ransomware protection)
- **0** errors in backup validation (test restores)

**Key Safeguards**:

- **11.1**: Data recovery process (documented procedures)
- **11.2**: Perform automated backups (scheduled, no manual intervention)
- **11.3**: Protect recovery data (encryption, access control, offsite)
- **11.4**: Establish isolated instance of recovery data (air-gapped, immutable)
- **11.5 (IG2)**: Test data recovery (quarterly or semi-annual restore tests)

**Backup Scope**:

- **Critical Systems**: ERP, CRM, databases, file servers, email
- **User Data**: Home directories, shared drives
- **System State**: OS configurations, Active Directory, certificates
- **Applications**: Application data, configurations

**Backup Types**:

- **Full**: Complete copy of all data (slow, storage-intensive, but fastest restore)
- **Incremental**: Changes since last backup (fast, efficient, slower restore)
- **Differential**: Changes since last full backup (middle ground)
- **Synthetic Full**: Combines full + incrementals to create new full

**Backup Frequency**:

- **Critical systems**: Daily or continuous (CDP - Continuous Data Protection)
- **User data**: Daily
- **Databases**: Transaction log backups (every 15-60 minutes) + daily full
- **Offsite sync**: Daily or weekly

**Backup Testing**:

- **Restore Drills**: Quarterly test restore of random data sets
- **Disaster Recovery Exercises**: Annual full DR test
- **Validation**: Automated backup verification (integrity checks)
- **Documentation**: Maintain restore runbooks

**Ransomware-Resilient Backups**:

- **Immutability**: Write-once-read-many (WORM), object lock (S3 Object Lock)
- **Air-Gap**: Physically or logically isolated (tape in safe, offline disk)
- **Separate Credentials**: Different admin accounts for backup systems
- **Network Segmentation**: Backups on separate VLAN, restricted access

**Backup Solutions**:

- **Traditional**: Veeam, Commvault, Veritas NetBackup, IBM Spectrum Protect
- **Cloud-Native**: AWS Backup, Azure Backup, GCP Cloud Backup
- **SaaS Backup**: Spanning, Veeam for M365 (for Office 365, Google Workspace)
- **Ransomware-Focused**: Rubrik, Cohesity (immutable, zero-trust)

---

#### Control 12: Network Infrastructure Management (IG2)

**Why It Matters**: Network is the highway for data and attacks. Secure the roads.

**Key Safeguards**:

- **12.1**: Ensure network infrastructure is up-to-date (patch routers, switches, firewalls)
- **12.2**: Establish secure network architecture (segmentation, DMZ)
- **12.3**: Securely manage network infrastructure (dedicated admin VLANs, out-of-band)
- **12.4**: Maintain network architecture diagram (current topology)
- **12.6**: Use secure network management protocols (SSH, SNMPv3, no Telnet)
- **12.7**: Ensure remote devices use VPN (encrypt remote access)
- **12.8 (IG3)**: Dedicated computing resources for admins (jump boxes, PAWs)

**Network Segmentation**:

- **Purpose**: Limit lateral movement, isolate critical assets
- **Approaches**:
  - **VLANs**: Virtual LANs (Layer 2 separation)
  - **Subnets**: IP addressing (Layer 3 separation)
  - **Firewalls**: Zone-based firewalls (enforce policy between segments)
  - **Micro-segmentation**: Software-defined, workload-level (zero trust)

**Network Zones**:

- **External/Internet**: Untrusted
- **DMZ (Perimeter Network)**: Internet-facing services (web servers, email gateways)
- **Internal/Corporate**: Workstations, internal applications
- **Restricted/Secure**: High-value assets (databases, HR systems)
- **Management**: Network and security device management (out-of-band)

**DMZ Architecture**:

- **Purpose**: Buffer between internet and internal network
- **Placement**: Dual firewall (external and internal) or screened subnet
- **Assets**: Web servers, mail relays, DNS, reverse proxies
- **Rules**: Strictly limited inbound, no direct access to internal

