CIS Controls v8
22 rules checking Center for Internet Security Controls v8 compliance, with Implementation Group (IG) classification. IG1 rules apply to all organizations, IG2 adds controls for organizations handling sensitive data, and IG3 covers mature security programs.
| Rule ID | Severity | CIS Reference | IG | Category | Summary |
|---|---|---|---|---|---|
| CIS-NET-001 | HIGH | 3.10 | IG2 | Insecure Protocols | Unencrypted protocol detected |
| CIS-NET-002 | CRITICAL | 12.1 | IG1 | Deprecated Protocols | Deprecated/broken protocol detected |
| CIS-NET-004 | HIGH | 12.5, 12.6 | IG2 | Insecure Authentication | Insecure authentication protocol detected |
| CIS-NET-010 | CRITICAL | 13.4 | IG2 | Overly Permissive | Any-to-any unrestricted traffic |
| CIS-NET-011 | CRITICAL | 12.2 | IG2 | Overly Permissive | Overly broad source address |
| CIS-NET-012 | CRITICAL | 12.2 | IG2 | Overly Permissive | Overly broad destination address |
| CIS-NET-013 | CRITICAL | 13.4 | IG2 | Overly Permissive | All ports or wide port range allowed |
| CIS-NET-014 | HIGH | 13.4 | IG2 | Overly Permissive | All protocols (ANY) allowed |
| CIS-NET-022 | CRITICAL | 3.12 | IG2 | Network Segmentation Violation | Direct database access from non-application source |
| CIS-NET-023 | CRITICAL | 12.7 | IG2 | Network Segmentation Violation | External source directly to internal resource |
| CIS-NET-030 | CRITICAL | 12.2, 13.4 | IG2 | Risky Service Exposure | High-risk port inbound from broad source |
| CIS-NET-032 | CRITICAL | 12.2 | IG2 | Risky Service Exposure | High-risk port from overly broad source |
| CIS-NET-033 | CRITICAL | 12.2 | IG2 | Risky Service Exposure | Database port exposed to internet |
| CIS-NET-034 | CRITICAL | 4.4, 12.2 | IG2 | Risky Service Exposure | Container/orchestration API exposed |
| CIS-NET-035 | CRITICAL | 4.4, 12.2 | IG2 | Risky Service Exposure | IPMI/BMC exposed from outside management |
| CIS-NET-036 | CRITICAL | 12.2, 13.4 | IG2 | Risky Service Exposure | ICS/SCADA protocols crossing zone boundaries |
| CIS-NET-040 | HIGH | 12.8 | IG3 | Administrative Access | Admin protocol from broad source |
| CIS-NET-041 | HIGH | 4.6 | IG1 | Administrative Access | Management traffic from public to internal |
| CIS-NET-042 | CRITICAL | 12.7 | IG2 | Administrative Access | Remote access without VPN |
| CIS-NET-051 | MEDIUM | 9.2 | IG1 | DNS Policy | DNS-over-HTTPS to known DoH providers |
| CIS-NET-052 | MEDIUM | 4.9, 13.4 | IG2 | DNS Policy | DNS as covert channel from sensitive segment |