CIS Controls v8
21 rules checking Center for Internet Security Controls v8 compliance, with Implementation Group (IG) classification. IG1 rules apply to all organizations, IG2 adds controls for organizations handling sensitive data, and IG3 covers mature security programs.
| Rule ID | Severity | CIS Reference | IG | Category | Summary |
|---|---|---|---|---|---|
| CIS-NET-001 | HIGH | 3.10 | IG2 | Insecure Protocols | Unencrypted protocol detected |
| CIS-NET-002 | CRITICAL | 12.1 | IG1 | Deprecated Protocols | Deprecated/broken protocol detected |
| CIS-NET-004 | HIGH | 12.5, 12.6 | IG2 | Insecure Authentication | Insecure authentication protocol detected |
| CIS-NET-010 | CRITICAL | 13.4 | IG2 | Overly Permissive | Any-to-any unrestricted traffic |
| CIS-NET-011 | CRITICAL | 12.2 | IG2 | Overly Permissive | Overly broad source address |
| CIS-NET-012 | CRITICAL | 12.2 | IG2 | Overly Permissive | Overly broad destination address |
| CIS-NET-013 | CRITICAL | 13.4 | IG2 | Overly Permissive | All ports or wide port range allowed |
| CIS-NET-014 | HIGH | 13.4 | IG2 | Overly Permissive | All protocols (ANY) allowed |
| CIS-NET-022 | CRITICAL | 3.12 | IG2 | Network Segmentation Violation | Direct database access from non-application source |
| CIS-NET-023 | CRITICAL | 12.7 | IG2 | Network Segmentation Violation | External source directly to internal resource |
| CIS-NET-030 | CRITICAL | 12.2, 13.4 | IG2 | Risky Service Exposure | High-risk port inbound from broad source |
| CIS-NET-032 | CRITICAL | 12.2 | IG2 | Risky Service Exposure | High-risk port from overly broad source |
| CIS-NET-033 | CRITICAL | 12.2 | IG2 | Risky Service Exposure | Database port exposed to internet |
| CIS-NET-034 | CRITICAL | 4.4, 12.2 | IG2 | Risky Service Exposure | Container/orchestration API exposed |
| CIS-NET-035 | CRITICAL | 4.4, 12.2 | IG2 | Risky Service Exposure | IPMI/BMC exposed from outside management |
| CIS-NET-036 | CRITICAL | 12.2, 13.4 | IG2 | Risky Service Exposure | ICS/SCADA protocol ports permitted |
| CIS-NET-040 | HIGH | 12.8 | IG3 | Administrative Access | Admin protocol from broad source |
| CIS-NET-041 | HIGH | 4.6 | IG1 | Administrative Access | Management traffic from public to internal |
| CIS-NET-042 | CRITICAL | 12.7 | IG2 | Administrative Access | Remote access without VPN |
| CIS-NET-051 | MEDIUM | 9.2 | IG1 | DNS Policy | DNS-over-HTTPS to known DoH providers |
| CIS-NET-052 | MEDIUM | 4.9, 13.4 | IG2 | DNS Policy | DNS as covert channel from sensitive segment |
The Severity column, like the Rules tab, shows the worst-case severity a rule can emit. Some rules emit a lower severity in less exposed cases:
- CIS-NET-011 and CIS-NET-012 are CRITICAL for an
anyor /16-or-wider address, and HIGH for a /17 to /20. - CIS-NET-013 is CRITICAL when all ports are permitted, and HIGH for a range of more than 100 ports.
ICMP flows
ICMP has no ports, so an ICMP flow never triggers CIS-NET-013 ("all ports or wide port range"). The address rules still apply.
L2TP (UDP 1701)
CIS-NET-002 fires on any rule that permits UDP 1701, even when IKE (UDP 500) and NAT-T (UDP 4500) are permitted as well. With L2TP/IPSec, L2TP packets travel inside ESP (IP protocol 50), or inside UDP 4500 with NAT-T, so a firewall never needs to permit cleartext UDP 1701. A rule that does permit it allows unprotected L2TP sessions. For L2TP/IPSec, permit only UDP 500, UDP 4500 and ESP.
ICS/SCADA protocols
CIS-NET-036 fires for any flow that permits Modbus (502), S7comm (102), EtherNet/IP (44818) or BACnet (47808), including traffic within a single subnet. This is by design: these protocols have no authentication or encryption, so every rule that permits them deserves review. Confirm that the path stays inside a dedicated, segmented OT network.