#Appendix A — The Master Checklist

Every testable control from every chapter of this book, in one place, with a status you can set and share.

This appendix is assembled automatically from the checklist at the end of each chapter, so it can never drift out of sync with the book. Each control is written to be answerable true or false by someone who is not you.

Tiers follow CIS Implementation Group semantics. IG1 is essential cyber hygiene that every organization needs regardless of size. IG2 assumes people whose job is security. IG3 is for organizations facing adversaries who will spend real money to get in. Work down the tiers, not across the chapters — an organization with every IG1 control implemented is in better shape than one with half of Chapter 4 done to IG3.

Set a status on anything below. If the shared store is available to your account, everyone opening this page sees and edits the same board, which is the entire difference between a checklist and a program.

AI 25 controls · Using and Securing AI

• AI-01A documented AI system inventory exists covering internally built, purchased, and vendor-embedded AI, with a named business owner per system and a "last verified" date no older than 90 days. [IG1] [ID.AM] [CIS 1] [CIS 2] [A.5.9]
• AI-02Shadow-AI discovery runs on a defined schedule across at least egress/DNS logs, third-party OAuth consent grants, and expense records, and its output feeds the inventory. [IG1] [ID.AM] [DE.CM]
• AI-03For every AI system in the inventory, the data classes it can read and the data classes it can write or act upon are recorded separately. [IG1] [ID.AM] [CIS 3]
• AI-04An AI acceptable-use policy is published, is one page or less, names sanctioned tools, and states for each whether customer data is used for training and in which region it is processed. [IG1] [GV.PO] [A.5.1]
• AI-05A single accountable owner for AI governance is named as a role in the policy, with documented decision authority for approving or refusing an AI system. [IG1] [GV.RR] [A.5.2]
• AI-06At least one sanctioned AI tool with a signed data processing agreement is available to every employee who has a business need. [IG1] [GV.SC]
• AI-07AI incidents — jailbreak, harmful output, model failure, training-data or retrieval leakage — are handled through the existing incident response process with a defined entry path, not a parallel process. [IG1] [RS.MA] [CIS 17] [A.5.24]
• AI-08Payment and payee-change requests require callback verification to a number held in the vendor or employee master record, never a number supplied in the request. [IG1] [PR.AT] [CIS 14]
• AI-09Help-desk account recovery and MFA re-enrolment require out-of-band verification against an authoritative source, with no documented exception for caller urgency. [IG1] [PR.AA] [CIS 6]
• AI-10Security awareness training teaches channel and structural indicators rather than spelling and grammar, and explicitly states that a video call or familiar voice is not proof of identity. [IG1] [PR.AT] [CIS 14] [A.6.3]
• AI-11Every AI system that can reach private data has documented evidence that at least one leg of the lethal trifecta — private data access, untrusted content ingestion, external communication — is severed, or has a mandatory human confirmation on every outbound action. [IG2] [PR.DS] [CIS 16]
