CIS Critical Security Controls v8.1 (The 18 CIS CSC)

4.1 Establish and Maintain a Secure Configuration Process
Establish and maintain a documented secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard 

4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure
Establish and maintain a documented secure configuration process for network devices. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. 

4.3 Configure Automatic Session Locking on Enterprise Assets 
Configure automatic session locking on enterprise assets after a defined period of inactivity. For general purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes. 

4.4 Implement and Manage a Firewall on Servers 
Implement and manage a firewall on servers, where supported. Example implementations include a virtual firewall, operating system firewall, or a third-party firewall agent. 

4.5 Implement and Manage a Firewall on End-User Devices 
Implement and manage a host-based firewall or port-filtering tool on end-user devices, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed. 

4.6 Securely Manage Enterprise Assets and Software
Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled-Infrastructure-as-Code (IaC) and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential. 

4.7 Manage Default Accounts on Enterprise Assets and Software 
Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable. 

4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software 
Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function. 

4.9 Configure Trusted DNS Servers on Enterprise Assets
Configure trusted DNS servers on network infrastructure. Example implementations include: configuring network devices to use enterprise-controlled DNS servers and/or reputable externally accessible DNS servers.  

4.10 Enforce Automatic Device Lockout on Portable End-User Devices 
Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices, where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts. 

4.11 Enforce Remote Wipe Capability on Portable End-User Devices 
Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate such as lost or stolen devices, or when an individual no longer supports the enterprise. 

4.12 Separate Enterprise Workspaces on Mobile End-User Devices 
Ensure separate enterprise workspaces are used on mobile end-user devices, where supported. Example implementations include using an Apple® Configuration Profile or Android™ Work Profile to separate enterprise applications and data from personal applications and data.