Since 2008, the CIS Controls have been through many iterations of refinement and improvement, leading up to what we are presented with today in CIS Controls version 8. CIS Controls reflect the combined knowledge of experts from every part of the ecosystem (companies, governments, and individuals). The controls reflect consideration by people in many different roles such as threat analysts, incident responders, solution providers, policy-makers, and more. This work is the wisdom collected from experts across many sectors who have banded together to create, adopt, and support the CIS Controls.

Today, I will be going over the first Control from version 8 of the top 18 CIS Controls – Inventory and Control of Enterprise Assets. This control had some updates since its last publication in CIS Controls 7.1 such as the introduction of “Safeguards”, which were known as “Sub-Controls” in previous versions of the CIS Controls. It is also notable that there are now only 18 Controls, whereas there were previously 20. Here I will go through the five safeguards for CIS Control 1 and offer my interpretation on what I’ve found.

Key Takeaways for Control 1

  • Starting with the basics. CIS Controls for version 8 have 18 controls. Out of the 18, the first six are considered to be the basics for setting the foundation for enterprise cybersecurity. Adopting the CIS Controls can both simplify and strengthen cybersecurity at once.
  • Tool availability. Many of the tools that accomplish the requirements set forth in Control 1 are open-source, which can help cut costs down during adoption of CIS. This is mainly for smaller organizations, as larger ones will quickly outgrow the extent of capabilities available as open-source. Commercial tools and services are available for enterprises who fit this category.
  • Reusability. Work smarter not harder. Many of the tools referenced (Read more...)