• AI-12Retrieval-augmented systems enforce the requesting user's authorization at query time, and this is verified before launch with a deliberately low-privilege test account. [IG2] [PR.AA] [CIS 3]
• AI-13Every autonomous agent runs under its own identity — not a shared service account and not a standing human-delegated token — with a documented and time-tested revocation procedure. [IG2] [PR.AA] [CIS 5] [CIS 6]
• AI-14Agent runtimes do not carry ambient credentials they do not need: service-account token automounting is disabled where unnecessary and instance-metadata access is restricted. [IG2] [PR.PS] [CIS 4]
• AI-15Tools and MCP servers available to agents are version-pinned with recorded definition hashes, and any change to a tool definition raises an alert and requires re-approval before it takes effect. [IG2] [GV.SC] [DE.CM]
• AI-16Every tool an agent may invoke is classified as reversible or irreversible, and every irreversible action requires a named human approver. [IG2] [GV.RR] [RS.MI]
• AI-17Prompts, retrieved context, tool calls with parameters, and outputs are logged to the SIEM for every agent with access to production data, with retention matching the organization's incident-investigation window. [IG2] [DE.CM] [CIS 8]
• AI-18Every automated or agent-driven alert closure carries the evidence that justified it, and a weekly random sample of agent-closed alerts is re-reviewed by a human with the resulting accuracy recorded as a metric before any expansion of agent autonomy. [IG2] [DE.AE] [RS.AN]
• AI-19AI-drafted detections pass a four-gate CI pipeline — lint, backend conversion, fires on a stored true-positive sample, does not fire on a stored benign sample — before reaching production, and their Blind Spots and False Positives sections are human-authored. [IG2] [DE.CM] [CIS 8]
• AI-20AI supply-chain controls are applied to the AI stack specifically: CI actions pinned by commit SHA, short-lived OIDC credentials instead of long-lived publishing tokens, isolated publish jobs, and an SBOM covering AI components. [IG2] [GV.SC] [CIS 16] [A.5.19]
• AI-21Each AI system has a documented impact assessment scoped against the NIST AI 600-1 generative-AI risk categories, refreshed on material change. [IG2] [ID.RA] [ISO 42001]
• AI-22Third-party AI risk is managed in the vendor process: processing region, training-use commitment, sub-processor list and sub-processor change-notice period are recorded per sanctioned tool and reviewed quarterly. [IG2] [GV.SC] [CIS 15] [A.5.19]
• AI-23Fine-tuning and continued-training data sources have recorded provenance and a review gate for new sources, on the basis that a near-constant small number of poisoned documents can backdoor a model regardless of corpus size. [IG3] [GV.SC] [ID.RA]
• AI-24If the organization provides a GPAI model above the systemic-risk threshold or places a high-risk AI system on the EU market, the applicable AI Act obligations and their live dates are identified in writing by counsel and reflected in the notification matrix. [IG3] [GV.OC] [RS.CO]
• AI-25Production model artefacts are treated as classified assets: access-controlled registry, signed artefacts, per-principal API rate limiting, and monitoring for query patterns consistent with systematic extraction. [IG3] [PR.DS] [CIS 3]

