CIS Logo
tagline: Confidence in the Connected World

CIS Controls and Sub-Controls Mapping to ISO 27001

This document provides a detailed mapping of the relationships between the CIS Controls and ISO 27001.

Download Spreadsheet

Related Resources



 Arrow CIS Control 1: Inventory and Control of Hardware Assets
Arrow CIS Control 2: Inventory and Control of Software Assets
Arrow CIS Control 3: Continuous Vulnerability Assessment and Remediation
Arrow CIS Control 4: Controlled Use of Administrative Privileges
Arrow CIS Control 5: Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers
Arrow CIS Control 6: Maintenance, Monitoring, and Analysis of Audit Logs
Arrow CIS Control 7: Email and Web Browser Protections
Arrow CIS Control 8: Malware Defenses
Arrow CIS Control 9: Limitation and Control of Network Ports, Protocols, and Services
Arrow CIS Control 10: Data Recovery Capability
Arrow CIS Control 11: Secure Configuration for Network Devices, such as Firewalls, Routers and Switches
Arrow CIS Control 12: Boundary Defense
Arrow CIS Control 13: Data Protection
Arrow CIS Control 14: Controlled Access Based on the Need to Know
Arrow CIS Control 15: Wireless Access Control
Arrow CIS Control 16: Account Monitoring and Control
Arrow CIS Control 17: Security Skills Assessment and Appropriate Training to Fill Gaps
Arrow CIS Control 18: Application Software Security
Arrow CIS Control 19: Incident Response and Management