Get audit-ready for CIS v8
CIS Controls v8 · Critical Security Controls
Prioritized set of actions to protect organizations and data from known cyber attack vectors, organized into 18 control groups with implementation groups for progressive adoption.
CIS v8What is CIS v8?
Prioritized set of actions to protect organizations and data from known cyber attack vectors, organized into 18 control groups with implementation groups for progressive adoption.
Who it applies to
Organisations that want a prioritised place to start rather than a comprehensive one. Unusually among these frameworks it is ordered by what to do first, which makes it a practical fit for small teams.
How the standard is organised
Controls broken into safeguards and grouped into implementation groups, so a smaller organisation can adopt the first tier without committing to the whole set.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
CIS v8 on the Bitkosh platform
The 153 CIS v8 controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- 9.1Supported browsers and email clients
IG1: Allow only fully vendor-supported browsers and email clients to be used.
09 Email and Web Browser Protections - 9.4Restrict browser and email extensions
IG2: Remove or block unnecessary or unapproved browser and email client plugins, add-ons and extensions.
09 Email and Web Browser Protections - 10.3Disable autorun and autoplay
IG1: Prevent automatic execution of content on removable media.
10 Malware Defenses - 13.4Traffic filtering between segments
IG2: Filter traffic that moves between network segments.
13 Network Monitoring and Defense - 1.5Passive discovery tool
IG3: Use passive network monitoring to spot devices that never answer active scans, and refresh the inventory regularly.
01 Inventory and Control of Enterprise Assets - 13.11Tune alerting thresholds
IG3: Adjust security event alert thresholds regularly, at least monthly, so alerts stay meaningful.
13 Network Monitoring and Defense
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes CIS v8, and who does it apply to?
How is CIS v8 conformance demonstrated?
How is CIS v8 structured?
Ready to get audit-ready for CIS v8?
See how the Bitkosh Readiness Platform gets you audit-ready for CIS v8 — and the other 47 ready frameworks — from a single control library.