CIS Controls v8.1 Skill

Purpose

Implement prioritized CIS Controls for cyber defense across all Hack23 projects, focusing on high-impact security controls organized by Implementation Groups.

Rules

Implementation Group 1 (Essential - All Projects)

Control 1: Inventory of Enterprise Assets

• MUST maintain asset inventory for all repositories and infrastructure

• MUST tag all cloud resources with Application, Environment, and Owner

Control 2: Inventory of Software Assets

• MUST track all dependencies (package.json, pom.xml, requirements.txt)

• MUST enable Dependabot for automated dependency tracking

• MUST generate Software Bill of Materials (SBOM) for releases

Control 3: Data Protection

• MUST classify data per Data Classification Policy

• MUST encrypt sensitive data at rest (AES-256) and in transit (TLS 1.3)

• MUST implement data retention and disposal procedures

Control 4: Secure Configuration

• MUST use secure defaults for all configurations

• MUST disable unnecessary features and services

• MUST never expose stack traces or debug information in production

Control 5: Account Management

• MUST enforce MFA for all privileged accounts

• MUST disable inactive accounts after 90 days

• MUST review access permissions quarterly

Control 6: Access Control Management

• MUST enforce principle of least privilege

• MUST use role-based access control (RBAC)

• MUST log all privileged actions

Implementation Group 2 (Enhanced Security)

Control 7: Continuous Vulnerability Management

• MUST enable automated vulnerability scanning

• MUST remediate per SLA (Critical: 7d, High: 30d, Medium: 90d, Low: 180d)

Control 8: Audit Log Management

• MUST enable audit logging for all security-relevant events

• MUST protect log integrity (immutable storage)

• MUST retain logs per retention policy

Control 11: Data Recovery

• MUST maintain tested backup and recovery procedures

• MUST test recovery annually

Control 16: Application Software Security

• MUST integrate security scanning in CI/CD (CodeQL, OWASP)

• MUST perform code review for security-sensitive changes

• MUST use parameterized queries and encode output

Implementation Group 3 (Advanced)

Control 17: Incident Response Management

• MUST maintain incident response plan

• MUST conduct tabletop exercises annually

Control 18: Penetration Testing

• SHOULD conduct security testing for public-facing applications

Hack23 ISMS Policy References

• Information Security Policy

• Asset Register - Control 1

• Data Classification Policy - Control 3

• Access Control Policy - Controls 5-6

• Vulnerability Management - Control 7

• Secure Development Policy - Control 16

• Incident Response Plan - Control 17

• Backup Recovery Policy - Control 11

References

• CIS Controls v8.1: https://www.cisecurity.org/controls/v8

• CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks