Skip to content

CIS Controls and outside-in evidence

Which CIS Controls controls outside-in evidence can support, which findings count against each, and what it cannot tell you.

Last reviewed

CIS Controls

v8

6controls with outside-in evidence

Everything else in the framework needs evidence from inside the organisation.

The CIS Controls v8 are a prioritised set of 18 controls, broken down into safeguards. Some of those safeguards concern internet-facing assets directly: encrypting data in transit, secure configuration, email and browser protections.

TrustSek maps its findings to those safeguards, so each finding points to the control it bears on and the reasoning behind the mapping.

What it does not cover

Many safeguards are about what happens inside your network: asset and software inventories, access control, account management, logging, backups and endpoint protection. Outside-in evidence cannot assess them. A clean result here is not an implementation group achieved.

Controls with outside-in evidence (6)

Controls not listed here depend on policies, people and internal systems, so they need evidence from inside the organisation. Each finding links to its full explanation.

The mapping comes from the scoring engine and is being extended. In a few places it names the milder form of a finding and not the more serious one, for example 50 or more subdomains but not 100 or more.

Other frameworks

Sources