How Black Cat SSPM maps to CIS Controls v8

Center for Internet Security Critical Security Controls Version 8 - prioritized set of actions to protect organizations from cyber attacks

CIS-01 — Inventory and Control of Enterprise Assets

Actively manage all enterprise assets to accurately know the totality of assets

CIS-02 — Inventory and Control of Software Assets

Actively manage all software to ensure only authorized software is installed

CIS-03 — Data Protection

Develop processes and technical controls to identify, classify, and protect data

CIS-04 — Secure Configuration of Enterprise Assets and Software

Establish and maintain secure configurations

CIS-05 — Account Management

Use processes and tools to assign and manage credentials for user accounts

CIS-06 — Access Control Management

Use processes and tools to manage access to assets

CIS-07 — Continuous Vulnerability Management

Develop a plan to assess and track vulnerabilities continuously

CIS-08 — Audit Log Management

Collect, alert, review, and retain audit logs of events

Audit Logging Disabled (workday)
Audit Logging Not Enabled (gcp)
Data Access Logs Incomplete (gcp)
GKE Logging Disabled (gcp)
Cloud Logging Sink Missing (gcp)
Log Metric for Project Ownership Missing (gcp)
Log Metric for Audit Config Changes Missing (gcp)
Log Metric for Custom Role Changes Missing (gcp)
Alert Policy Disabled (gcp)
Alert Policy Has No Notification Channels (gcp)
Log Metric Project Ownership Alert Missing (gcp)
Log Metric Audit Config Alert Missing (gcp)
Log Metric Custom Role Alert Missing (gcp)
DNS Logging Disabled (gcp)
Master Password Changed (1password)
AWS Config Not Recording (aws)
CloudTrail Data Events Disabled (aws)
CloudTrail Log Validation Disabled (aws)
CloudTrail Not Logging (aws)
CloudTrail Not Multi-Region (aws)
VPC Flow Logs Disabled (aws)
Alert Disabled (azure)
Alert NSG Create Missing (azure)
Alert NSG Delete Missing (azure)
Alert Policy Assignment Missing (azure)
Alert SQL Firewall Missing (azure)
Alert Security Solution Create Missing (azure)
Alert Security Solution Delete Missing (azure)
App Service Logging Disabled (azure)
Diagnostic Retention Short (azure)
Key Vault Diagnostic Logging Disabled (azure)
NSG Flow Logs Disabled (azure)
SQL Audit Retention Short (azure)
SQL Auditing Disabled (azure)
Modifiable Retention Policy (box)
No Indefinite Retention Policies (box)
No Retention Policies Defined (box)
Permanent Delete Disposition Action (box)
Retired Retention Policy (box)
Short Retention Period (box)
Audit Log Retention Period (datadog)
Audit Logging Disabled (datadog)
Monitoring Disabled (digitalocean)
Office Add-in Disabled (dropbox)
Suspended Member Not Removed (dropbox)
Subnet Flow Logs Disabled (gcp)
Global Mailbox Auditing Disabled (m365)
Mailbox Audit Bypass Configured (m365)
Mailbox Auditing Disabled (m365)
Non-Shared Mailbox Audit Bypass (m365)
Shared Mailbox Sent-As Not Audited (m365)
Shared Mailbox Sent-On-Behalf Not Audited (m365)
Unified Audit Log Not Enabled (m365)
User Mailbox Auditing Disabled (m365)
Sensitive Audit Event (openai)
Audit Log Using Local Filesystem Storage (teleport)
Proxy Host Key Checks Disabled (teleport)
Role Disables Session Recording (teleport)
Session Recording Disabled (teleport)
Session Recording in Async Mode (teleport)
Session Recording in Proxy Mode (teleport)
Log Drain Disabled (vercel)
No Log Drain (vercel)

CIS-09 — Email and Web Browser Protections

Improve protections and detections of email and web threats

CIS-10 — Malware Defenses

Prevent or control installation and execution of malicious applications

CIS-11 — Data Recovery

Establish and maintain data recovery practices

CIS-12 — Network Infrastructure Management

Establish, implement, and manage network devices to prevent attacks

CIS-13 — Network Monitoring and Defense

Operate processes and tools to establish and maintain network monitoring

CIS-14 — Security Awareness and Skills Training

Establish and maintain a security awareness program

CIS-15 — Service Provider Management

Develop a process to evaluate service providers who hold sensitive data

CIS-16 — Application Software Security

Manage the security lifecycle of in-house developed or acquired software

CIS-17 — Incident Response Management

Establish a program to develop and maintain an incident response capability

Alert Source No Auto-Resolve (incidentio)
Escalation Path Shallow (incidentio)
Schedule No Holiday Configuration (incidentio)
Schedule Without Active Shift (incidentio)
Single Responder Escalation (incidentio)
Single Rotation Schedule (incidentio)
Workflow Disabled or Error (incidentio)
Workflow Ignores Step Errors (incidentio)
Escalation Policy Without Loops (pagerduty)
Escalation Policy Without Schedule (pagerduty)
Possibly Abandoned Service (pagerduty)
Service Without Auto-Resolve (pagerduty)
Service Without Escalation Policy (pagerduty)
Single User Escalation Rule (pagerduty)
Single User Schedule (pagerduty)

CIS-18 — Penetration Testing

Test the effectiveness and resiliency of enterprise assets through penetration testing

