CIS Benchmarks from the Center of Internet Security (CIS) are a set of globally recognised and consensus-driven best practices to help security practitioners implement and manage their cybersecurity defences. Developed with a global community of security experts, the guidelines help organisations proactively safeguard against emerging risks. Organisations adopt the CIS Benchmark standards to reduce the potential attack surface of their digital assets and mitigate security threats.

Inventory and control of enterprise IT assets

• Enterprise IT Assets refer to all company hardware assets, like employees’ devices, network devices and servers, and any IoT-related devices. Essentially, any asset that needs security monitoring.
• We take inventory of these assets and pinpoint insufficient security controls on these.

Inventory and control of software assets

• Software assets refer to a company’s apps and operating systems.
• We take inventory and identify any outdated software and patches.

Network infrastructure management, monitoring and defence

• We assess physical and virtualised gateways (including the architecture and configuration), firewalls, wireless access points, routers, and switches.
• We assess the effectiveness of network monitoring.

Data protection and recovery

• We determine the type of sensitive data the company utilises, including where this data is stored and if it is shared with any third-party identity.
• We check if this data is properly secured in line with relevant regulations (HIPAA, PCI DSS and PCI Software Security Framework, ISO 27001, ISO 9001, ISO 13485, Essential Eight and GDPR).
• We scrutinize the effectiveness of the data recovery processes.

Malware defence

• We look at improving the security tools the business has that are aimed at preventing malware infection.

Hardware and software secure configuration

• We evaluate hardware and software security settings and look at its effectiveness.
• We identify unnecessary apps and/or user accounts that could be exploited by attackers to minimise the organisation’s attack surface.

Access control management

• We audit the access control by reviewing the business’s authorisation, authentication, and password management against its policies, procedures and monitoring tools.
• We then identify if employees’ access rights are accurate for their current roles and level of authority.

Continuous vulnerability management

• Evaluating the efficiency of a business’ already established processes of proactive detection of security flaws.

Security log management

• Auditing a business’s aggregated security logs in their Security Information and Event Management (SIEM) system.
• Evaluating the security log data. This is a thorough analysis and takes into account the authentication of events (like if there has been any successful logins and/or failed login attempts), session length and the activity, including any changes to configuration settings, software changes (like installation or deletion), system or app errors, and more.

Email and web protection

• Auditing email and web communications for security threats and unauthorised access.

Security awareness and skills training

• Ensuring that company employees have the most updated and revised security training process and materials.

Incident response management

• Assessing a company’s security system and looking at how responsive it is in identifying, protecting, and detecting security threats, and its recover response rate.

Planning and scope

• Taking into account the ideal audit scope and customer budget, our planning involves the discussion and outlining of objectives, such as the type of security controls to be audited, including tools and duration of the audit.

Preparation

• We get further intel on company information and auditing targets, like the security team, IT users, the security policies and processes employed by the business, the type of hardware and software supplies and who third-party service providers may be.

Audit

• We conduct a security audit based on the parameters outlined in the scope phase.

Reporting

• We provide a comprehensive report of our findings, highlighting any security issues and the severity levels, such as missing security controls, and outdated processes, as well as explaining the risks they present.
• Additionally, we provide a recommended remediation path for the company to implement and follow.  

Remediation

• We handle the remedial actions ourselves, by fixing any lapses in security control measures.
• This is done through a number of ways, depending on the recommendations of our report: Improving security policies, ensuring hardware and software has secure configuration, deploying security tools and systems and ensuring employees are adequately equipped and trained about security awareness.