cis-controls

A workspace to collaborate mapping updates to the Center for Internet Security (CIS) Critical Security Controls (CSC).

Overview

The documents posted here are for collaboration with my security colleagues to review suggestive changes in preparation for submission to the CIS Controls Community for official review and possible inclusion. Again, the proposed changes are not an official publication, but are posted here for research and for collaborative purposes.

The goal is to map all the CIS Critical Security Controls v8 to the following references:

To share your feedback after you review the proposed changes, please submit a Github New Issue, so we can discuss. Looking forward to collaborating with you.

The last review was conducted on 8/20/2023.

CIS Critical Security Controls v8 Mapping to NIST 800-53 Rev. 5

Download the modified spreadsheet to review the proposed changes. A PDF is also available.

The proposed changes are based on the latest official publication that can be downloaded at CIS Critical Security Controls v8 Mapping to NIST 800-53 Rev. 5 (Moderate and Low Baselines).

Summary of the proposed changes:

All CIS Controls have been mapped to NIST SP 800-53r5 controls and baselines
Added Privacy, Low, and High baselines
Added Unmapped 800-53 High sheet
Baseline corrections:
- NIST Control AU-11 baseline for CIS 3.1 is low not moderate
- NIST Control CM-2 baseline for CIS 4.2 is low not moderate
- NIST Control CM-6 baseline for CIS 4.2 and 12.3 is low not moderate
- NIST Control CM-7 baseline for CIS 4.2 and 12.3 is low not moderate
- NIST Control CM-10 baseline for CIS Control 2.3 and 9.4 is low not moderate
- NIST Control CM-11 baseline for CIS 9.4 is low not moderate
- NIST Control CM-8 baseline for CIS 16.4 is low not moderate
- NIST Control IR-6 baseline for CIS 17.4 is low not moderate
- NIST Control IR-8 baseline for CIS 17.6 is low not moderate
- NIST Control RA-2 baseline for CIS 3.2 is N/A not low
- NIST Control SC-7(3) baseline for CIS 9.3 is moderate not low
- NIST Control SC-7(4) baseline for CIS 9.3 is moderate not low
- NIST Control SC-18 baseline for CIS 9.1 is moderate not low
- NIST Control SC-39 baseline for CIS 4.12 is low not moderate
- NIST Control SI-4 baseline for CIS 15.5 is low not moderate
- NIST Control SI-12 baseline for CIS 3.1 is low not moderate
Missing a letter 'z' in "N/A - Deployed organiation-wide"; should be "N/A - Deployed organization-wide"
Added "#" column to maintain order
Modified formatting for improved consistency and ability to sort
Column 'New' and 'Corrected' and all cell yellow highlights should be removed once reviewed
These are the NIST controls and their baselines in use for the newly introduced mappings:
- AU-6(8) - High
- CA-8 - Moderate
- CA-8(1) - Moderate
- CM-4(1) - Moderate
- CP-9(3) - Moderate
- MP-4 - Moderate
- PM-4 - High
- PM-6 - High
- SA-11(2) - High
- SA-3(1) - High
- SA-9 - Low
- SC-7(12) - N/A
- SC-7(15) - N/A
- SR-5(2) - N/A
These are the CIS Controls with newly introduced mappings:
- 3.12
- 4.12
- 12.8
- 13.2
- 15.7
- 16.13
- 16.8
- 18.1
- 18.2
- 18.3
- 18.4
- 18.5
- 16.14

CIS Critical Security Controls v8 Mapping to NIST CSF v1.1