CIS Controls and Kudo

CIS Controls Controls with ISMS

Control-by-control mapping between CIS Controls and the Kudo ISMS, with the complete structure ready for audits and evidence.

Table of the 153 CIS Controls v8 safeguards organized by control and mapped to the Kudo ISMS policies.

CIS 1 — Inventory and Control of Enterprise Assets

Code	ISMS Policy
1.1	Asset Management Policy
1.2	Asset Management Policy
1.3	Asset Management Policy
1.4	Asset Management Policy
1.5	Asset Management Policy

CIS 2 — Inventory and Control of Software Assets

Code	ISMS Policy
2.1	Asset Management Policy
2.2	Asset Management Policy
2.3	Asset Management Policy
2.4	Asset Management Policy
2.5	Hardening Policy
2.6	Hardening Policy
2.7	Asset Management Policy

CIS 3 — Data Protection

Code	ISMS Policy
3.1	Asset Management Policy
3.2	Privacy Policy
3.3	Privacy Policy
3.4	Privacy Policy
3.5	Privacy Policy
3.6	Privacy Policy
3.7	Privacy Policy
3.8	Privacy Policy
3.9	Privacy Policy
3.10	Privacy Policy
3.11	Communications Security Policy
3.12	Privacy Policy
3.13	Privacy Policy
3.14	Documents and Records Policy

CIS 4 — Secure Configuration of Enterprise Assets and Software

Code	ISMS Policy
4.1	Hardening Policy
4.2	Hardening Policy
4.3	Hardening Policy
4.4	Access Management Policy
4.5	Access Management Policy
4.6	Hardening Policy
4.7	Hardening Policy
4.8	Hardening Policy
4.9	Hardening Policy
4.10	Hardening Policy
4.11	Change and Configuration Management Policy
4.12	Change and Configuration Management Policy

CIS 5 — Account Management

Code	ISMS Policy
5.1	Access Management Policy
5.2	Access Management Policy
5.3	Access Management Policy
5.4	Access Management Policy
5.5	Access Management Policy
5.6	Human Resources Security Policy

CIS 6 — Access Control Management

Code	ISMS Policy
6.1	Access Management Policy
6.2	Access Management Policy
6.3	Access Management Policy
6.4	Access Management Policy
6.5	Access Management Policy
6.6	Access Management Policy
6.7	Access Management Policy
6.8	Access Management Policy

CIS 7 — Continuous Vulnerability Management

Code	ISMS Policy
7.1	Hardening Policy
7.2	Hardening Policy
7.3	Hardening Policy
7.4	Hardening Policy
7.5	Hardening Policy
7.6	Risk Management Policy
7.7	Risk Management Policy

CIS 8 — Audit Log Management

Code	ISMS Policy
8.1	Logging and Monitoring Policy
8.2	Logging and Monitoring Policy
8.3	Logging and Monitoring Policy
8.4	Logging and Monitoring Policy
8.5	Logging and Monitoring Policy
8.6	Logging and Monitoring Policy
8.7	Logging and Monitoring Policy
8.8	Logging and Monitoring Policy
8.9	Documents and Records Policy
8.10	Documents and Records Policy
8.11	Logging and Monitoring Policy
8.12	Logging and Monitoring Policy

CIS 9 — Email and Web Browser Protections

Code	ISMS Policy
9.1	Communications Security Policy
9.2	Communications Security Policy
9.3	Communications Security Policy
9.4	Communications Security Policy
9.5	Hardening Policy
9.6	Hardening Policy
9.7	Communications Security Policy

CIS 10 — Malware Defenses

Code	ISMS Policy
10.1	Hardening Policy
10.2	Hardening Policy
10.3	Hardening Policy
10.4	Hardening Policy
10.5	Hardening Policy
10.6	Hardening Policy
10.7	Logging and Monitoring Policy