CIS-03.1 — Establish and maintain a data management process

Establish and maintain a data management process

Org Members Can Create Public Repos (github)
Org Members Can Fork Private Repos (github)
Chat External Access Enabled (workspace)
DLP Rules Not Configured (workspace)
Gmail Confidential Mode Disabled (workspace)
Gmail Delegate Privileged (workspace)
Gmail Filter Forwards Externally (workspace)
Gmail Multiple Forwarding Destinations (workspace)
Gmail Send-As External Alias (workspace)
Gmail Stale Delegates (workspace)
Gmail Suspicious Forwarding (workspace)
Gmail Unverified Send-As Alias (workspace)
OAuth App AI With Data Scopes (workspace)
Drive External Sharing Enabled (workspace)
Drive Link Sharing Anyone (workspace)
Drive Sharing Outside Organization (workspace)
Drive Publish to Web Allowed (workspace)
Drive External Shared Drives Allowed (workspace)
Drive Shared Drive Creation Unrestricted (workspace)
Drive File Public Sharing (workspace)
Drive File Publicly Indexed (workspace)
Drive File Link Sharing Enabled (workspace)
Drive File Shared With Personal Email (workspace)
Drive File External Edit Access (workspace)
Drive Shared Drive Has External Members (workspace)
Drive File Owner Is External (workspace)
Drive File Shared With External Domain (workspace)
Drive File Stale External Sharing (workspace)
Drive File Excessive Permissions (workspace)
Drive File External Commenter Access (workspace)
Drive File Broad Internal Sharing (workspace)
Drive File Org-Wide Link Sharing (workspace)
Drive User Excessive External Sharing (workspace)
Vault Exported (1password)
S3 Bucket Policy Public (aws)
S3 Bucket Public Access Not Blocked (aws)
Confluence Space Anonymous Access (atlassian)
Confluence Space Public Links (atlassian)
Jira Project Public Access (atlassian)
Storage Public Blob Access (azure)
Excessive Env Vars (circleci)
Pipeline Hardcoded Secrets (circleci)
Dashboard Public Sharing (datadog)
Dashboard Public URL (datadog)
Plain Text Env Var (digitalocean)
Group Forking Allowed Outside (gitlab)
Group Public Visibility (gitlab)
Group Sharing Outside Organization (gitlab)
Group Sharing Unlocked (gitlab)
Public Project (gitlab)
Active External Data Link (google_ads)
Overly Permissive Dashboard (grafana)
Overly Permissive Folder (grafana)
Public Dashboard (grafana)
Public Status Page (incidentio)
Default Calendar Sharing Too Permissive (m365)
Default Group Access Public (m365)
Default Sharing Policy Allows External (m365)
Distribution Group Open Join Policy (m365)
Distribution List Allows External Senders (m365)
External Forwarding on Mailbox (m365)
Forwarding Address Configured (m365)
Forwarding SMTP to External (m365)
Guest Access to Group Content Not Restricted (m365)
LinkedIn Integration Enabled in OWA (m365)
Mailbox Delivers to Both Mailbox and Forward (m365)
Mobile Contact Sync Enabled in OWA (m365)
Organization Sharing Enabled (m365)
Outbound Spam External Forwarding Allowed (m365)
Public Microsoft 365 Group (m365)
Remote Domain Auto-Forwarding Allowed (m365)
Sharing Policy Allows External Domains (m365)
Transport Rule Forwards Outside Org (m365)
Transport Rule Redirects Externally (m365)
Publicly Shared Database (notion)
Publicly Shared Page (notion)
Stale Public Page (notion)
Debug Files Access (sentry)
Enhanced Privacy Disabled (sentry)
Event Attachments Access (sentry)
Open Membership (sentry)
Shared Issues Enabled (sentry)
Password Protection Disabled (shopify)
Webhook External Destination (shopify)
Webhook Using HTTP (shopify)
No Storage Integration Required (snowflake)
Outbound Share Review (snowflake)
Share To Many Accounts (snowflake)
Unload To Inline URL (snowflake)
Unload To Internal Stages (snowflake)
External Messaging Enabled (teams)
External Shared Channel (teams)
Public Team (teams)
Unrestricted External Federation (teams)
Auto Expose System Environment Variables (vercel)
Directory Listing Enabled (vercel)
Exposed to Preview (vercel)
IP Visibility Enabled (vercel)
Plain Text Secret (vercel)
Public Source (vercel)
Sensitive Env Var Policy Disabled (vercel)
Group Allows External Posting (workspace)
Group Allows Open Join (workspace)
Group Contact Owner Anyone (workspace)
Group Discoverable by Anyone (workspace)
Group Domain-Wide Membership Visibility (workspace)
Group Public Conversations (workspace)
Mail Delegation Enabled (workspace)
Shared Drive Allows External Users (workspace)
Shared Drive Allows Non-Members (workspace)
Shared Drive Has External Members (workspace)
Shared Drive No Download Restriction (workspace)

CIS-03.2 — Establish and maintain a data inventory

Establish and maintain a data inventory including network segmentation controls

Legacy VPC Network In Use (gcp)

CIS-03.6 — Encrypt data on end-user devices

Encrypt data on end-user devices

Cloud KMS Key Publicly Accessible (gcp)
Cloud KMS Key Rotation Period Exceeds 90 Days (gcp)
Cloud KMS Encryption Key Has No Rotation Schedule (gcp)
Cloud KMS Key Primary Version Not Active (gcp)
Cloud KMS Key Uses Software Protection Level (gcp)
Secret Manager Secret Publicly Accessible (gcp)
Secret Manager Secret Has No Rotation (gcp)
Secret Manager Secret Has No Versioning (gcp)

CIS-03.10 — Encrypt sensitive data in transit

Encrypt sensitive data in transit

Certificate Expiring Soon (openai)
Delegated Auth Certificate Expiring Soon (workday)
Encryption Not Required For Third-Party Endpoints (zoom)
Always Use HTTPS Disabled (cloudflare)
TLS Mode Not Strict (cloudflare)
TLS 1.3 Disabled (cloudflare)
Minimum TLS Version Weak (cloudflare)
HSTS Disabled (cloudflare)
Opportunistic Encryption Disabled (cloudflare)
SSL Policy Weak TLS Version (gcp)
Edge Hostname Using Shared Cert (akamai)
HSTS Max-Age Too Short (akamai)
HSTS Not Enabled (akamai)
HTTP/2 Not Enabled (akamai)
Origin Not Using TLS (akamai)
Key Vault Key No Expiry (azure)
Key Vault Secret No Expiry (azure)
Storage Key Not Rotated (azure)
Bidirectional Collaboration Whitelist (box)
Broad Inbound Collaboration Whitelist (box)
No Collaboration Whitelist Entries (box)
Device Without Disk Encryption (chrome_enterprise)
SSL Encryption Disabled (cloudflare)
SSL Mode Flexible (cloudflare)
Expired Service Token Not Deleted (cloudflare_access)
Service Token Without Expiry (cloudflare_access)
Stale Service Token (cloudflare_access)
Unused API Key (datadog)
HTTP Allowed (digitalocean)
Insecure Backend (digitalocean)
No SSL Termination (digitalocean)
SSL Not Enforced (digitalocean)
Content Filter Not Full (discord)
Guild Publicly Discoverable (discord)
NSFW Channel (discord)
No AutoMod Rules (discord)
No Keyword Filtering (discord)
No Mention Spam Protection (discord)
No Spam Protection (discord)
Widget Enabled (discord)
External Folder Join Unrestricted (dropbox)
Folder Link Restriction Not Enforced (dropbox)
Public Shared Links Allowed by Default (dropbox)
Shared Folders Open to Anyone (dropbox)
Dormant Cloud Token (grafana_cloud)
Excessive Tokens Per Policy (grafana_cloud)
Non-Expiring Cloud Token (grafana_cloud)
Recently Created Token Without Use (grafana_cloud)
Token With Wildcard Policy (grafana_cloud)
S/MIME Buffer Encryption Not Enabled (m365)
S/MIME CRL Timeout Too Long (m365)
S/MIME Cert Chain With Root Not Included (m365)
S/MIME Cert Chain Without Root Not Included (m365)
S/MIME Clear Signing Not Enabled (m365)
S/MIME Encryption Algorithms Not Configured (m365)
S/MIME Encryption Not Enforced (m365)
S/MIME Signing Not Enforced (m365)
S/MIME Triple-Wrap Not Enabled (m365)
Storage Container Public (ovhcloud)
Extension Disabled (pagerduty)
Webhook External URL (pagerduty)
Webhook Inactive (pagerduty)
Public Sharing Model (salesforce)
Data Scrubber Defaults Disabled (sentry)
Data Scrubber Disabled (sentry)
Data Rekeying Disabled (snowflake)
Application Has TLS Verification Disabled (teleport)
Database Configured Without TLS (teleport)
Variable Not Marked Sensitive (terraform_cloud)
Variable Plaintext Credentials (terraform_cloud)
Variable Set Global Scope (terraform_cloud)
Workspace Global Remote State (terraform_cloud)
S/MIME Not Configured (workspace)

