Showing 117 controls
Utilize an Active Discovery Tool
The goal is to ensure that appropriate safeguards are in place and effective.
Use a Passive Asset Discovery Tool
The goal is to ensure that appropriate safeguards are in place and effective.
Deploy and Maintain Anti-Malware Software
The goal is to ensure that appropriate safeguards are in place and effective.
Configure Automatic Anti-Malware Scanning of Removable Media
The goal is to ensure that appropriate safeguards are in place and effective.
Use Behavior-Based Anti-Malware Software
The goal is to ensure that appropriate safeguards are in place and effective.
Tune Security Event Alerting Thresholds
The goal is to ensure that appropriate safeguards are in place and effective.
Deploy a Host-Based Intrusion Detection Solution
The goal is to ensure that appropriate safeguards are in place and effective.
Deploy a Network Intrusion Detection Solution
The goal is to ensure that appropriate safeguards are in place and effective.
Collect Network Traffic Flow Logs
The goal is to ensure that appropriate safeguards are in place and effective.
Perform Periodic External Penetration Tests
The goal is to ensure that appropriate safeguards are in place and effective.
Perform Periodic Internal Penetration Tests
The goal is to ensure that appropriate safeguards are in place and effective.
Utilize Automated Software Inventory Tools
The goal is to ensure that appropriate safeguards are in place and effective.
Log Sensitive Data Access
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Data Recovery Process
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain Architecture Diagram(s)
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Security Awareness Program
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Service Provider Management Policy
The goal is to ensure that appropriate safeguards are in place and effective.
Classify Service Providers
The goal is to ensure that appropriate safeguards are in place and effective.
Ensure Service Provider Contracts Include Security Requirements
The goal is to ensure that appropriate safeguards are in place and effective.
Assess Service Providers
The goal is to ensure that appropriate safeguards are in place and effective.
Monitor Service Providers
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Secure Application Developmentxa0Process
The goal is to ensure that appropriate safeguards are in place and effective.
Conduct Application Penetration Testing
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Process to Accept and Address Software Vulnerabilities
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain Contact Information for Reporting Security Incidents
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain an Enterprise Process for Reporting Incidents
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain an Incident Response Process
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Penetration Testing Program
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Data Management Process
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Secure Configuration Process
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Secure Configuration Process for Network Infrastructure
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain Detailed Enterprise Asset Inventory
The goal is to ensure that appropriate safeguards are in place and effective.
Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain an Inventory of Service Providers
The goal is to ensure that appropriate safeguards are in place and effective.
Leverage Vetted Modules or Services for Application Security Components
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Manage an Inventory of Third-Party Software Components
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Software Inventory
The goal is to ensure that appropriate safeguards are in place and effective.
Ensure Authorized Software is Currently Supported
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Data Inventory
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Data Classification Scheme
The goal is to ensure that appropriate safeguards are in place and effective.
Document Data Flows
The goal is to ensure that appropriate safeguards are in place and effective.
Configure Automatic Anti-Malware Signature Updates
The goal is to ensure that appropriate safeguards are in place and effective.
Disable Autorun and Autoplay for Removable Media
The goal is to ensure that appropriate safeguards are in place and effective.
Enable Anti-Exploitation Features
The goal is to ensure that appropriate safeguards are in place and effective.
Centrally Manage Anti-Malware Software
The goal is to ensure that appropriate safeguards are in place and effective.
Protect Recovery Data
The goal is to ensure that appropriate safeguards are in place and effective.
Ensure Network Infrastructure is Up-to-Date
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain a Secure Network Architecture
The goal is to ensure that appropriate safeguards are in place and effective.
Securely Manage Network Infrastructure
The goal is to ensure that appropriate safeguards are in place and effective.
Centralize Network Authentication, Authorization, and Auditing (AAA)
The goal is to ensure that appropriate safeguards are in place and effective.
Use of Secure Network Management and Communication Protocols
The goal is to ensure that appropriate safeguards are in place and effective.
Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise???s AAA Infrastructure
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain Dedicated Computing Resources for All Administrative Work
The goal is to ensure that appropriate safeguards are in place and effective.
Perform Application Layer Filtering
The goal is to ensure that appropriate safeguards are in place and effective.
Perform Traffic Filtering Between Network Segments
The goal is to ensure that appropriate safeguards are in place and effective.
Manage Access Control for Remote Assets
The goal is to ensure that appropriate safeguards are in place and effective.
Deploy a Host-Based Intrusion Prevention Solution
The goal is to ensure that appropriate safeguards are in place and effective.
Deploy a Network Intrusion Prevention Solution
The goal is to ensure that appropriate safeguards are in place and effective.
Deploy Port-Level Access Control
The goal is to ensure that appropriate safeguards are in place and effective.
Train Workforce Members to Recognize Social Engineering Attacks
The goal is to ensure that appropriate safeguards are in place and effective.
Train Workforce Members on Authentication Best Practices
The goal is to ensure that appropriate safeguards are in place and effective.
Train Workforce on Data Handling Best Practices
The goal is to ensure that appropriate safeguards are in place and effective.
Train Workforce Members on Causes of Unintentional Data Exposure
The goal is to ensure that appropriate safeguards are in place and effective.
Train Workforce Members on Recognizing and Reporting Security Incidents
The goal is to ensure that appropriate safeguards are in place and effective.
Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
The goal is to ensure that appropriate safeguards are in place and effective.
Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks
The goal is to ensure that appropriate safeguards are in place and effective.
Conduct Role-Specific Security Awareness and Skills Training
The goal is to ensure that appropriate safeguards are in place and effective.
Securely Decommission Service Providers
The goal is to ensure that appropriate safeguards are in place and effective.
Implement Code-Level Security Checks
The goal is to ensure that appropriate safeguards are in place and effective.
Conduct Threat Modeling
The goal is to ensure that appropriate safeguards are in place and effective.
Perform Root Cause Analysis on Security Vulnerabilities
The goal is to ensure that appropriate safeguards are in place and effective.
Use Up-to-Date and Trusted Third-Party Software Components
The goal is to ensure that appropriate safeguards are in place and effective.
Use Standard Hardening Configuration Templates for Application Infrastructure
The goal is to ensure that appropriate safeguards are in place and effective.
Separate Production and Non-Production Systems
The goal is to ensure that appropriate safeguards are in place and effective.
Train Developers in Application Security Concepts and Secure Coding
The goal is to ensure that appropriate safeguards are in place and effective.
Remediate Penetration Test Findings
The goal is to ensure that appropriate safeguards are in place and effective.
Validate Security Measures
The goal is to ensure that appropriate safeguards are in place and effective.
Allowlist Authorized Software
The goal is to ensure that appropriate safeguards are in place and effective.
Allowlist Authorized Libraries
The goal is to ensure that appropriate safeguards are in place and effective.
Allowlist Authorized Scripts
The goal is to ensure that appropriate safeguards are in place and effective.
Encrypt Sensitive Data at Rest
The goal is to ensure that appropriate safeguards are in place and effective.
Segment Data Processing and Storage Based on Sensitivity
The goal is to ensure that appropriate safeguards are in place and effective.
Deploy a Data Loss Prevention Solution
The goal is to ensure that appropriate safeguards are in place and effective.
Configure Data Access Control Lists
The goal is to ensure that appropriate safeguards are in place and effective.
Enforce Data Retention
The goal is to ensure that appropriate safeguards are in place and effective.
Securely Dispose of Data
The goal is to ensure that appropriate safeguards are in place and effective.
Encrypt Data on End-User Devices
The goal is to ensure that appropriate safeguards are in place and effective.
Encrypt Data on Removable Media
The goal is to ensure that appropriate safeguards are in place and effective.
Enforce Remote Wipe Capability on Portable End-User Devices
The goal is to ensure that appropriate safeguards are in place and effective.
Separate Enterprise Workspaces on Mobile End-User Devices
The goal is to ensure that appropriate safeguards are in place and effective.
Configure Automatic Session Locking on Enterprise Assets
The goal is to ensure that appropriate safeguards are in place and effective.
Implement and Manage a Firewall on Servers
The goal is to ensure that appropriate safeguards are in place and effective.
Implement and Manage a Firewall on End-User Devices
The goal is to ensure that appropriate safeguards are in place and effective.
Securely Manage Enterprise Assets and Software
The goal is to ensure that appropriate safeguards are in place and effective.
Manage Default Accounts on Enterprise Assets and Software
The goal is to ensure that appropriate safeguards are in place and effective.
Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
The goal is to ensure that appropriate safeguards are in place and effective.
Configure Trusted DNS Servers on Enterprise Assets
The goal is to ensure that appropriate safeguards are in place and effective.
Ensure Use of Only Fully Supported Browsers and Email Clients
The goal is to ensure that appropriate safeguards are in place and effective.
Use DNS Filtering Services
The goal is to ensure that appropriate safeguards are in place and effective.
Maintain and Enforce Network-Based URL Filters
The goal is to ensure that appropriate safeguards are in place and effective.
Restrict Unnecessary or Unauthorized Browser and Email Client Extensions
The goal is to ensure that appropriate safeguards are in place and effective.
Implement DMARC
The goal is to ensure that appropriate safeguards are in place and effective.
Block Unnecessary File Types
The goal is to ensure that appropriate safeguards are in place and effective.
Deploy and Maintain Email Server Anti-Malware Protections
The goal is to ensure that appropriate safeguards are in place and effective.
Perform Automated Backups
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain an Isolated Instance of Recovery Data
The goal is to ensure that appropriate safeguards are in place and effective.
Test Data Recovery
The goal is to ensure that appropriate safeguards are in place and effective.
Conduct Routine Incident Response Exercises
The goal is to ensure that appropriate safeguards are in place and effective.
Conduct Post-Incident Reviews
The goal is to ensure that appropriate safeguards are in place and effective.
Establish and Maintain Security Incident Thresholds
The goal is to ensure that appropriate safeguards are in place and effective.
Address Unauthorized Assets
The goal is to ensure that appropriate safeguards are in place and effective.
Designate Personnel to Manage Incident Handling
The goal is to ensure that appropriate safeguards are in place and effective.
Assign Key Roles and Responsibilities
The goal is to ensure that appropriate safeguards are in place and effective.
Define Mechanisms for Communicating During Incident Response
The goal is to ensure that appropriate safeguards are in place and effective.
Address Unauthorized Software
The goal is to ensure that appropriate safeguards are in place and effective.
System Interconnections
Desired outcome.