**Secure Management**:

- **Protocols**: SSH (not Telnet), HTTPS (not HTTP), SNMPv3 (not v1/v2c)
- **Access**: Management VLAN, out-of-band network, jump box
- **Authentication**: Strong passwords, MFA, certificate-based
- **Monitoring**: Log all admin access, session recording

**Network Diagram**:

- **Information**: Devices, IP addresses, VLANs, security zones, data flows
- **Format**: Visio, Draw.io, Lucidchart (keep current, version control)
- **Frequency**: Update quarterly or after major changes

---

#### Control 13: Network Monitoring and Defense (IG2)

**Why It Matters**: Visibility is security. You can't defend against what you can't see.

**Key Safeguards**:

- **13.1**: Centralize security event alerting (SIEM)
- **13.2**: Deploy network-based IDS (intrusion detection)
- **13.3**: Deploy network-based IPS (intrusion prevention)
- **13.4**: Perform traffic filtering (block known-bad IPs, domains)
- **13.6**: Collect network traffic flow logs (NetFlow, IPFIX)
- **13.8**: Deploy network-based anti-malware
- **13.10 (IG3)**: Perform application layer filtering (WAF)
- **13.11 (IG3)**: Tune security event alerting thresholds

**IDS vs IPS**:

- **IDS (Intrusion Detection System)**: Passive monitoring, alerts on threats (Suricata, Snort, Zeek)
- **IPS (Intrusion Prevention System)**: Active blocking, inline (Snort IPS, Palo Alto Threat Prevention)

**Detection Methods**:

- **Signature-based**: Match known attack patterns (Snort rules)
- **Anomaly-based**: Baseline normal traffic, alert on deviations
- **Heuristic**: Behavioral analysis
- **Threat Intelligence**: IP/domain reputation feeds

**Network Traffic Analysis (NTA)**:

- **Tools**: Darktrace, ExtraHop, Vectra AI, Corelight (Zeek-based)
- **Capabilities**:
  - Baseline normal network behavior
  - Detect anomalies (data exfiltration, lateral movement, C2 beaconing)
  - Machine learning-based detection
  - East-west traffic visibility (internal lateral movement)

**NetFlow/IPFIX**:

- **Purpose**: Metadata about network traffic (who, what, when, how much)
- **Data**: Source/dest IP, ports, protocol, bytes transferred, timestamps
- **Tools**: SolarWinds NTA, Plixer Scrutinizer, ManageEngine NetFlow Analyzer
- **Use Cases**: Capacity planning, security investigation, compliance

**Web Application Firewall (WAF)**:

- **Purpose**: Protect web applications from OWASP Top 10
- **Placement**: In front of web servers (cloud or on-prem)
- **Detection**: SQL injection, XSS, CSRF, file inclusion
- **Solutions**: F5 WAF, Imperva, Cloudflare WAF, AWS WAF, Azure WAF

**Alert Tuning (IG3)**:

- **Problem**: Alert fatigue (too many false positives)
- **Solution**: Iterative tuning
  - Baseline environment
  - Disable low-value signatures
  - Whitelist known-good traffic
  - Adjust thresholds
  - Prioritize critical alerts
- **Goal**: High-fidelity alerts that warrant investigation

---

#### Control 14: Security Awareness and Skills Training

**Why It Matters**: Users are the weakest link AND the strongest defense (if trained).

**Key Safeguards**:

- **14.1**: Security awareness program (annual training, all workforce)
- **14.2**: Train on secure authentication (password hygiene, MFA)
- **14.3**: Train on data handling (classification, encryption, disposal)
- **14.4**: Train on identifying social engineering (phishing, vishing, smishing)
- **14.5 (IG2)**: Train on authentication best practices (passphrase, password managers)
- **14.6 (IG2)**: Train on identifying and reporting incidents (when and how to report)
- **14.9 (IG3)**: Conduct role-specific training (developers, admins, executives)

