Control 18

Control 18

Control 18 is one of the 18 Controls of the CIS Controls, Version 8.1. CIS’s guide, at its v8.1.2 revision, lists 5 Safeguards under it, numbered 18.1 to 18.5.¹ The schema uses those numbers as their identifiers. Of the Safeguards, none is in Implementation Group 1, 3 in Implementation Group 2 and all 5 in Implementation Group 3. Its Safeguards are about the asset classes Network (4) and Documentation (1).

This bundle leaves out CIS’s name and description for the Control and CIS’s text for its Safeguards, because CIS licenses that text under CC BY-NC-ND 4.0; CIS’s guide gives them, and the guide’s reference says where to find it. The edition file gives the Control and each of its Safeguards a title and a description in the project’s own words, written from what each requires.² For Control 18 they are:

• Title: Testing the defences as an attacker would
• Description: Testing how well the enterprise’s defences hold up by finding and exploiting weaknesses in people, processes and technology, as an attacker would.

Footnotes

1. https://www.cisecurity.org/controls/v8-1, the guide this page offers, the Safeguards of Control 18 ↩

2. src/cis_controls/data/cis-controls-8.1.2.yaml, Control 18 and its Safeguards ↩