You can’t protect what you don’t know you have. Start with a complete, current list of every device.

• 1.1Establish and Maintain Detailed Enterprise Asset InventoryIdentifyKeep an accurate, up-to-date list of every device that can store or touch your data — laptops, desktops, phones, servers, network gear, IoT, and cloud instances. Record the owner, location, and approval status, and review it at least twice a year.
• 1.2Address Unauthorized AssetsRespondCheck weekly for devices that shouldn’t be on your network, and remove, block, or quarantine anything you don’t recognize.

Know exactly what software is running — and make sure it’s authorized and still supported.

• 2.1Establish and Maintain a Software InventoryIdentifyMaintain a list of all licensed software installed across your devices — title, publisher, install date, and business purpose. Review at least twice a year.
• 2.2Ensure Authorized Software is Currently SupportedIdentifyOnly allow software the vendor still supports. For anything unsupported you can’t remove yet, document an exception with the risk and any mitigations. Review monthly.
• 2.3Address Unauthorized SoftwareRespondRemove software that isn’t on your approved list — or formally document an exception. Review monthly.

Know what sensitive data you hold, control who can reach it, and dispose of it safely.

• 3.1Establish and Maintain a Data Management ProcessGovernWrite down how you classify, own, handle, retain, and dispose of data based on its sensitivity. Review annually.
• 3.2Establish and Maintain a Data InventoryIdentifyKeep an inventory of where your sensitive data lives. Review annually, with priority on sensitive data.
• 3.3Configure Data Access Control ListsProtectSet file, database, and application permissions on a need-to-know basis — people should only reach the data their job requires.
• 3.4Enforce Data RetentionProtectKeep data only as long as your policy says. Define both a minimum and a maximum retention period.
• 3.5Securely Dispose of DataProtectDestroy data securely when it’s no longer needed, using methods that match the data’s sensitivity.
• 3.6Encrypt Data on End-User DevicesProtectTurn on full-disk encryption on laptops and devices that hold sensitive data (BitLocker on Windows, FileVault on Mac).

Devices and software ship insecure by default. Set — and document — a hardened standard.

• 4.1Establish and Maintain a Secure Configuration ProcessGovernDocument a standard secure setup for your devices and software. Review it annually.
• 4.2Establish and Maintain a Secure Configuration Process for Network InfrastructureGovernDocument a secure baseline configuration for your network devices — firewalls, switches, and access points. Review annually.
• 4.3Configure Automatic Session Locking on Enterprise AssetsProtectAuto-lock screens after inactivity — no more than 15 minutes on computers, 2 minutes on mobile devices.
• 4.4Implement and Manage a Firewall on ServersProtectRun and manage a firewall on every server.
• 4.5Implement and Manage a Firewall on End-User DevicesProtectRun a host firewall on every workstation, set to deny by default and only allow what’s explicitly needed.
• 4.6Securely Manage Enterprise Assets and SoftwareProtectAdminister systems over secure protocols like SSH and HTTPS — never Telnet or plain HTTP unless absolutely essential.
• 4.7Manage Default Accounts on Enterprise Assets and SoftwareProtectDisable or lock down built-in vendor/default accounts (root, administrator, and similar).

Every account is a way in. Track them, keep them unique, and close the ones you don’t need.

• 5.1Establish and Maintain an Inventory of AccountsIdentifyKeep a list of all user, administrator, and service accounts. Confirm every active account is still authorized at least quarterly.
• 5.2Use Unique PasswordsProtectUse a unique password for every account — at least 8 characters with MFA, or 14 characters without.
• 5.3Disable Dormant AccountsProtectDisable or delete any account that’s gone unused for 45 days.
• 5.4Restrict Administrator Privileges to Dedicated Administrator AccountsProtectUse separate, dedicated admin accounts for admin work. Do everyday tasks like email and browsing from a non-admin account.

Grant access deliberately, revoke it instantly, and require MFA where it counts.

• 6.1Establish an Access Granting ProcessGovernDocument a process for granting access when someone is hired or changes roles — automate it where you can.
• 6.2Establish an Access Revoking ProcessGovernDisable access immediately when someone leaves or changes roles. Disable (don’t delete) accounts to preserve the audit trail.
• 6.3Require MFA for Externally-Exposed ApplicationsProtectRequire multi-factor authentication on every internet-facing application.
• 6.4Require MFA for Remote Network AccessProtectRequire MFA for any remote access into your network (VPN, remote desktop, etc.).
• 6.5Require MFA for Administrative AccessProtectRequire MFA on every administrative account.

Find weaknesses before attackers do — and patch on a predictable schedule.

• 7.1Establish and Maintain a Vulnerability Management ProcessGovernDocument how you find and track security vulnerabilities. Review the process annually.
• 7.2Establish and Maintain a Remediation ProcessGovernDocument a risk-based plan for fixing vulnerabilities. Review it monthly.
• 7.3Perform Automated Operating System Patch ManagementProtectAutomatically patch operating systems at least monthly.
• 7.4Perform Automated Application Patch ManagementProtectAutomatically patch applications at least monthly.

When something goes wrong, logs are how you know what happened. Turn them on and keep them.

• 8.1Establish and Maintain an Audit Log Management ProcessGovernDocument what you log, how you review it, and how long you keep it. Review annually.
• 8.2Collect Audit LogsDetectTurn on logging across your systems, following your log management policy.
• 8.3Ensure Adequate Audit Log StorageProtectMake sure your logging destinations have enough storage to meet your retention policy.

Email and the browser are where most attacks land. Keep them current and filtered.

• 9.1Ensure Use of Only Fully Supported Browsers and Email ClientsProtectOnly use vendor-supported, up-to-date browsers and email clients.
• 9.2Use DNS Filtering ServicesProtectUse DNS filtering on all devices, on-site and remote, to block access to known malicious domains.

Anti-malware on every device, kept current, with risky auto-execution turned off.

• 10.1Deploy and Maintain Anti-Malware SoftwareDetectDeploy and maintain anti-malware software on every device.
• 10.2Configure Automatic Anti-Malware Signature UpdatesProtectSet anti-malware to update its signatures automatically.
• 10.3Disable Autorun and Autoplay for Removable MediaProtectDisable autorun and autoplay for USB drives and other removable media.

Backups only count if they’re automated, protected, isolated — and actually restorable.

• 11.1Establish and Maintain a Data Recovery ProcessGovernDocument your backup and recovery process — what’s in scope, recovery priorities, and how backups are secured. Review annually.
• 11.2Perform Automated BackupsRecoverRun automated backups at least weekly — more often for sensitive data.
• 11.3Protect Recovery DataProtectProtect your backups as well as the original data — encrypt and/or separate them.
• 11.4Establish and Maintain an Isolated Instance of Recovery DataRecoverKeep at least one isolated backup copy — offline, in the cloud, or off-site.

Your firewalls, switches, and access points need patching too.

• 12.1Ensure Network Infrastructure is Up-to-DateProtectKeep network gear on current, supported firmware and software. Review versions monthly.

Your people are your largest attack surface — and your best early-warning system.

• 14.1Establish and Maintain a Security Awareness ProgramGovernRun a security-awareness program. Train staff at hire and at least annually, and refresh the content every year.
• 14.2Train Workforce Members to Recognize Social Engineering AttacksProtectTrain staff to spot phishing, business email compromise, pretexting, and tailgating.
• 14.3Train Workforce Members on Authentication Best PracticesProtectTrain staff on MFA, strong password habits, and credential management.
• 14.4Train Workforce on Data Handling Best PracticesProtectTrain staff to store, transfer, archive, and destroy sensitive data properly — plus clear-screen and clear-desk habits.
• 14.5Train Workforce Members on Causes of Unintentional Data ExposureProtectTrain staff on accidental exposure — misdirected email, lost devices, and oversharing.
• 14.6Train Workforce Members on Recognizing and Reporting Security IncidentsProtectTrain staff to recognize a potential security incident and report it.
• 14.7Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security UpdatesProtectTrain staff to notice and report when their devices are missing updates or automated tools have failed.
• 14.8Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure NetworksProtectTrain staff on the risks of insecure networks, and give remote workers guidance on securing their home network.

Your vendors’ security is your security. Know who has access to your data.

• 15.1Establish and Maintain an Inventory of Service ProvidersIdentifyKeep an inventory of your vendors and service providers, classify each one, and name an internal contact for each. Review annually.

Decide who does what, and how to report a problem, before you’re in the middle of one.

• 17.1Designate Personnel to Manage Incident HandlingRespondName a primary person and at least one backup to manage incident handling. This can be a third party, as long as someone internal oversees the work.
• 17.2Establish and Maintain Contact Information for Reporting Security IncidentsGovernKeep a contact list for incidents — staff, vendors, law enforcement, your cyber-insurer, and relevant agencies. Verify it annually.
• 17.3Establish and Maintain an Enterprise Process for Reporting IncidentsGovernDocument how staff report an incident — the timeframe, who to tell, how, and the minimum information to include. Make it available to everyone and review annually.