CIS Controls Audit Services

We provide tailored CIS Controls assessments that evaluate your security posture against industry best practices, delivering actionable recommendations prioritized for your specific business needs.

Schedule an Assessment

Understanding CIS Controls

The Center for Internet Security (CIS) Controls are a prioritized set of actions that collectively form a defense-in-depth approach to cybersecurity. We help you implement these controls in a way that makes sense for your organization.

Why CIS Controls Matter

The CIS Controls are developed by a community of IT experts who continuously evolve these best practices to address the changing threat landscape. They provide:

  • A prioritized path to improve your cybersecurity posture
  • Defense against the most pervasive cyber attacks
  • A foundation for compliance with various regulatory frameworks
  • A consensus-developed approach backed by global IT security experts

Our audits evaluate your environment against these controls, identifying gaps and providing specific recommendations tailored to your organization's unique context.

CIS Controls v8 Coverage

Inventory & Control of Enterprise Assets Full Coverage
Access Control Management Full Coverage
Data Protection Full Coverage
Security Awareness & Skills Training Full Coverage
Service Provider Management Full Coverage

Tailored to Your Organization

We understand that organizations have different resource constraints and risk profiles. Our CIS Controls assessment approach is tailored to match your specific needs through Implementation Groups.

Implementation Group 1

Essential cyber hygiene - the foundation for any organization regardless of size or complexity.

  • Basic security controls for small organizations
  • Protection against general, non-targeted attacks
  • Reasonable implementation with limited resources
  • Addresses the most critical security basics

Implementation Group 2

Intermediate cyber hygiene - for organizations with moderate resources and more complex environments.

  • More comprehensive security controls
  • Protection against targeted attacks
  • Requires more specialized security expertise
  • Builds on IG1 foundations

Implementation Group 3

Advanced cyber hygiene - for organizations with significant resources and complex security requirements.

  • Sophisticated security controls
  • Defense against advanced persistent threats
  • Requires dedicated security teams
  • Comprehensive implementation of all CIS Controls

Our Assessment Process

Our thorough assessment methodology ensures we provide a complete picture of your security posture with actionable recommendations tailored to your environment.

1

Discovery & Scoping

We begin by understanding your organization's environment, risk profile, and specific requirements.

  • Identify critical assets and systems
  • Determine the appropriate Implementation Group
  • Define assessment boundaries and scope
  • Establish success criteria and expectations
2

Control Assessment

We systematically evaluate each applicable CIS Control against your environment using a combination of interviews, documentation review, and technical testing.

  • Review existing policies and procedures
  • Interview key stakeholders and system owners
  • Conduct technical validation where applicable
  • Document evidence of compliance or gaps
3

Gap Analysis & Prioritization

We analyze the findings to identify security gaps and prioritize them based on risk, implementation effort, and your specific business context.

  • Calculate compliance scores for each control
  • Identify critical security gaps
  • Determine risk-based prioritization
  • Consider dependencies between controls
4

Remediation Planning

We develop a detailed remediation plan with specific, actionable recommendations tailored to your environment and constraints.

  • Create step-by-step remediation instructions
  • Suggest tools and resources for implementation
  • Develop implementation timelines
  • Identify quick wins vs. long-term projects
5

Executive Reporting

We deliver comprehensive reporting that communicates findings clearly to both technical teams and executive stakeholders.

  • Executive summary with key metrics
  • Detailed technical findings
  • Visual compliance scorecards
  • Strategic and tactical recommendations

Critical Controls We Evaluate

Here are some of the key CIS Controls we assess in your environment, explaining both the expected security measure and how we evaluate compliance.

1

Inventory & Control of Enterprise Assets

Expected Security Control: Maintain an accurate inventory of all enterprise assets with the potential to store or process data.

Our Assessment Approach: We validate your asset inventory processes, verify completeness through network scanning, and check automation of discovery and monitoring.

4

Secure Configuration of Enterprise Assets

Expected Security Control: Establish and maintain secure configuration practices for infrastructure and software.