CLD 26 controls · Cloud, Container and Kubernetes Security

• CLD-01A responsibility matrix exists per cloud service in production (not per provider), naming the owner of configuration, identity, data and logs for each. [IG1] [GV.RR] [ID.AM]
• CLD-02Control-plane logging is enabled in every account, subscription and project — CloudTrail management events, Entra audit and sign-in logs, the Azure Activity log exported past its 90-day platform window, GCP Admin Activity — with no unlogged region, account, subscription or tenant. [IG1] [DE.CM] [CIS 8] [A.8.15]
• CLD-03Control-plane logs are exported to storage outside the account that generates them, with object-lock or equivalent immutability, and lifecycle rules on those buckets require security sign-off to change. [IG2] [PR.DS] [CIS 8] [A.5.28]
• CLD-04Documented log retention for control-plane events is at least twelve months, with the risk assessment behind the chosen number recorded on the risk register. [IG2] [DE.CM] [CIS 8]
• CLD-05CloudTrail data events are enabled for S3 buckets and Lambda functions that hold or process regulated data. [IG2] [DE.CM] [CIS 8]
• CLD-06GCP Data Access audit logs are enabled for projects holding regulated data, and their retention is configured beyond the 30-day _Default. [IG2] [DE.CM] [CIS 8]
• CLD-07Microsoft Purview Audit retention is configured deliberately, and where a 10-year add-on has been purchased, a matching custom retention policy has been created and targeted. [IG2] [DE.CM]
• CLD-08SearchQueryInitiatedExchange and SearchQueryInitiatedSharePoint are activated for privileged and high-risk mailboxes. [IG3] [DE.CM]
• CLD-09Every cloud detection has a documented data-source precondition check that fails loudly when the source stops reporting or was never populated. [IG2] [DE.AE]
• CLD-10IMDSv2 is enforced at the account level (HttpTokensEnforced) in all production accounts, and the MetadataNoToken metric reads zero for the fleet. [IG2] [PR.PS] [CIS 4] [A.8.9]
• CLD-11A detection exists for CloudTrail events where ec2RoleDelivery is "1.0", and for ASIA instance-role credentials used from a source IP outside AWS. [IG2] [DE.CM]
• CLD-12An unused-access analyzer runs in every account, and its findings are worked as a tracked remediation queue with an owner and a cadence. [IG2] [PR.AA] [CIS 5] [CIS 6]
• CLD-13External-access analyzers exist in every Region in use, not only the primary Region. [IG2] [ID.AM] [PR.AA]
• CLD-14Cloud accounts are baselined against the relevant CIS Benchmark at Level 1 minimum, and at Level 2 for any account holding regulated data, with drift reported. [IG1] [PR.PS] [CIS 4] [A.8.9]
• CLD-15A pre-built quarantine SCP (or equivalent org-level policy) exists in the management account, has been tested in a drill, and its attachment requires Incident Commander approval. The runbook states that it does not restrict management-account principals or service-linked roles, and names the identity-side alternative for those cases. [IG2] [RS.MI] [A.5.26]
• CLD-16A dedicated isolation security group exists in each VPC with no 0.0.0.0/0 (0-65535) rule in either direction, and the runbook documents that changing security groups does not terminate established connections. [IG2] [RS.MI]
• CLD-17A forensics account exists with read-only access to collected artefacts, and the cross-account snapshot procedure — including sharing the customer-managed KMS key for encrypted snapshots — has been executed end-to-end in a drill within the last 12 months. [IG3] [RS.AN] [A.5.28]
• CLD-18A one-page per-provider revocation card (what kills a session, what kills a credential, what each does not reach) is in the incident war-room kit and reviewed annually. [IG1] [RS.MA] [A.5.24]
• CLD-19Kubernetes control-plane audit logging is enabled on every cluster, with Request-level auditing on Secrets, ServiceAccounts and RBAC objects. [IG2] [DE.CM] [CIS 8]
• CLD-20automountServiceAccountToken is set to false for every workload that does not call the API server, verified by policy rather than by convention. [IG2] [PR.AA] [CIS 4]
• CLD-21NetworkPolicy enforcement has been positively verified on every cluster (a deny-all policy demonstrably blocks traffic), not merely assumed from the presence of a CNI. [IG2] [PR.IR] [CIS 13]
• CLD-22The Kubernetes response runbook requires evidence capture — memory, runtime state, volume snapshot — before any pod or node deletion, and the requirement has been exercised in a tabletop or functional drill. [IG2] [RS.AN] [A.5.28]
• CLD-23PodDisruptionBudgets that would block a containment drain have been identified per cluster, with a documented override procedure. [IG3] [RS.MI]
• CLD-24IRSA / Workload Identity trust policies pin the sub claim to a specific namespace and service account, with no cluster-wide assumable roles. [IG3] [PR.AA] [CIS 6]
• CLD-25Cryptomining findings in container environments are triaged as suspected full control-plane compromise, including a mandatory check of whether the cluster Secret store was read. [IG2] [RS.AN]
• CLD-26A diagnostic setting exports the Azure Activity log beyond its 90-day platform window for every subscription, and resource diagnostic logs are enforced by Azure Policy at management-group scope for resources holding regulated data. [IG2] [DE.CM] [CIS 8] [A.8.15]

