CIS Controls

Prioritised baseline security controls for protecting IT assets and reducing risk.

CIS Controls is a prioritised set of technical security controls used as a baseline by IT teams. It sits at the operational control layer and focuses on actions such as asset inventory, access management, patching and monitoring.

Putting the Controls into practice brings practical choices: which controls to implement first, how to map them across mixed on‑prem and cloud estates, and how to measure effectiveness. Resource limits and existing tooling often require tailoring the controls to local operations.

CIS Controls: Access and Privileged Security

Defines controls for access restrictions, privileged account management, authentication and authorisation enforcement.

AD360

Centralises authentication, provisioning and access controls to enforce directory access and policy compliance.

WALLIX PAM

Centralises privileged credential control and session brokering to enforce and audit privileged access.

PAM360

Stores and rotates privileged credentials and records sessions to control and validate administrative access.

Heimdal Application Control

Implements application allowlisting to prevent unauthorised execution and enforce endpoint control policies.

Specops Password Policy

Enforces password composition and breached-password checks to strengthen directory authentication controls.

Heimdal Next-Gen Antivirus

Detects and blocks malware on endpoints to enforce endpoint security controls and reduce compromise risk.

uniqkey

Encrypted credential vault with access controls and sharing to centralise organisational password management.

WALLIX Remote Access

Enforces authentication, authorisation and session logging for remote access to support secure access controls.

ADSelfService Plus

Provides self-service password reset, MFA and unlocks to reduce helpdesk load and secure authentication.

Heimdal Unified Security Platform

Integrates endpoint and network protections to enforce security controls and manage threat prevention centrally.

Audit evidence for CIS Controls

Gather logs, configuration snapshots and reports to demonstrate alignment with CIS Controls and support audit inquiries.

NetWrix Auditor

Collects and stores tamper-evident audit records and reports for configuration and access changes.

ADAudit Plus

Records AD and Windows events and generates searchable audit trails and alerts for investigations.

Identity360

Aggregates identity and access telemetry to correlate events and support investigation and compliance reporting.

CIS Controls: data protection and handling

Measures in CIS Controls covering data classification, secure transfer, retention and controlled handling to reduce exposure from weak processes.

Netwrix Data Classification

Discovers and classifies sensitive data across repositories to support data governance and protection controls.

Netwrix Endpoint Protector

Controls and logs endpoint data transfers and removable device usage to prevent data loss and support audits.

MOVEit Transfer

Provides encrypted, access-controlled file transfers and central logging to protect and manage sensitive file movement.

CIS Controls for governance and compliance

Use CIS Controls to define oversight, assign accountability and map technical controls to policy and compliance requirements.

Patch Manager Plus

Automates OS and third-party patching to maintain secure configurations and meet compliance patching requirements.

CyberSmart

Manages cybersecurity controls, policies and monitoring to help meet recognised standards and demonstrate compliance.

Endpoint Central

Centralised endpoint management with patching and security controls to maintain compliant secure configurations.

Where CIS Controls fits

The Controls connect directly to identity, endpoint, network and logging systems. They inform configuration standards, vulnerability management and the telemetry teams should collect.

They must be considered across IT because they affect responsibilities for controls, change testing and how incidents are investigated internally. Using the Controls helps technical teams target the highest operational risks within current processes.

Discuss your CIS Controls implementation

Speak to a specialist