CIS-04.1 — Establish and maintain a secure configuration process

Establish and maintain a secure configuration process

GitHub Actions Can Approve Pull Requests (github)
GitHub Actions Default Workflow Permissions Read-Write (github)
GitHub Actions Enabled For All Repositories (github)
Org Repository Creation Unrestricted (github)
Repo Secret Scanning Push Protection Disabled (github)
SSO Not Enabled (workday)
Stale Integration System (workday)
Chat Webhooks Enabled (workspace)
Meet Recording Unrestricted (workspace)
Spoofing Protection Disabled (workspace)
Join Before Host Allowed (zoom)
No Password For Instant Meetings (zoom)
No Password For PMI Meetings (zoom)
Password Embedded In Join Link (zoom)
Automatic HTTPS Rewrites Disabled (cloudflare)
SSO Not Configured (workspace)
SSO Not Configured (cloudflare)
SSO Not Configured (atlassian)
SA Key Creation Not Disabled (gcp)
SA Key Upload Not Disabled (gcp)
Default SA Grant Not Disabled (gcp)
Service Account Key Expiry Not Enforced (gcp)
GKE Network Policy Disabled (gcp)
GKE Private Cluster Disabled (gcp)
GKE Shielded Nodes Disabled (gcp)
GKE Release Channel Not Set (gcp)
GKE Node Pool Auto-Upgrade Disabled (gcp)
GKE Binary Authorization Disabled (gcp)
GKE Database Encryption Disabled (gcp)
GKE Intranode Visibility Disabled (gcp)
Firewall Rule Changed (1password)
SSO Disabled (1password)
SSO Policy Modified (1password)
Signing Key Changed (1password)
Default Security Group Has Rules (aws)
Default VPC In Use (aws)
EC2 IMDSv2 Not Enforced (aws)
EC2 Instance Has Public IP (aws)
GuardDuty Not Enabled (aws)
KMS Key Disabled (aws)
KMS Key Pending Deletion (aws)
KMS Key Rotation Disabled (aws)
RDS Backup Retention Too Short (aws)
RDS Publicly Accessible (aws)
RDS Storage Not Encrypted (aws)
S3 Bucket Encryption Disabled (aws)
S3 Bucket Logging Disabled (aws)
S3 Bucket Versioning Disabled (aws)
Unrestricted Egress (aws)
Unrestricted RDP Access (aws)
Unrestricted SSH Access (aws)
CP Code Unused (akamai)
Edge Hostname IPv4 Only (akamai)
Group With No Contracts (akamai)
Property Caching Disabled (akamai)
Property No Origin Failover (akamai)
SureRoute Not Enabled (akamai)
Archived Workspace Not Deleted (anthropic)
Stale Workspace (anthropic)
App Service FTP Enabled (azure)
App Service HTTP/2 Disabled (azure)
App Service HTTPS Disabled (azure)
App Service Minimum TLS (azure)
App Service Remote Debugging Enabled (azure)
Defender App Service Disabled (azure)
Defender Containers Disabled (azure)
Defender Key Vault Disabled (azure)
Defender Resource Manager Disabled (azure)
Defender SQL Disabled (azure)
Defender Servers Disabled (azure)
Defender Storage Disabled (azure)
Key Vault Network ACLs Allow (azure)
Key Vault No Private Endpoint (azure)
Key Vault Purge Protection Disabled (azure)
Key Vault Soft Delete Disabled (azure)
NSG All Ports Open (azure)
NSG Permissive Outbound (azure)
NSG UDP Open (azure)
NSG Unrestricted RDP (azure)
NSG Unrestricted SSH (azure)
Network Watcher Disabled (azure)
SQL Firewall Allow Azure Services (azure)
SQL Firewall Unrestricted (azure)
SQL Minimum TLS (azure)
SQL TDE Disabled (azure)
SQL Threat Detection Disabled (azure)
SQL Vulnerability Assessment Disabled (azure)
Security Alert Notifications Disabled (azure)
Security Contact Email Missing (azure)
Security Contact Phone Missing (azure)
Storage Blob Soft Delete Disabled (azure)
Storage Container Soft Delete Disabled (azure)
Storage HTTPS Not Required (azure)
Storage Infrastructure Encryption Disabled (azure)
Storage Minimum TLS (azure)
Storage Network Default Allow (azure)
Storage Shared Key Enabled (azure)
Extension With Risky Permissions (chrome_enterprise)
Outdated Browser Version (chrome_enterprise)
Sideloaded Extension Detected (chrome_enterprise)
Config Policies Disabled (circleci)
Config Policies Soft Fail (circleci)
Forked PR Builds Enabled (circleci)
Pipeline Deprecated Image (circleci)
Schedule Non-Default Branch (circleci)
Stale Runner (circleci)
Webhook Insecure URL (circleci)
Webhook Unverified TLS (circleci)
CORS Allows All Origins (cloudflare_access)
Auto Upgrade Disabled (digitalocean)
Backups Disabled (digitalocean)
Basic Tier (digitalocean)
Database No Maintenance Window (digitalocean)
Database Single Node (digitalocean)
Droplet Powered Off (digitalocean)
Email Not Verified (digitalocean)
IPv6 Disabled (digitalocean)
Kubernetes HA Disabled (digitalocean)
Kubernetes No Registry Integration (digitalocean)
No Backups (digitalocean)
No Droplets Attached (digitalocean)
No Garbage Collection (digitalocean)
Outdated Kubernetes Version (digitalocean)
Outdated Version (digitalocean)
Surge Upgrade Disabled (digitalocean)
Bulk Recipients Enabled (docusign)
No IP Restrictions (docusign)
No Signer Certificate Required (docusign)
PowerForms Enabled (docusign)
Recipient Domain Validation Disabled (docusign)
Sign On Paper Enabled (docusign)
Signer Reassignment Enabled (docusign)
Bucket Versioning Disabled (gcp)
Cloud SQL Backup Not Enabled (gcp)
Cloud SQL Instance Has Public IP (gcp)
Cloud SQL SSL Not Required (gcp)
Default VPC In Use (gcp)
Essential Contacts Coverage Incomplete (gcp)
Firewall Rule Egress Open to World (gcp)
Firewall Rule Exposes Dangerous Port (gcp)
Instance Serial Port Enabled (gcp)
Shielded VM Disabled (gcp)
Actions Allow All External (github)
Public Repo Without Security Policy (github)
Repo Dependabot Disabled (github)