Our Assessment Approach: We compare configurations against CIS Benchmarks, evaluate change control processes, and assess configuration drift monitoring.

5

Account Management

Expected Security Control: Create, assign, manage, and revoke access credentials and privileges for user, administrator, and service accounts.

Our Assessment Approach: We review access provisioning processes, privileged account controls, and account lifecycle management practices.

6

Access Control Management

Expected Security Control: Create, assign, and manage authorization processes to allow or deny access to assets and resources.

Our Assessment Approach: We evaluate least privilege implementation, role-based access controls, and separation of duties enforcement.

10

Malware Defenses

Expected Security Control: Prevent or control the installation, spread, and execution of malicious applications, code, or scripts.

Our Assessment Approach: We assess anti-malware coverage, scanning frequency, and detection/response capabilities for various threat types.

12

Network Infrastructure Management

Expected Security Control: Establish, implement, and actively manage network infrastructure devices.

Our Assessment Approach: We review network architecture, device configurations, segmentation implementation, and management processes.

Making Recommendations Actionable

We prioritize findings to help you focus on what matters most for your specific environment, ensuring you get the highest security return on your investment.

Critical Priority

Security gaps that present an immediate, severe risk to your organization and should be addressed as soon as possible.

  • Exploitation is likely and impact is severe
  • Controls fundamental to basic security hygiene
  • Often quick to implement with high security value
  • Direct exposure of critical assets

High Priority

Security improvements that significantly reduce risk and should be included in near-term planning.

  • Exploitation is possible with substantial impact
  • Core security controls with broad protection
  • May require moderate effort to implement
  • Addresses common attack vectors

Medium Priority

Important security enhancements that should be implemented as part of your security roadmap.

  • Exploitation requires specific conditions
  • Important but not foundational controls
  • May require significant planning or resources
  • Enhances defense-in-depth strategy

Low Priority

Security improvements that enhance your overall posture but present lower risk if not immediately addressed.

  • Exploitation is unlikely or limited impact
  • Enhancement to existing controls
  • May be resource-intensive to implement
  • Addresses edge cases or specific scenarios

Sample Findings & Recommendations

Here's how we present our findings to make them clear, actionable, and valuable for your specific environment.

Sample CIS Controls Assessment Report

Incomplete Asset Inventory System
Critical
CIS Control 1: Inventory and Control of Enterprise Assets

Finding: The current asset inventory system is manually maintained and does not include all enterprise assets. Network scans identified 37 devices that are not in the current inventory, including 12 servers hosting sensitive applications.

Risk: Without a complete inventory, the organization cannot effectively secure all assets, potentially leaving systems unpatched, unmonitored, or misconfigured.

Tailored Remediation Steps:
  1. Implement the already-licensed agent from your endpoint security solution on all discovered systems to enable automatic inventory updates.
  2. Configure the existing network monitoring tool to perform weekly automated discovery scans and alert on newly detected devices.
  3. Establish an asset management workflow in ServiceNow to track the lifecycle of all assets.
  4. Update the current onboarding/offboarding procedures to include asset tracking steps.
Excessive Administrative Privileges
High
CIS Control 5: Account Management

Finding: 27 user accounts have administrative privileges on domain controllers without business justification. Many of these accounts are used for daily activities, increasing the risk of privilege escalation attacks.

Risk: Administrative accounts used for routine tasks are more susceptible to compromise, potentially giving attackers elevated privileges to critical infrastructure.

Tailored Remediation Steps:
  1. Implement a tiered administration model using the existing Active Directory structure.
  2. Create dedicated administrative accounts for the 8 IT staff members who require these privileges.
  3. Configure your privileged access management solution (already licensed but not fully deployed) to provide just-in-time access for administrative functions.
  4. Update Group Policy to prevent administrative accounts from being used for email and web browsing.

Ready to Strengthen Your Security Posture?


Contact us today to schedule a CIS Controls assessment tailored to your organization's unique environment and needs.


Schedule a Consultation