CIS Top 20 Critical Security Controls

Course Description

These security controls can be combined with frameworks, like NIST SP 800-37 (The NIST Risk Management Framework-RMF) to provide organizations with defense-in-depth best practices.

This course may help prepare students for industry certifications around the CIS Security Controls.The course will cover an overview of each control, map the controls to the NIST Cybersecurity Framework, and students will gain hands-on practice through labs in this course.

Students should be familiar with common IT and cybersecurity terminology. It is recommended that students have 1-2 years of experience working in the cybersecurity industry.

By the end of this course, students should be able to:

Course Goals

By the end of this course, students should be able to:

Understand what the 20 CIS security controls are

Understand how each control maps to the NIST Cybersecurity Framework

Module 1: Introduction

Module 2: Control 1: Inventory and Control of Hardware Assets

Module 3: Control 2: Inventory and Control of Software Assets

Module 4: Control 3: Continuous Vulnerability Management

Module 5: Control 4: Controlled Use of Administrative Privileges

Module 6: Control 5: Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

Module 7: Control 6: Maintenance, Monitoring, and Analysis of Audit Logs

Module 8: Control 7: Email and Web Browser Protections

Module 9: Control 8: Malware Defenses

Module 10: Control 9: Limitation and Control of Network Ports, Protocols, and Services

Module 11: Control 10: Data Recovery Capabilities

Module 12: Control 11: Secure Configuration for Network Devices, Such as Firewalls, Routers, and Switches

Module 13: Control 12: Boundary Defense

Module 14: Control 13: Data Protection

Module 15: Control 14: Controlled Access Based on the Need to Know

Module 16: Control 15: Wireless Access Control

Module 17: Control 16: Account Monitoring and Control

Module 18: Control 17: Implement a Security Awareness and Training Program

Module 19: Control 18: Application Software Security

Module 20: Control 19: Incident Response and Management

Module 21: Control 20: Penetration Tests and Red Team Exercises

Module 22: What Small and Medium Enterprises (SME) Need to Know about the CIS Controls

Module 23: Conclusion

Module 24: Course Assessment