COMM 22 controls · Communications, Legal and Regulatory Notification

• COMM-01A communications authority table names, by role, who drafts, who reviews for legal content and who approves release for each of: internal all-staff, external customer, media, partner and regulator communications, with a named deputy for each. [IG1] [CIS 17] [A.5.24] [RS.CO]
• COMM-02A Notification Owner role exists, is distinct from the Incident Commander, is named with a deputy, and owns the deadline register and proof of filing. [IG1] [A.5.24] [GV.RR]
• COMM-03The executive and board briefing cadence is defined in the plan by severity, including the rule that an update is issued at the scheduled time even when there is no new information, and the rule that staff receive external statements before those statements are made public. [IG1] [A.5.24] [RS.CO]
• COMM-04An out-of-band messaging channel and a static-PIN voice bridge exist that do not authenticate against the production identity provider, and every named responder has joined both from a personal device within the last 6 months. [IG1] [A.5.29] [RC.CO]
• COMM-05A printed contact card is held by every named responder at home and at work, carrying responder mobile numbers, bridge number and PIN, outside counsel after-hours number, forensics retainer, and the insurer's policy number and notification line. [IG1] [A.5.24] [RS.CO]
• COMM-06An alternate email path on a separate domain and tenant from production exists for regulator and customer correspondence, and has been tested end to end within the last 12 months. [IG2] [A.5.29]
• COMM-07A written channel-hygiene standard requires every incident-channel statement to be labeled observed or assessed, forbids speculation on cause, attribution and legal exposure, and forbids unverified counts; it is stated aloud at the opening of every incident bridge. [IG1] [A.5.28] [RS.CO]
• COMM-08Legal hold is placed on incident channels, mailboxes and ticketing at declaration, before any review of channel contents, and deletion is prohibited from that point. [IG1] [A.5.28] [RS.AN]
• COMM-09The privilege posture is documented before an incident: which outside counsel retains the forensics firm, under a per-incident engagement scoped to legal advice, and which channel carries legal-strategy discussion. [IG2] [A.5.24] [A.5.28]
• COMM-10The incident record is maintained as two deliberate streams — a factual operational record expected to be produced, and a narrow counsel-directed legal-advice stream — and blanket privilege marking of operational artefacts is prohibited. [IG3] [A.5.28]
• COMM-11Four distinct timestamp fields are captured per incident — awareness, reasonable belief, formal determination, and discovery — each recorded with the role who set it and the evidence relied on. [IG2] [RS.MA] [A.5.28]
• COMM-12A first-24-hours notification decision tree is printed and available in the war room, listing the six scoping facts, the sub-24-hour clock table and the 72-hour staging list. [IG1] [CIS 17] [RS.CO]
• COMM-13A jurisdiction and entity-scope register records, for every country and regime the organization operates in, whether it is in scope, the deadline, the recipient, the portal and the local counsel contact; it is reviewed at least quarterly. [IG2] [GV.OC] [A.5.31]
• COMM-14Contractual notification clocks — business associate agreements, customer MSAs, DFARS flow-downs and the cyber insurance policy — are inventoried in the same register as statutory clocks, keyed by counterparty. [IG2] [A.5.20] [GV.SC]
• COMM-15A separate product-security triage lane exists for CRA Article 14 obligations, distinct from enterprise IR, with a 24-hour early-warning path to the coordinating CSIRT and ENISA. [IG2] [RS.CO] [A.5.31]
• COMM-16A disclosure committee and a written materiality assessment procedure exist for SEC-reporting entities, with a documented cadence ensuring the determination is made without unreasonable delay. [IG2] [GV.OC] [GV.RR]
• COMM-17Five notification templates — media holding statement, regulator notification skeleton, customer notification, employee notification and substantive media statement — plus a journalist Q&A document, are pre-approved by counsel and the Executive Sponsor and are reachable from a personal device with no corporate login. [IG1] [CIS 17] [A.5.24] [RS.CO]
• COMM-18The cyber insurer's notification trigger and deadline, panel vendor list, and pre-approval requirements are extracted from the actual policy and recorded on the printed contact card. [IG1] [A.5.24] [RC.CO]
• COMM-19The board has recorded a written ransom-payment position covering approval authority, facts required before options are presented, the financial ceiling and who may raise it, and any category that will not be paid; it is reviewed annually. [IG2] [GV.RR] [GV.OC]
• COMM-20The ransom decision path mandates OFAC and sanctions screening through counsel before any negotiation concludes, documented contemporaneously, plus insurer notification and a law enforcement and CISA report. [IG2] [GV.OC] [RS.CO]
• COMM-21A named law enforcement liaison role exists, a pre-incident relationship with the relevant field office or national CERT has been established, and the plan requires any delay request to be obtained in writing and reconciled against all other running clocks. [IG2] [RS.CO] [A.5.5]
• COMM-22The regulatory register carries a flagged watch list for regimes in flux — CIRCIA, SEC Item 1.05, the GDPR 96-hour proposal, the UK Cyber Security and Resilience Bill, the HIPAA Security Rule, the TSA surface rule — with a named owner and a quarterly re-verification date. [IG2] [GV.OC] [ID.IM]