Repo Secret Scanning Disabled (github)
Webhook Insecure URL (github)
Active Runner Offline (gitlab)
Group No IP Restriction (gitlab)
Integration Insecure URL (gitlab)
No Compliance Framework (gitlab)
Project Container Scanning Disabled (gitlab)
Project Discussions Not Required (gitlab)
Shared Runner Not Locked (gitlab)
Broad Mute Timing (grafana)
Community Plugin (grafana)
Data Source Basic Auth (grafana)
Data Source TLS Skip Verify (grafana)
Data Source With Credentials (grafana)
Direct Access Data Source (grafana)
External Contact Point (grafana)
No Alert Rules Configured (grafana)
Outdated Plugin (grafana)
Unsigned Plugin (grafana)
Admin Stale Master Password (lastpass)
Critically Low Shared Folder Score (lastpass)
Empty Vault User (lastpass)
Low Shared Folder Security Score (lastpass)
Master Password Never Changed (lastpass)
Stale Master Password (lastpass)
Very Weak Master Password (lastpass)
Weak Master Password (lastpass)
ActiveSync Integration Enabled for OWA (m365)
Admin Malware Notifications Disabled (m365)
Anti-Phishing First Contact Tip Disabled (m365)
Anti-Phishing Spoof Detection Weak (m365)
Blocked File Type Action Not Quarantine (m365)
Common Attachment Types Filter Disabled (m365)
Common Attachment Types Missing (m365)
Comprehensive Spam Marking Disabled (m365)
Connection Filter Not Configured (m365)
Copilot License Assigned (m365)
Customer Lockbox Not Enabled (m365)
DKIM Record Missing (m365)
DMARC Record Missing (m365)
Distribution List Hidden From GAL (m365)
External Recipient Mail Tips Disabled (m365)
Group Naming Convention Not Configured (m365)
High Confidence Spam Not Quarantined (m365)
Inbound Spam Bulk Threshold Too High (m365)
Mail Tips Not Fully Enabled (m365)
Mailbox Move Enabled for Org Relationships (m365)
Mailbox SMTP Auth Not Disabled (m365)
Multi-Tenant App Without Verified Publisher (m365)
No File Types Blocked in OWA (m365)
No MIME Types Blocked in OWA (m365)
OWA Clickjacking Protection Not Set (m365)
On-Send Add-ins Enabled in OWA (m365)
Outbound Spam Notification Disabled (m365)
Outbound Spam Thresholds Not Configured (m365)
Remote Domain Auto-Reply Enabled (m365)
Remote Domain Delivery Reports Enabled (m365)
Remote Domain NDR Enabled (m365)
Remote Domain TNEF Enabled (m365)
Remote Domain Trusted Inbound Enabled (m365)
Remote Domain Trusted Outbound Enabled (m365)
Risk-Based Consent Not Configured (m365)
SMTP Auth Not Disabled Globally (m365)
SPF Hard Fail Not Enabled (m365)
SPF Record Missing (m365)
Self-Service Subscriptions Enabled (m365)
Sensitivity Labels Not Configured (m365)
Suspicious Outbound Copy Not Enabled (m365)
Transport Rule Deletes Messages (m365)
Transport Rule Disabled (m365)
Transport Rule Includes BCC (m365)
Transport Rule Processes External Sender (m365)
Unknown File Types Not Blocked (m365)
Unverified Domain (m365)
Unverified Federated Domain (m365)
Zero-Hour Auto Purge Disabled (m365)
Cloud Project Suspended (ovhcloud)
Developer Mode Enabled (ovhcloud)
IAM Policy No Identities (ovhcloud)
Instance In Shelved State (ovhcloud)
Instance Rescue Mode (ovhcloud)
Instance Using Default Image (ovhcloud)
OAuth2 Client No Description (ovhcloud)
Active Project Without Users (openai)
Disproportionate Output Tokens (openai)
Excessive API Request Volume (openai)
Project Without Rate Limits (openai)
Usage Anomaly (openai)
Low Data Retention (snowflake)
No Account Resource Monitor (snowflake)
No SCIM Configured (snowflake)
No SSO Configured (snowflake)
Resource Monitor Notify Only (snowflake)
SSO Login Page Disabled (snowflake)
Warehouse No Auto Resume (snowflake)
Warehouse No Auto Suspend (snowflake)
Warehouse No Resource Monitor (snowflake)
Warehouse Oversized (snowflake)
No Client Idle Timeout Configured (teleport)
Node Running Outdated Teleport Version (teleport)
Trusted Cluster Is Disabled (teleport)
Organization Default Execution Mode Local (terraform_cloud)
Organization Force Delete Allowed (terraform_cloud)
Variable Set Priority Override (terraform_cloud)
Workspace Drift Detection Disabled (terraform_cloud)
Workspace No VCS Connection (terraform_cloud)
Workspace Outdated Terraform Version (terraform_cloud)
Deployment Protection Disabled (vercel)
Domain Expiring Soon (vercel)
Fork Protection Disabled (vercel)
Insecure Log Drain (vercel)
No Target Restriction (vercel)
Project No Deployment Protection (vercel)
SSL Not Verified (vercel)
Stale Integration (vercel)
Strict Deployment Protection Disabled (vercel)
Broken Connection (workato)
Collaborator Group No Description (workato)
Stale Connection (workato)
Workspace Recipe Limit (workato)
Automatic Email Forwarding Enabled (workspace)
DKIM Not Configured (workspace)
Domain Not Verified (workspace)
Gemini Not Licensed (workspace)
Group Spam Moderation Disabled (workspace)
IMAP Access Enabled (workspace)
POP Access Enabled (workspace)
Shared Drive Folder Sharing Unrestricted (workspace)
Shared Drive No Admin Restrictions (workspace)
Chat File Transfer Enabled (zoom)
Cloud Recording No Auto-Delete (zoom)
Local Recording Enabled (zoom)
No Meeting Password Required (zoom)
Unauthenticated Join Allowed (zoom)
Waiting Room Disabled (zoom)
Weak Password Policy (zoom)

CIS-04.2 — Establish and maintain a secure configuration process for servers

Establish and maintain a secure configuration process for server hardening

Instance Uses Full Cloud-Platform API Scope (gcp)

