About cis-controls
This page is for anyone reading the LinkML schema’s elements: it says how they are named and what the model leaves out.
The CIS Critical Security Controls sort an enterprise’s security work into Controls, each a group of Safeguards on one subject. Each Safeguard is about one class of enterprise asset and serves one security function. CIS places it in one or more of three Implementation Groups, which say how soon an enterprise should take it up. The schema gives the Control and the Safeguard a class each, and holds them in one document for an edition.
Element names are the schema’s own. Classes and enums carry the Cis prefix
(CisControl, CisSafeguard, CisAssetClass) so they can be imported
beside other vocabularies. Slots are snake_case, and the fields of a
Safeguard start with safeguard_. The enum values are upper case, such as
IG1, DEVICES and GOVERN, each with CIS’s spelling as its title. Every
element is in the cis_controls: namespace
(https://w3id.org/lmodel/cis-controls/).
The identifiers sit in cis_control_id and cis_safeguard_id. An identifier
is CIS’s own number as a string, such as "4" for Control 4 and "4.1" for
Safeguard 4.1, so data joins with CIS’s guide and the crosswalks that cite it.
Quote it in YAML, which reads an unquoted 1.10 as the number 1.1.
The descriptions are this project’s own words. CIS licenses the CIS Controls
under CC BY-NC-ND 4.0, so the schema, its examples, the edition file and
these pages carry no CIS text, copied or paraphrased. The edition file,
src/cis_controls/data/cis-controls-8.1.2.yaml, gives each Control and
Safeguard a title and a short description in the project’s words, written
from what each requires. The title and description slots are for text
their user has the right to use. NOTICE states the position.
What is left out
Section titled “What is left out”The schema models the structure of the Controls and nothing of CIS’s text: no title, description, overview or procedure of a Control or Safeguard as CIS wrote it, and none of the guide’s glossary. It leaves out the subclasses into which CIS’s guide divides each asset class, CIS’s mappings from the Safeguards to other frameworks, its companion guides, and earlier versions of the Controls.