CRAFT 25 controls · Plan, Playbook, Runbook

• CRAFT-01A written incident response plan exists, is formally approved by senior leadership, and is under fifteen pages with no commands or tool-level steps in it. [IG1] [GV.PO] [CIS 17] [A.5.24]
• CRAFT-02Every playbook has a named individual owner and a named deputy — not a team alias or distribution list. [IG1] [GV.RR] [A.5.24]
• CRAFT-03Every playbook header carries: id, version, status, owner, approver, created, modified, last_exercised, next_review_due, and TLP marking. [IG1] [GV.PO]
• CRAFT-04Every playbook states entry criteria as observable conditions, and a "do not use this playbook for" list. [IG1] [RS.MA] [A.5.25]
• CRAFT-05Every playbook states exit criteria as a gated, observable condition (for example "no new signs of compromise"), not a subjective judgement. [IG2] [RS.MA]
• CRAFT-06Every playbook contains an explicit loop-back rule directing responders back to the analysis step when new indicators are found. [IG2] [RS.AN]
• CRAFT-07Every playbook has an on_playbook_failure instruction covering what to do when the infrastructure the playbook depends on is unavailable or itself suspect. [IG2]
• CRAFT-08A severity schema of four or fewer levels is published, keyed to business impact across at least functional impact, information impact and recoverability. [IG1] [RS.MA-02] [CIS 17]
• CRAFT-09Each severity level names who is paged, the declaration deadline, the executive update cadence, and what becomes pre-authorized at that level. [IG1] [RS.MA-03]
• CRAFT-10The severity definition contains an explicit round-up-under-uncertainty rule, with reassessment deferred to the post-incident review. [IG1] [RS.MA-02]
• CRAFT-11Escalation (more resources) and elevation (higher management) are defined as separate gates with separate triggers. [IG2] [RS.MA-04]
• CRAFT-12Severity classification is documented as operationally distinct from any regulatory materiality determination, with different named owners. [IG2] [RS.CO]
• CRAFT-13Every decision point in every playbook states a deadline, an authorizing role, a named deputy, both branches, and a default action if the deadline passes undecided. [IG1] [GV.RR]
• CRAFT-14A pre-authorized actions table exists, listing actions responders may take with no approval and log afterwards. [IG1] [RS.MI]
• CRAFT-15An approval-gated actions table exists with three columns — action, authorizing role, out-of-hours reach path — and is signed by the executive whose services it covers. [IG1] [GV.RR] [A.5.24]
• CRAFT-16For every critical business service, the plan names who may stop it, who must be told, what evidence justifies stopping it, and the default if that person is unreachable within a stated interval. [IG2] [GV.RR]
• CRAFT-17Contracts with any MSSP or managed provider state explicitly whether the provider may take unilateral containment action on your estate. [IG2] [GV.SC]
• CRAFT-18Containment sections place a considerations block — mission impact, containment duration and effectiveness, evidence impact — above the action list. [IG2] [RS.MI]
• CRAFT-19Playbooks are stored in version control with per-playbook ownership and change review recorded before merge. [IG2] [GV.PO]
• CRAFT-20An automated check fails or flags any playbook whose last_exercised date is older than the documented interval, and such playbooks are marked Draft. [IG3] [ID.IM-02]
• CRAFT-21Playbooks reference atomic, separately-owned runbooks by ID rather than inlining commands, so a tool change is fixed once. [IG3] [GV.PO]
• CRAFT-22A current printed copy of the plan, active playbooks and the contact card is held by every person with an assigned response role, dated and reissued at a documented interval. [IG1] [RC.CO] [A.5.29]
• CRAFT-23A documented review frequency exists, plus four event triggers — real activation, exercise, audit finding, and change of tooling/supplier/authority/regulation — each with a deadline and an owner. [IG1] [ID.IM-01] [ID.IM-03] [A.5.27]
• CRAFT-24Post-incident and post-exercise findings are tracked as owned, dated items in the same system used for other committed work, and closure is verified. [IG2] [ID.IM-03] [A.5.27]
• CRAFT-25The response contact cascade is tested against a stated time limit at least annually, and the test result is recorded. [IG1] [RS.CO] [A.6.8]