CIS-04.3 — Establish and maintain a secure configuration process for databases

Configure automatic updates and secure configurations for database services

Instance Does Not Block Project-Wide SSH Keys (gcp)

CIS-04.4 — Implement and manage a firewall on end-user devices

Implement and manage firewall and secure configuration on compute instances

OS Login Disabled on Instance (gcp)

CIS-04.6 — Securely manage enterprise assets and software

Securely manage enterprise assets and software

Security Contact Missing (gcp)
IP Forwarding Enabled on Instance (gcp)

CIS-04.8 — Uninstall or disable unnecessary services

Uninstall or disable unnecessary services on enterprise assets

CIS-05.1 — Establish and maintain an inventory of accounts

Establish and maintain an inventory of all accounts

Group Not SCIM-Managed (openai)
Recent Sensitive Change (google_ads)
Alert Source Unowned (incidentio)
App No Description (slack)
Archive Channel Unrestricted (slack)
Default Channels Excessive (slack)
Display Name Not Validated (slack)
Everyone Notify General (slack)
Inactive Channel (slack)
Message Edit Unrestricted (slack)
Notify Channel Unrestricted (slack)
Remove Private Channel Unrestricted (slack)
Remove Public Channel Unrestricted (slack)
Slackbot Responses Unrestricted (slack)
User Groups Unrestricted (slack)
Workflow Creation Unrestricted (slack)
Channel Without Moderation (teams)
Large Team Without Moderation (teams)
Meeting Recording Disabled (teams)
Message Edit Delete Unrestricted (teams)
Team Without Description (teams)
Policy Set Empty (terraform_cloud)
Policy Set Not Global (terraform_cloud)
Policy Set Overridable (terraform_cloud)
Sentinel Policy Advisory Only (terraform_cloud)
Workspace Auto Apply Enabled (terraform_cloud)
Workspace Destroy Plan Allowed (terraform_cloud)

CIS-05.3 — Disable dormant accounts

Delete or disable dormant accounts after a period of inactivity

Terminated User With Active Account (workday)
Workday Dormant User Account (workday)
Dormant Accounts (okta)
OAuth App Inactive With Grants (okta)

CIS-05.4 — Restrict administrator privileges

Restrict administrator privileges to dedicated accounts

Invite Grants Owner Role (openai)
Super Admin Count Excessive (okta)
Super Admin Count Excessive (workspace)
Super Admin Count Excessive (cloudflare)
Super Admin Redundancy Missing (okta)
Super Admin Redundancy Missing (workspace)
Super Admin Redundancy Missing (cloudflare)
Overly Permissive IAM Binding (gcp)
Org-Level Owner Binding (gcp)
Org-Level Editor Binding (gcp)
Cloud Function Default Service Account (gcp)

