CIS Controls v8 Checklist

Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise's infrastructure in order to remediate and minimise the window of opportunity for attackers.

Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.

Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.

Establish and maintain the secure configuration of network infrastructure assets.

Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise's network infrastructure and user base.

Develop a process to evaluate service providers who hold sensitive data or are responsible for an enterprise's critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately.

Establish a programme to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.

Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls (people, processes, and technology), and mimicking the actions and objectives of an attacker.