Products / Frameworks / 4.1.0

CIS Controls

Maps identity, endpoint, network, logging, backup and vulnerability evidence to CIS safeguard domains.

All frameworks Download control list (CSV)

This is the MSP 4.1.0 catalog snapshot, not the full publisher standard and not an assertion of Free/Professional parity. All conclusions require scope, adequate evidence and an authorized reviewer. This profile uses clause, family, criteria-group or locally authored readiness entries. It does not enumerate every official subcontrol or assessment objective.

18 catalog entries0 with exact test mappings15 family-support entries3 manual / unmapped

Search controls or testsCoverage

Control / requirement	Packaged guidance & evidence	Coverage
`CIS-01`Enterprise asset inventory and authorization	Enterprise asset inventory and authorization Evidence and test details Applicable supporting collectors: ASSETREC, NETWORK, STORAGE, VMWARE, WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-02`Software inventory and authorization	Software inventory and authorization Evidence and test details Applicable supporting collectors: GPO, WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-03`Data protection throughout its lifecycle	Data protection throughout its lifecycle Evidence and test details Applicable supporting collectors: BACKUP, ENTRA, STORAGE. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-04`Secure configuration of enterprise assets and software	Secure configuration of enterprise assets and software Evidence and test details Applicable supporting collectors: GPO, WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-05`Account lifecycle management	Account lifecycle management Evidence and test details Applicable supporting collectors: ADSEC, ENTRA. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-06`Access-control lifecycle management	Access-control lifecycle management Evidence and test details Applicable supporting collectors: ADSEC, ENTRA. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-07`Continuous vulnerability management	Continuous vulnerability management Evidence and test details Applicable supporting collectors: VULN. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-08`Audit-log collection, protection and review	Audit-log collection, protection and review Evidence and test details Applicable supporting collectors: ENTRA, NETWORK, WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-09`Email and browser protections	Email and browser protections Evidence and test details Applicable supporting collectors: ENTRA. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-10`Malware defenses	Malware defenses Evidence and test details Applicable supporting collectors: WINDOWS. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-11`Data recovery and restoration	Data recovery and restoration Evidence and test details Applicable supporting collectors: BACKUP. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-12`Network infrastructure management	Network infrastructure management Evidence and test details Applicable supporting collectors: NETWORK. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-13`Network monitoring and defense	Network monitoring and defense Evidence and test details Applicable supporting collectors: NETWORK. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-14`Security awareness and skills training	Security awareness and skills training Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`CIS-15`Service-provider security management	Service-provider security management Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`CIS-16`Application software security	Application software security Evidence and test details Applicable supporting collectors: CERTTLS, VULN. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope
`CIS-17`Incident-response management	Incident-response management Evidence and test details No exact automated mapping is packaged for this entry. Supply and review policies, records, interviews, observations or other appropriate evidence; absence of a mapping is not PASS.	Manual / no exact mapping
`CIS-18`Penetration testing	Penetration testing Evidence and test details Applicable supporting collectors: VULN. No exact requirement-to-test mapping is published for this row in the 4.1.0 mapping CSV. Family applicability is not proof that this requirement receives a mapped test result.	Family supporting scope