CIS-06.1 — Establish an access granting process

Establish and follow a process for granting access to enterprise assets

Repo Branch Deletion Allowed (github)
Repo Force Pushes Allowed (github)
Repo Insufficient Required Reviews (github)
Certificate Without Project Scope (openai)
Inactive Certificate (openai)
Overpermissive Custom Role (openai)
Stale Expired Invite (openai)
Stale Pending Invite (openai)
Delegated Auth Allows Local Fallback (workday)
Empty Security Group (workday)
Excessive Session Timeout (workday)
Integration With Excessive Scope (workday)
No Account Lockout Policy (workday)
No IP Restrictions Configured (workday)
Security Group With Broad Domain Access (workday)
Security Group With Excessive Members (workday)
Weak Password Policy (workday)
Super Admin Account Recovery Enabled (workspace)
Gmail App Passwords Active (workspace)
Weak Password Policy (workspace)
Weak Session Control (workspace)
OAuth App Critical Scopes (workspace)
OAuth App Broad Scopes (okta)
OAuth App With Restricted Scopes Widely Authorized (workspace)
KMS Separation of Duties Violation (gcp)
SA Separation of Duties Violation (gcp)
GKE Legacy ABAC Enabled (gcp)
GKE Workload Identity Disabled (gcp)
GKE Master Authorized Networks Disabled (gcp)
MySQL skip_show_database Not Enabled (gcp)
MySQL local_infile Enabled (gcp)
Drive External Sharing Enabled (workspace)
Drive Link Sharing Anyone (workspace)
Drive File Public Sharing (workspace)
Drive File Publicly Indexed (workspace)
Drive File External Edit Access (workspace)
Drive File Owner Is External (workspace)
Drive Shared Drive Has External Members (workspace)
Drive File Excessive Permissions (workspace)
Drive File Broad Internal Sharing (workspace)
Dormant User (1password)
Failed Sign-in Attempt (1password)
Failed Sign-in From Untrusted Location (1password)
Service Account Token Created (1password)
Sign-in From Untrusted Location (1password)
Suspended User Activity (1password)
Suspended User Not Removed (1password)
Inactive IAM Users (aws)
Old Access Keys Not Rotated (aws)
Overly Permissive IAM Policy (aws)
Password Never Used (aws)
Password Policy Expiration Too Long (aws)
Root Access Key Exists (aws)
Unused Access Keys (aws)
Weak Password Policy (aws)
API Client Credentials Near Expiry (akamai)
API Client Inactive (akamai)
Custom Role With Admin Permissions (akamai)
User Account Locked (akamai)
User All Groups Access (akamai)
User Inactive (akamai)
API Key Created By Non-User (anthropic)
Admin Invite Pending Review (anthropic)
Admin Redundancy Missing (anthropic)
Dormant Member (anthropic)
Excessive Org Admins (anthropic)
Excessive Workspace Admins (anthropic)
Expired Invite Not Cleaned (anthropic)
Inactive API Key Not Removed (anthropic)
Managed User Review (anthropic)
Stale API Key (anthropic)
Stale Invite (anthropic)
Unscoped API Key (anthropic)
Unscoped Admin (anthropic)
Workspace Single Admin (anthropic)
API Token Without Expiry (cloudflare)
API Token Stale (cloudflare)
API Token Older Than 90 Days (atlassian)
External User With Product Access (atlassian)
Inactive User (atlassian)
Jira Project Permissive Default Roles (atlassian)
Session Duration Excessive (atlassian)
Suspended User With Access (atlassian)
User Dual Admin Role (atlassian)
User With Multiple API Tokens (atlassian)
App Service Auth Disabled (azure)
App Service Managed Identity Disabled (azure)
Classic Administrators (azure)
Custom Admin Roles (azure)
Guest Privileged Role (azure)
Key Vault RBAC Not Enabled (azure)
Owner Count Exceeded (azure)
SQL AD Admin Not Configured (azure)
Excessive Admin Users (box)
External Collaboration Not Restricted (box)
Inactive User Account (box)
No Device Pins Configured (box)
Platform Access Only Admin (box)
User Exempt from Device Limits (box)
User Exempt from Login Verification (box)
Download Restrictions Not Set (chrome_enterprise)
Incognito Mode Allowed (chrome_enterprise)
Stale Browser (90+ Days Inactive) (chrome_enterprise)
Unmanaged Browser (30+ Days Inactive) (chrome_enterprise)
No Groups Defined (circleci)
OIDC Not Configured (circleci)
Unrestricted Context (circleci)
User Checkout Key (circleci)
Application Allows All IdPs (cloudflare_access)
Application Without Policies (cloudflare_access)
Bypass Decision Policy (cloudflare_access)
Group Includes Everyone (cloudflare_access)
Group With Empty Include Rules (cloudflare_access)
Long Session Duration (cloudflare_access)
No Purpose Justification (cloudflare_access)
Policy Allows Everyone (cloudflare_access)
Single Identity Provider (cloudflare_access)
Admin Redundancy (datadog)
Application Key Write Scopes (datadog)
Dashboard Permissions Open (datadog)
Excessive Admins (datadog)
External Admin (datadog)
External Admin Service Account (datadog)
SSO Disabled (datadog)
SSO Not Enforced (datadog)
Service Account Custom Role (datadog)
Kubernetes SSO Not Enabled (digitalocean)
Weak SSH Key (digitalocean)
Channel Everyone Overwrite (discord)
Everyone Role Has Dangerous Permissions (discord)
Excessive Admin Roles (discord)
Excessive Admins (discord)
Low Verification Level (discord)
MFA Not Required for Admins (discord)
Member Verification Gate Disabled (discord)
Overly Permissive Channel (discord)
Permanent Invite (discord)
Role Can Mention Everyone (discord)
Role Has Administrator Permission (discord)
Role Has Dangerous Permissions (discord)
Unlimited Use Invite (discord)
Excessive Admins (docusign)
Inactive User With Access (docusign)
Long Mobile Session Timeout (docusign)
Long Signing Session Timeout (docusign)
Long Web Session Timeout (docusign)
No Account Lockout (docusign)
No Password Expiration (docusign)
No SSO Configured (docusign)
Overly Broad Permission Profile (docusign)
SSO Not Mandatory (docusign)
Unclaimed Domain (docusign)
User Without Group (docusign)
Weak Password Length (docusign)
Weak Password Strength (docusign)
EMM Not Required (dropbox)
Email Not Verified (dropbox)
Excessive Admin Users (dropbox)
Excessive Device Sessions (dropbox)
Group Creation Unrestricted (dropbox)
Inactive Member Account (dropbox)
Stale Desktop Session (dropbox)
Stale Pending Invite (dropbox)
Stale Web Session (dropbox)
Bucket Uniform Access Disabled (gcp)
Excessive Project Owners (gcp)
Instance Uses Default Service Account (gcp)
Owner Role Group Assignment (gcp)
Privileged Service Account Binding (gcp)
SA Impersonation Role Binding (gcp)
User Managed Service Account Keys (gcp)
Fine-Grained PAT Stale (github)
Fine-Grained PAT Broad Access (github)
Org Default Permission Too Permissive (github)
Repo Branch Protection Disabled (github)
Stale Organization Member (github)
Deactivated Member Not Removed (gitlab)
Group Membership Unlocked (gitlab)
Pending Invitation Not Accepted (gitlab)
Project Branch Protection Disabled (gitlab)
Project Force Push Allowed (gitlab)
Project Merge Approvals Disabled (gitlab)
Project No Code Owner Approval (gitlab)
Email-Only User Access (google_ads)
Excessive Admin Users (google_ads)
Stale Pending Invitation (google_ads)
Stale User Access (google_ads)
Admin Without Recent Activity (grafana)
Basic Auth Enabled With SSO (grafana)
Disabled Service Account With Tokens (grafana)
Dormant User (grafana)
Excessive Admins (grafana)
Non-Expiring Service Account Token (grafana)
SSO Disabled (grafana)
Service Account Admin Role (grafana)
Single SSO Provider (grafana)
Access Policy Without IP Restriction (grafana_cloud)
Cloud Wildcard Access Policy (grafana_cloud)
Excessive Cloud Admins (grafana_cloud)
Overly Permissive Access Policy (grafana_cloud)
Excessive Admins (incidentio)
Single Account Owner (incidentio)
User No Slack Linked (incidentio)
User Without Base Role (incidentio)
Workflow Accesses Private Data (incidentio)
Admin Dormant (lastpass)
Admin Never Logged In (lastpass)