CIS 11 — Data Recovery

Code	ISMS Policy
11.1	Backup and Recovery Policies
11.2	Backup and Recovery Policies
11.3	Backup and Recovery Policies
11.4	Backup and Recovery Policies
11.5	Backup and Recovery Policies
11.6	Business Continuity Policy
11.7	Business Continuity Policy

CIS 12 — Network Infrastructure Management

Code	ISMS Policy
12.1	IT Security Policy
12.2	IT Security Policy
12.3	Communications Security Policy
12.4	Communications Security Policy
12.5	Communications Security Policy
12.6	Communications Security Policy
12.7	IT Security Policy
12.8	IT Security Policy

CIS 13 — Network Monitoring and Defense

Code	ISMS Policy
13.1	Logging and Monitoring Policy
13.2	Logging and Monitoring Policy
13.3	Logging and Monitoring Policy
13.4	Logging and Monitoring Policy
13.5	Incident Management Policy
13.6	Communications Security Policy
13.7	Communications Security Policy
13.8	Communications Security Policy
13.9	Logging and Monitoring Policy
13.10	Logging and Monitoring Policy
13.11	Logging and Monitoring Policy

CIS 14 — Security Awareness and Skills Training

Code	ISMS Policy
14.1	Awareness Management Policy
14.2	Awareness Management Policy
14.3	Awareness Management Policy
14.4	Awareness Management Policy
14.5	Awareness Management Policy
14.6	Awareness Management Policy
14.7	Awareness Management Policy
14.8	Awareness Management Policy
14.9	Human Resources Security Policy

CIS 15 — Service Provider Management

Code	ISMS Policy
15.1	Vendor Management Policy
15.2	Vendor Management Policy
15.3	Vendor Management Policy
15.4	Vendor Management Policy
15.5	Vendor Management Policy
15.6	Vendor Management Policy
15.7	Vendor Management Policy

CIS 16 — Application Software Security

Code	ISMS Policy
16.1	Secure Development Policy
16.2	Secure Development Policy
16.3	Secure Development Policy
16.4	Secure Development Policy
16.5	Secure Development Policy
16.6	Secure Development Policy
16.7	Secure Development Policy
16.8	Secure Development Policy
16.9	Secure Development Policy
16.10	Secure Development Policy
16.11	Secure Development Policy
16.12	Secure Development Policy
16.13	Secure Development Policy
16.14	Access Management Policy

CIS 17 — Incident Response Management

Code	ISMS Policy
17.1	Incident Management Policy
17.2	Incident Management Policy
17.3	Incident Management Policy
17.4	Incident Management Policy
17.5	Incident Management Policy
17.6	Incident Management Policy
17.7	Crisis Management Policy
17.8	Crisis Management Policy
17.9	Awareness Management Policy

CIS 18 — Penetration Testing

Code	ISMS Policy
18.1	Incident Management Policy
18.2	Hardening Policy
18.3	Hardening Policy
18.4	Incident Management Policy
18.5	Compliance Management Policy

CIS Controls with ISMS

Overview of CIS Controls mapped to the Kudo ISMS: domains, scope and equivalences between both cybersecurity frameworks.

Domain Mapping

Graphical mapping between CIS Controls and Kudo domains

On this page

CIS 1 — Inventory and Control of Enterprise Assets CIS 2 — Inventory and Control of Software Assets CIS 3 — Data Protection CIS 4 — Secure Configuration of Enterprise Assets and Software CIS 5 — Account Management CIS 6 — Access Control Management CIS 7 — Continuous Vulnerability Management CIS 8 — Audit Log Management CIS 9 — Email and Web Browser Protections CIS 10 — Malware Defenses CIS 11 — Data Recovery CIS 12 — Network Infrastructure Management CIS 13 — Network Monitoring and Defense CIS 14 — Security Awareness and Skills Training CIS 15 — Service Provider Management CIS 16 — Application Software Security CIS 17 — Incident Response Management CIS 18 — Penetration Testing