CIS Critical Security Controls v8.1

Network traffic, security telemetry, vulnerability scans, log sources, and managed-device information help identify systems visible within the deployed scope and can reveal unknown or unauthorized assets.

Maintain the authoritative inventory across endpoints, mobile devices, cloud assets, IoT, and equipment that does not communicate through monitored infrastructure.

Endpoint and workload telemetry, vulnerability findings, and observed network activity can identify software, services, unsupported components, and potentially unauthorized applications.

Maintain the complete software inventory, approve applications, manage licenses, and prevent unauthorized installation and execution across all enterprise assets.

Firewalls, segmentation, encrypted connectivity, secure web controls, email protection, application protection, and monitoring help protect sensitive information in transit and reduce malicious activity.

Discover and classify data, define handling and retention rules, manage file and database permissions, protect data at rest, and securely dispose of information.

Network Box applies and maintains controlled configurations for the appliances, virtual systems, and managed security services it provides; monitoring and vulnerability findings can expose weaknesses elsewhere.

Define and enforce secure baselines across endpoints, servers, cloud platforms, operating systems, applications, mobile devices, and IoT assets outside Network Box management.

Supported directory integrations, VPN authentication, administrative controls, and security logs help enforce and monitor account use within Network Box-managed services.

Maintain the enterprise account inventory, unique credentials, service-account governance, dormant-account removal, privileged-account separation, and joiner-mover-leaver processes.

Network Box helps enforce network access through firewalls, segmentation, secure remote access, VPN authentication, supported MFA, directory integrations, and security logging.

Own access approval and revocation, role design, entitlement reviews, application permissions, and identity lifecycle management.

Within the agreed scope, Network Box performs recurring vulnerability assessment, validates and prioritizes findings, tracks results, and provides remediation guidance informed by threat intelligence and SOC analysis.

Approve risk treatment, patch operating systems and applications, make configuration changes, accept residual risk where appropriate, and remediate affected assets on time.

SIEM and managed platforms collect and normalize in-scope logs, correlate events, generate alerts, support analyst review, retain records under the contracted service, and identify interrupted log sources.

Define enterprise logging and retention requirements and ensure every required system, application, cloud service, and audit event is connected and retained for the necessary period.

Network Box applies URL and reputation controls, filters malicious or prohibited web destinations, detects web-borne threats, and protects email against malware, phishing, impersonation, links, and dangerous attachments.

Maintain supported browser and email-client versions, control endpoint browser configuration and extensions, and manage domain-level email authentication unless it is specifically included in scope.

Layered security controls analyze and block malicious files, code, traffic, and behavior while threat intelligence and managed updates keep protections current within service scope.

Ensure endpoint-wide anti-malware coverage, removable-media controls, operating-system exploit protections, and protection for assets outside the MDR/XDR scope.

Network Box supplies incident findings, monitors for continuing threats, validates managed security controls, and restores Network Box-managed security functions during recovery.

Own backup creation, isolation, encryption, retention, restoration priorities, business-system recovery, and regular recovery testing.

Managed firewalls, segmentation, VPN, SD-WAN, secure administration, configuration control, documentation, updates, and monitoring establish and maintain a secure network design within scope.

Manage switches, wireless infrastructure, third-party routers, and every other network system outside the agreed Network Box service scope.

Network Box continuously monitors in-scope networks and security telemetry, detects intrusions and anomalous activity, correlates events, applies threat intelligence, and has the 24/7 SOC investigate and escalate potential incidents.

Ensure suitable sensor placement, inspection settings, log-source coverage, and contracted services across the environment, including systems that sit outside Network Box visibility.

Security-awareness education and phishing simulations help personnel recognize social engineering, protect credentials, handle sensitive information safely, and report suspicious activity; reports provide evidence of participation and results.

Assign required training, follow up on non-completion, address role-specific skills, and integrate awareness activities into the broader personnel program.

Network Box provides defined operational responsibilities, service descriptions, contractual commitments, escalation procedures, security reporting, and available assurance documentation for its services.

Maintain the complete provider inventory, assign criticality, perform due diligence, define contractual requirements, monitor every provider, and manage termination or transition activities.

WAF protects internet-facing applications from common attacks, while vulnerability assessment, SIEM, MDR/XDR, threat intelligence, and SOC monitoring can expose weaknesses or suspicious production activity.

Own secure development, architecture review, developer education, code review, dependency analysis, software composition analysis, and application penetration testing.

The SOC receives alerts, categorizes and prioritizes events, investigates available evidence, communicates with authorized contacts, documents activity, and assists with containment and remediation under the agreed service.

Own the organization-wide response policy, executive decisions, legal and regulatory obligations, business continuity, public communication, and coordination beyond the managed-service scope.

Vulnerability findings, attack trends, security telemetry, and WAF or network-defense results can help define test priorities and support remediation after a penetration test; scanning and monitoring do not replace a penetration test.

Establish the testing program and engage an appropriately qualified and independent party for scoped internal and external penetration tests, then remediate resulting findings.