Disabled Account Not Removed (lastpass)
Dormant Account (lastpass)
Excessive Shared Folder Admins (lastpass)
Never Logged In Account (lastpass)
Shared Folder All Admin (lastpass)
Shared Folder Excessive Users (lastpass)
Shared Folder No Read-Only Users (lastpass)
Shared Folder Single Admin (lastpass)
ActiveSync Does Not Block Unmanaged Devices (m365)
Admin Consent Requests Disabled (m365)
App Certificate Credentials Expiring Soon (m365)
App Expired Certificate Credentials (m365)
App Expired Password Credentials (m365)
App Long-Lived Certificate Credentials (m365)
App Long-Lived Password Credentials (m365)
App Password Credentials Expiring Soon (m365)
App Using Password Credentials (m365)
Auth Methods Migration Incomplete (m365)
CA Block High Risk Users Missing (m365)
CA Block Risky Sign-ins Missing (m365)
CA Compliant Devices Not Required (m365)
CA Device Code Flow Not Blocked (m365)
CA Legacy Auth Not Blocked (m365)
CA Session Duration Not Set (m365)
Copilot License on Guest User (m365)
Custom Banned Passwords Not Enforced (m365)
Direct File Access on Public Computers (m365)
Excessive Global Administrators (m365)
External Users With Admin Role (m365)
Global Admin Not Cloud-Only (m365)
Global Admin Redundancy Missing (m365)
Guest Access to Groups Not Restricted (m365)
Guest Group Privileges Not Restricted (m365)
Guest Invitation Not Restricted (m365)
Guest User Permissions Not Restricted (m365)
Guest Users Present (m365)
Lockout Duration Too Short (m365)
M365 Group Creation Not Restricted (m365)
MSOL PowerShell Not Blocked (m365)
Mobile Device Allows Non-Provisionable (m365)
OAuth App AI With Data Scopes (m365)
OWA Session Timeout Disabled (m365)
Password Expiration Policy Enabled (m365)
Password Lockout Threshold Too High (m365)
Password Protection Mode Audit Only (m365)
Password Protection On-Prem Disabled (m365)
SP Certificate Credentials Expiring Soon (m365)
SP Expired Certificate Credentials (m365)
SP Expired Password Credentials (m365)
SP Long-Lived Certificate Credentials (m365)
SP Long-Lived Password Credentials (m365)
SP Password Credentials Expiring Soon (m365)
SP Using Password Credentials (m365)
Self-Service Sign Up Enabled (m365)
Shared Mailbox Sign-In Enabled (m365)
TAP Character Length Too Short (m365)
TAP Enabled for All Users (m365)
TAP Global Policy Enabled (m365)
TAP Maximum Lifetime Too Long (m365)
TAP Not One-Time Use (m365)
User Consent to Apps Not Restricted (m365)
Users Can Create Security Groups (m365)
Users Can Create Tenants (m365)
Users Can Install Outlook Add-ins (m365)
Users Can Register Applications (m365)
WAC Viewing on Public Computers (m365)
Bot Without Description (notion)
Guest User Sprawl (notion)
Member Without Email (notion)
API Credential Never Used (ovhcloud)
API Credential No Expiry (ovhcloud)
API Credential No IP Restriction (ovhcloud)
API Credential OVH Support Access (ovhcloud)
API Credential Overly Permissive (ovhcloud)
Excessive OAuth2 Clients (ovhcloud)
IAM Policy Excessive Identities (ovhcloud)
IAM Policy Wildcard Actions (ovhcloud)
IAM Policy Wildcard Resources (ovhcloud)
Identity User Disabled Not Removed (ovhcloud)
Identity User MFA Not Enabled (ovhcloud)
Identity User No Group (ovhcloud)
Identity User Password Never Changed (ovhcloud)
MFA Not Enabled (ovhcloud)
No IP Restrictions (ovhcloud)
Only SMS MFA Enabled (ovhcloud)
SSH Key Size Too Small (ovhcloud)
Weak SSH Key Algorithm (ovhcloud)
Access Policy Default Not Deny (okta)
App Not Using Federated Auth (okta)
App With Individual User Assignments (okta)
Dormant Super Admins (okta)
OAuth App AI With Broad Access (okta)
Session Idle Timeout Too Long (okta)
Session Lifetime Too Long (okta)
Super Admin API Tokens (okta)
Stale API Token (okta)
Old API Token (okta)
Weak Account Lockout (okta)
API Key Non-User Owner (openai)
Admin Key Non-User Owner (openai)
Admin Key Sprawl (openai)
Disabled User Not Removed (openai)
Excessive Organization Owners (openai)
Excessive Project API Keys (openai)
Excessive Service Accounts (openai)
Orphaned Service Account (openai)
Owner Redundancy Missing (openai)
Project With Only Service Accounts (openai)
Stale API Key (openai)
Stale Admin Key (openai)
Stale Service Account (openai)
Excessive Admins (pagerduty)
Single Account Owner (pagerduty)
Unassigned User (pagerduty)
API Access Review (salesforce)
Excessive Modify All Data (salesforce)
Frozen Active User (salesforce)
Inactive Admin (salesforce)
No Clickjack Protection (salesforce)
Permission Set Modify All Data (salesforce)
Session Timeout Too Long (salesforce)
Default Role Not Member (sentry)
Dormant User (sentry)
Excessive Admins (sentry)
Old Pending Invite (sentry)
SSO Disabled (sentry)
Excessive API Scopes (shopify)
Excessive Admins (shopify)
Staff Unrestricted Permissions (shopify)
App Management Unrestricted (slack)
Excessive Admins (slack)
Excessive Owners (slack)
External Admin (slack)
Guest Multi Channel (slack)
Guest Slash Commands (slack)
App Approval Not Required (slack)
Owner Redundancy (slack)
Public Channel Creation Unrestricted (slack)
ACCOUNTADMIN Default Role (snowflake)
ACCOUNTADMIN Excessive Grants (snowflake)
Disabled User With Active Grants (snowflake)
Dormant User (snowflake)
Excessive Admin Roles (snowflake)
No Separation Of Duties (snowflake)
OAuth Integration Permissive (snowflake)
Password Only Auth (snowflake)
Service Account Password Auth (snowflake)
User Not Disabled (snowflake)
Weak Password Policy (snowflake)
Anonymous Meeting Join Enabled (teams)
Excessive Team Owners (teams)
Guest Access Overly Permissive (teams)
Guest Members in Team (teams)
Lobby Bypass for Everyone (teams)
Auth Connector Has Broad Claim Mapping (teleport)
Auth Connector Has No Role Mappings (teleport)
Auth Connector Maps Claims to Admin Role (teleport)
GitHub Connector Maps All Teams (teleport)
Local User Has No SSO Identity (teleport)
Role Allows Impersonation (teleport)
Role Enables SSH Agent Forwarding (teleport)
Role Has Broad Admin RBAC Rules (teleport)
Role Has Unlimited Session TTL (teleport)
Role Has Wildcard App Labels (teleport)
Role Has Wildcard Database Labels (teleport)
Role Has Wildcard Kubernetes Labels (teleport)
Role Has Wildcard Node Labels (teleport)
Token Grants Admin Role (teleport)
Token Grants Auth System Role (teleport)
Token Has No Expiry (teleport)
Token Uses Static Join Method (teleport)
Trusted Cluster Has Broad Role Map (teleport)
User Account Is Locked (teleport)
User Has Admin Role (teleport)
User Has Excessive Roles (teleport)
Organization 2FA Not Enforced (terraform_cloud)
Organization SAML Not Enabled (terraform_cloud)
Organization Session Timeout Too Long (terraform_cloud)
Team Excessive Permissions (terraform_cloud)
Team Secret Visibility (terraform_cloud)
Team Workspace Admin Access (terraform_cloud)
User 2FA Not Enabled (terraform_cloud)
User Pending Invitation (terraform_cloud)
Access Group Empty (vercel)
Auto Join Enabled (vercel)
Excessive Members (vercel)
Excessive Owners (vercel)
Member Unconfirmed (vercel)
Non-SSO Member (vercel)
Overly Broad Access (vercel)
Overprivileged Integration (vercel)
SSO Not Enforced (vercel)
Token No Expiration (vercel)
Token Overprivileged (vercel)
Token Stale (vercel)
API Client No IP Restriction (workato)
API Endpoint Inactive (workato)
API Platform Client Excessive Keys (workato)
Excessive API Clients (workato)
Excessive Admins (workato)
Inactive Member (workato)
No Custom Roles (workato)
Overprivileged Member (workato)
Workspace Single Admin (workato)
Admin With App Password (workspace)
Dormant Users (workspace)
Never Logged In Users (workspace)
OAuth App With Restricted Scopes (workspace)
User With App Password (workspace)
Excessive Admins (zoom)
Inactive User (zoom)
SSO Not Enforced (zoom)

