RSI Security

How to Map CIS Controls v7.1 to NIST CSF

RSI Security
IAM

Earlier this year, the Center for Internet Security (CIS) realeased the newest edition of their Critical Security Controls, CIS Controls v7.1. For many institutions, the implementation of these new protocols requires adaptation to other frameworks and compliance obligations, like mapping onto the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

While both of these systems are complex and difficult to implement in their own right, this blog will make mapping one onto the other simple by breaking down each one into its component parts.

 

How to Map CIS Controls v7.1 to NIST CSF

At their core, the CIS Controls and NIST CSF are similar: robust, flexible frameworks that give direction to your organization’s overall approach to cybersecurity. CIS tends to be more prescriptive, whereas NIST is more flexible. Ultimately, they’re more similar than different.

As such, CIS Controls v7 1 mapping to NIST CSF comes down to two simple steps:

By cultivating a deep understanding of what each system requires, you’ll be able to easily isolate ways in which one leads into the other. For example, what CIS calls “controls” or “subcontrols” map more or less directly onto what NIST calls “categories” or “subcategories.”

Let’s take a deep dive into each, beginning with CIS.

 

Understanding the CIS v7.1 Controls

The CIS Controls consists of 20 general categories of cybersecurity practices spread across three levels (basic, foundational, and organizational). Each control breaks down into subcontrols (171 total), specifying required practices and technologies.

The 20 controls aren’t required for all companies; instead, implementation further breaks down into three distinct implementation groups, designating levels of cybersecurity maturity:

The subsections that immediately follow will break down each control in detail and link to its individual page, accessible via the controls and resources list. We’ll also provide a synopsis of the subcontrols for each control, including at least one example per control level.

 

Schedule a free Consultation

 

CIS Controls 1-6: Basic

The first tier of controls comprises the most fundamental practices required for baseline cybersecurity. Across 47 subcontrols, 11 apply to IG1, IG2 must follow 38, and IG3 must abide by all 47.

The basic controls break down as follows:

A representative subcontrol for the basic level is 2.1, “Maintain Inventory of Authorized Software,” which applies to all 3 IGs. It requires that the organization keep detailed records pertaining to all software authorized for use. For a taste of how complex and robust basic controls get, consider 2.7, “Utilize Application Whitelisting,” which applies only to IG3.

 

CIS Controls 7-16: Foundational

Foundational controls involve more complication than the basic ones, but they’re still fundamental. Of the 88 total subcontrols, just 22 are required for IG1, but IG2 must follow 70, and IG3 all 88.

Here’s a breakdown of the foundational controls:

Foundational subcontrols typically look like 9.4: “Apply Host-Based Firewalls or Port-Filtering,” which applies across all 3 IGs. At their most complex, they require intense attention to detail, with practices like encrypting all data stored on USB devices (13.9) or disabling wireless access on devices for which it’s not required (15.4), both of which apply to IG3 only.

 

CIS Controls 17-20: Organizational

Finally, the third level includes controls that mainly detail governance and overall, company-wide protocols. There are 36 subcontrols; 10 apply to IG1, 31 apply to IG2, and all 36 apply to IG3.

Interestingly, this level contains the only controls with no particular subcontrols for IG1: controls 18 and 20. A typical organizational control is 17.5: “Train Workforce on Secure Authorization,” which applies to all 3 IGs. The most complex subcontrols, applying only to IG3, include practices like “Create Incident Scoring and Prioritization Schema” (19.8).

 

Understanding the NIST CSF v1.1

The most recent update to the NIST CSF, CSF version 1.1 (v1.1), was published in April of 2018. As with the prior versions thereof, the current CSF is intended to provide a set of general guidelines that complement an organization’s existing cybersecurity infrastructure.

This means that, unlike the CIS Controls, it dosn’t presrcibe or require particular practices. Incidentally, that looseness makes it easier to map the CIS (or any other framework) onto it.

The NIST CSF is made up of a few key components:

As with the CIS Controls above, the subsections below will first describe the NIST’s codified scheme, then briefly touch on how CIS’s maps onto it.

 

NIST Cybersecurity Framework: Core Functions

The biggest component of the CSF comprises the core functions into which its various security outcomes are organized. Namely, there are 5 functions, which break down into 23 categories of security outcomes recommended for businesses to implement or map practices onto.

Understanding these functions is key to mapping CIS controls, and any other cybersecurity architecture, onto them. The functions break down as follows:

Across this system of functions and categories, there is one further level: subcategories of individual controls or practices, of which there are 108 in total. For example, subcategory ID.BE-3 specifies that a business’ organizational priorities are communicated.

In the most basic mapping, NIST functions correspond to the levels of CIS Controls, outcome categories to the controls themselves, and subcategories to subcontrols.

In practice, that correspondence makes mapping as simple as tracing the particular practices you have in place to meet a CIS subcontrol and finding a corresponding subcategory in the NIST scheme. For example, subcontrols within CIS control 17 (Security Awareness and Training) map more or less directly onto subcategories within PR.AT, detailed above.

 

NIST Cybersecurity Framework: Implementation Tiers

One layer of complication in mapping involves both frameworks’ reliance on a distributed implementation. Similar to the CIS implementation groups detailed above, the NIST CSF groups into tiers. However, its tiered implementation matrix is less defined than that of CIS.

Rather than flagging subcategories by tier, NIST implementation tiers correspond to an institution’s overall rigor with respect to implementing outcomes across functions:

Importantly, unlike CIS, these tiers are not measures of maturity. While institutions are encouraged to progress toward tier 4, doing so is optional. Depending on the nature and means of a company, it may elect to remain at a lower tier if its security needs are satisfied there.

Generally speaking, CIS’s implementation groups map onto NIST’s implementation tiers rather intuitively. For example, controls for CIS group 1 are relatively baseline, so they map loosely onto NIST tiers 1 and 2. As institutions mature into CIS groups 2 and 3, their infrastructure approaches NIST tiers 3 and 4. Ultimately, you can map onto the tiers however you see fit.

 

Professional Cybersecurity You Can Trust

Here at RSI Security, we have an in-depth knowledge of every element of cybersecurity. That includes not just compliance with CIS and NIST, but also every step of planning, construction, and implementation of your entire cyberdefense architecture. Our experts have over a decade of keeping companies of all shapes and sizes safe from the dangers of cybercrime.

We’re happy to help you with things like:

For all that and more, we’re your first and best option. Contact RSI Security today for help mapping CIS Controls v7.1 to the NIST CSF v1.1, as well as all other cybersecurity solutions.

 

Download our free checklist today to see which CIS security controls you need to address.
Exit mobile version