Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise's infrastructure in order to remediate and minimize the window of opportunity for attackers. Monitor public and private industry sources for new threats and vulnerability information.
Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.
Applicable Controls
| CIS Control | CIS Safeguard | Asset Type | Security Function | Title | Description |
|---|---|---|---|---|---|
7 | 7.1 | Applications | Protect | Establish and Maintain a Vulnerability Management Process | Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard. |
8 | 8.2 | Network | Detect | Collect Audit Logs | Collect audit logs. Ensure that logging, per the enterprise’s audit log management process, has been enabled across enterprise assets. |
Policy Templates for Security Controls
Vulnerability Management Policy Template for CIS Control 7
This template can assist an enterprise in developing a data management policy.
Download the template
Audit Log Management Policy Template for CIS Control 8
This template can assist an enterprise in developing an audit log management policy.
Download the template
Public and Non-profit Tools
CyberTrust Massachusetts Advisory Services
Comprehensive assessment services that review Active Directory, antivirus, internal system, and email vulnerabilities. Free for Plymouth County municipalities.
CISA Cyber Hygiene Service – Vulnerability Scanning
Free to U.S.-based federal, state, local, tribal and territorial governments, as well as public and private sector critical infrastructure organizations. Services include Vulnerability Scanning (continuous monitoring and assessment of internet-accessible network assess to assess host and vulnerability status)
CISA's Logging Made Easy (LME)
This service is a no-cost log management solution for small to medium-sized organizations with limited resources. It provides centralized logging and proactive threat detection and delivers enhanced security by allowing organizations to monitor their network, identify users, and actively analyze Sysmon data to quickly identify potential malicious activity.
CISA Cyber Hygiene Service – Web Application Scanning
Free to U.S.-based federal, state, local, tribal and territorial governments, as well as public and private sector critical infrastructure organizations. Web Application Scanning (uncovers exploitable vulnerabilities and misconfigurations) Reports delivered on-demand as well as monthly.
NSA DIB Cybersecurity Services – Protective DNS
NSA offers no-cost cybersecurity services to any company that contracts with DoD (sub or prime) or has access to non-public DoD information. Protective DNS (PDNS) is a DNS filter that blocks users from connecting to malicious or suspicious domains. To date, NSA’s PDNS program has blocked 1 billion malicious or suspicious domains, including nation-state spearphishing, malware, botnets, and ransomware activity.
NSA DIB Cybersecurity Services - Attack Surface Management
NSA offers no-cost cybersecurity services to any company that contracts with DoD (sub or prime) or has access to non-public DoD information. Through this service, NSA takes an adversarial approach to illuminate any internet-facing assets, searching for ways your network might be vulnerable. This allows customers to identify and remediate issues before they become compromises. Each customer receives a tailored, prioritized report of issues for mitigation, along with an overview of their organization’s Internet footprint.
CISA SCUBA Tool
The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies’ cloud business application environments and protect federal information that is created, accessed, shared and stored in those environments.
Nmap ("Network Mapper")
Free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.