CIS-06.2 — Establish and maintain an access revoking process

Establish and maintain audit logging for access management events

PostgreSQL log_connections Not Enabled (gcp)
PostgreSQL log_disconnections Not Enabled (gcp)
PostgreSQL log_min_messages Below WARNING (gcp)
PostgreSQL log_min_error_statement Above ERROR (gcp)
PostgreSQL log_min_duration_statement Not Disabled (gcp)
PostgreSQL pgaudit Extension Not Enabled (gcp)

CIS-06.3 — Require MFA for externally-exposed applications

Require all externally-exposed enterprise or third-party applications to enforce MFA

MFA Not Enforced (workday)
Workday User Without MFA Required (workday)
MFA Not Enrolled (okta)
MFA Not Enabled (cloudflare)
User 2-Step Verification Not Enforced (workspace)
MFA Disabled (1password)
MFA Status Unknown (1password)
Sign-in Without MFA (1password)
Root Account MFA Not Enabled (aws)
User MFA Not Enabled (aws)
User MFA Not Enabled (akamai)
Two-Step Verification Not Enforced (atlassian)
User Without MFA (atlassian)
No MFA Requirement (cloudflare_access)
Member Without 2FA (github)
Org 2FA Not Required (github)
Group 2FA Grace Period Too Long (gitlab)
Group 2FA Not Enforced (gitlab)
Member Without 2FA (gitlab)
Admin Without MFA (lastpass)
MFA Not Enabled (lastpass)
CA MFA Not Enforced (m365)
Security Defaults Disabled (m365)
Guest Email OTP Not Enabled (m365)
MFA Suspicious Activity Reporting Disabled (m365)
Weak Authentication Factors Enabled (m365)
Phishing Resistant Auth Policies (okta)
Phishing Resistant MFA Factors (okta)
Session MFA Not Required (okta)
Admin Without MFA (salesforce)
User Without MFA (salesforce)
Staff MFA Disabled (shopify)
MFA Not Required (slack)
User No MFA (slack)
Authentication Policy No MFA (snowflake)
MFA Not Enabled (snowflake)
Admin 2-Step Verification Not Enforced (workspace)
Delegated Admin Without 2-Step Verification (workspace)
User Without 2-Step Verification (workspace)
Admin Without MFA (zoom)
User Without MFA (zoom)

CIS-06.4 — Require MFA for remote network access

Require MFA for all remote network access

CIS-06.5 — Require MFA for administrative access

Require MFA for all administrative access

Admin Without MFA (okta)
Admin Without 2-Step Verification (workspace)
Two-Factor Enforcement Disabled (cloudflare)
Cloud SQL Authorized Networks Open to World (gcp)
Password Manager Disabled (chrome_enterprise)
No SAML or OIDC Provider (cloudflare_access)
One-Time PIN Only Authentication (cloudflare_access)
Advanced Permissions Disabled (pagerduty)
SSO Disabled (pagerduty)
High Failed Logins (salesforce)
Weak Password Policy (salesforce)
Admin Action MFA Not Enforced (teleport)
Cluster MFA Disabled (teleport)
Device Trust Disabled (teleport)
Expired Certificate Disconnect Disabled (teleport)
Local Auth Enabled With SSO (teleport)
Local User Has No MFA Device (teleport)
Passwordless Without Hardware Key Policy (teleport)
Role Does Not Require Session MFA (teleport)
Session MFA Not Enforced (teleport)
TOTP Without WebAuthn (teleport)
User Uses Only TOTP for MFA (teleport)

CIS-07.1 — Establish and maintain a vulnerability management process

Establish and maintain a documented vulnerability management process

Unrestricted API Key (gcp)
Stale API Key (gcp)

CIS-07.4 — Perform automated patch management

Perform operating system and application patch management

Old Service Account Keys (gcp)

CIS-10.1 — Deploy and maintain anti-malware software

Deploy and maintain anti-malware software on all enterprise assets

CIS-10.5 — Enable anti-exploitation features

Enable anti-exploitation features on enterprise assets and software

WAF Disabled (cloudflare)
Browser Integrity Check Disabled (cloudflare)

CIS-12.1 — Ensure network infrastructure is up-to-date

Ensure network infrastructure is kept up-to-date

Account Protection Disabled (akamai)
Bot Management Disabled (akamai)
DNSSEC Not Enabled (akamai)
Geo Firewall Not Configured (akamai)
IP Firewall Not Configured (akamai)
Rate Control Threshold Too Permissive (akamai)
Rate Controls Disabled (akamai)
SOA Serial Stale (akamai)
Slow POST Protection Disabled (akamai)
TSIG Not Enabled (akamai)
WAF In Alert-Only Mode (akamai)
WAF Policy Alert-Only Mode (akamai)
Safe Browsing Disabled (chrome_enterprise)
Allows All Inbound (digitalocean)
Allows All Outbound (digitalocean)
Default VPC Used (digitalocean)
No Firewall (digitalocean)
No VPC (digitalocean)
Publicly Accessible (digitalocean)
SSH Open To All (digitalocean)
IP Allowlist Disabled (incidentio)
Instance Has Public IP (ovhcloud)
Integration No Network Policy (snowflake)
Network Policy No Blocklist (snowflake)
Network Policy Wildcard (snowflake)
No Network Policy (snowflake)
No Network Restrictions Configured (teleport)
Overly Broad Network Allow Rule (teleport)
Agent Pool Organization Scoped (terraform_cloud)
Notification No HMAC Token (terraform_cloud)
Run Task Advisory Enforcement (terraform_cloud)
SSH Key Present (terraform_cloud)
VCS Connection Organization Scoped (terraform_cloud)

CIS-12.6 — Use of secure network management and communication protocols

Use secure network management and communication protocols

Weak Password Policy (okta)
DNS DNSSEC Disabled (gcp)
DNS DNSSEC RSASHA1 Key-Signing Key (gcp)
DNS DNSSEC RSASHA1 Zone-Signing Key (gcp)

CIS-13.1 — Centralize security event alerting

Centralize security event alerting across enterprise assets

CIS-13.4 — Perform traffic filtering between network segments

Perform traffic filtering between network segments

Public Firewall Rule (gcp)
Cloud Function Public Ingress (gcp)
Cloud Run Service Public Ingress (gcp)

CIS-15.1 — Establish and maintain an inventory of service providers

Establish and maintain an inventory of service providers

External Account Member (cloudflare)
Group Allows External Members (workspace)
External Members at Org Level (gcp)
Excessive Applications Installed (box)
Connected App with Full Dropbox Access (dropbox)
Orb Allowlist Empty (circleci)
Bot With Admin (discord)
Excessive Integrations (discord)
Orphaned Webhook (discord)
Webhook Inventory (discord)
Custom App Sideloading (teams)
Unapproved Third-Party App (teams)

CIS-16.1 — Establish and maintain a secure application development process

Establish and maintain a secure application development process

Org Web Commit Signoff Not Required (github)
Public Storage Bucket (gcp)
BigQuery Dataset Public Access (gcp)
Cloud Function Plaintext Secrets in Environment (gcp)