**Awareness Training Program**:

- **Frequency**: Annual mandatory training, quarterly refreshers
- **Topics**:
  - Phishing and social engineering
  - Password security (unique, complex, MFA)
  - Data classification and handling
  - Physical security (tailgating, clean desk)
  - Incident reporting
  - Acceptable use policy
- **Format**: Online modules, videos, quizzes, in-person sessions

**Phishing Simulation**:

- **Purpose**: Test user awareness, identify high-risk users
- **Frequency**: Monthly or quarterly
- **Escalation**: Users who fail multiple times receive additional training
- **Tools**: KnowBe4, Proofpoint Security Awareness, Cofense PhishMe, SANS Securing The Human

**Role-Specific Training (IG3)**:

- **Developers**: Secure coding (OWASP Top 10, input validation, authentication)
- **System Administrators**: Hardening, least privilege, secure remote access
- **Executives**: Business email compromise, social engineering targeting leadership
- **HR/Finance**: W-2 phishing, wire transfer fraud
- **Security Team**: Advanced training (SANS, Offensive Security, certifications)

**Security Culture**:

- **Security Champions**: Ambassadors in each department
- **Gamification**: Rewards for reporting phishing, security wins
- **Communication**: Regular security tips, newsletters, posters
- **Executive Support**: C-suite visibly supports security initiatives

**Measurement**:

- Phishing click rate (goal: <5%)
- Training completion rate (goal: 100%)
- Incident reporting rate (upward trend is good - users reporting more)
- Time to report phishing (faster is better)

---

#### Control 15: Service Provider Management

**Why It Matters**: Third-party risk is your risk. Supply chain attacks are on the rise.

**Key Safeguards**:

- **15.1**: Inventory of service providers (cloud, SaaS, MSPs, vendors)
- **15.2**: Service provider management policy (risk assessment, contracts)
- **15.3 (IG2)**: Classify service providers (by criticality, data access)
- **15.4 (IG2)**: Ensure contracts include security requirements (SLAs, audit rights)
- **15.5 (IG2)**: Assess service providers (questionnaires, certifications)
- **15.6 (IG2)**: Monitor service providers (ongoing, not just initial)
- **15.7 (IG3)**: Securely decommission service providers (data return, deletion)

**Service Provider Types**:

- **Cloud IaaS**: AWS, Azure, GCP (infrastructure)
- **SaaS**: Salesforce, Office 365, Workday (applications)
- **Managed Services**: MSP, MSSP, SOC-as-a-Service
- **Professional Services**: Consultants, auditors, pen testers
- **Business Partners**: Integrations, data sharing

**Risk Classification**:

- **Critical**: Access to sensitive data, single point of failure (e.g., email provider)
- **High**: Access to internal systems, PII (e.g., HR SaaS)
- **Medium**: Limited data access (e.g., marketing platform)
- **Low**: No data access (e.g., office supplies)

**Vendor Assessment Methods**:

- **Security Questionnaires**: SIG (Standard Information Gathering), CAIQ, custom
- **Certifications**: SOC 2, ISO 27001, HITRUST, PCI-DSS (request reports)
- **Penetration Tests**: Request recent pentest results (executive summary)
- **On-Site Audits**: For critical vendors (right-to-audit clause)
- **Continuous Monitoring**: SecurityScorecard, BitSight, UpGuard (external ratings)

**Contract Security Clauses**:

- **Data protection**: Encryption, access control, data location
- **Incident notification**: Timeframe (e.g., 24-72 hours)
- **Right to audit**: Annual or on-demand audits
- **Data ownership**: Customer owns data
- **Data return/deletion**: Upon termination, certificated deletion
- **Subcontractor approval**: Notify of subcontractor changes
- **Insurance**: Cyber liability insurance requirements
- **Compliance**: HIPAA BAA, GDPR DPA, etc.

**Ongoing Monitoring**:

- **Quarterly reviews**: Security posture, incidents, changes
- **Annual recertification**: Review SOC 2, ISO, pentest reports
- **News monitoring**: Breaches, M&A, financial stability
- **Scorecard tracking**: Trend analysis (improving or declining)

**Offboarding**:

- **Data 

…(truncated)