CIP-6 - Endpoint Cybersecurity
Control for endpoint protection and hardening
Control Definition
Endpoint devices must be protected by deploying detection and response solutions with behavioral analysis, integrated with the SIEM for alert correlation and coordinated incident response. Operating systems must be hardened, stored information must be encrypted, and devices must be kept up to date through automated patch management, identifying and reporting those that are non-compliant. Which applications and external devices can run on or connect to each endpoint must be controlled, sensitive information leakage must be prevented, and there must be the ability to locate a device and remotely wipe its information when necessary.
Requirements
Requirement 1
We deploy EDR/XDR solutions with advanced behavioral analysis on 100% of corporate endpoint devices.
Requirement 2
We manage exceptions to endpoint controls through a formal approval process with an expiration date.
Requirement 3
We integrate EDR/XDR solutions with the SIEM/SOC for alert correlation and coordinated incident response.
Requirement 4
We automatically update the signatures and detection engines of EDR/XDR solutions.
Requirement 5
We apply operating system hardening based on CIS Benchmarks for Windows, macOS and Linux through centralized configuration management.
Requirement 6
We enable full-disk encryption on all devices with centralized recovery key management.
Requirement 7
We automate patch management with defined SLAs.
Requirement 8
We implement application control through allowlisting so that only approved applications run.
Requirement 9
We restrict the use of unauthorized USB storage devices on all endpoints.
Requirement 10
We implement data loss prevention (DLP) controls on endpoints to detect and block the exfiltration of sensitive data.
Requirement 11
We geolocate endpoints when necessary.
Requirement 12
We remotely wipe information stored on the endpoint with no possibility of recovery.
Requirement 13
We automatically identify and report devices that are non-compliant.
CIP-5 - Endpoint Inventory
Endpoint device inventory: automated discovery, isolation of unauthorized devices and secure wiping when they're retired.
Tools — Identity and Endpoints (CIP)
Free DivisionCero resources to strengthen identity and endpoint security: forensic tracking, threat maps and practical guides.