DATA 25 controls · Data, Cryptography and the Post-Quantum Clock

• DATA-01A data inventory exists listing every data store holding Restricted data, with a named business owner per store, reviewed at least annually. [IG1] [ID.AM] [CIS 3]
• DATA-02The classification scheme has no more than three tiers, and every Restricted data set carries a regulatory flag list and a numeric confidentiality-lifetime value in years. [IG1] [ID.AM] [CIS 3]
• DATA-03At least one automated technical control (access policy, DLP rule, egress alert or encryption requirement) is driven by the classification label, not merely documented against it. [IG2] [PR.DS]
• DATA-04Cloud external-exposure analysis is enabled in every region and account in use, and its findings are triaged on a defined SLA. [IG1] [PR.DS] [CIS 3]
• DATA-05No non-production environment contains unmasked production personal or regulated data, verified by sampling at least annually. [IG2] [PR.DS]
• DATA-06Each Restricted data store has its own credentials, its own restricted network path, and no shared service account with another store. [IG2] [PR.AA] [PR.DS]
• DATA-07A bulk-read or bulk-export alert with a defined numeric threshold exists on every Restricted data store and routes to a monitored queue. [IG2] [DE.CM] [CIS 3]
• DATA-08At least one DLP rule is in enforcing (block) mode with a documented, logged self-service exception path; the count of enforcing rules is reported to leadership quarterly. [IG2] [PR.DS]
• DATA-09All Restricted data is encrypted at rest under a customer-managed key, and the key policy denies access to principals outside a defined list. [IG2] [PR.DS]
• DATA-10A key custody record exists for every Restricted data store, stating key type, key material location, who can decrypt, and who can alter the key policy. [IG2] [PR.DS]
• DATA-11TLS is enforced on internal service-to-service traffic, not only at the perimeter, with plaintext internal protocols enumerated and exception-tracked. [IG2] [PR.DS]
• DATA-12Every certificate has a named owner and an expiry alert, and every traffic-inspection point is monitored for loss of event flow as well as for alerts. [IG1] [PR.DS] [DE.CM]
• DATA-13No static long-lived cloud or registry credential exists in any CI/CD pipeline; workload identity federation or equivalent short-lived credentials are used instead. [IG2] [PR.AA]
• DATA-14Secret scanning runs pre-commit and in CI, full repository history has been scanned at least once, and every hit is tracked to a revocation timestamp at the issuing system. [IG1] [PR.AA] [CIS 3]
• DATA-15Secret-store access is logged, and reading a secret a principal has never read before generates an alert. [IG3] [DE.CM] [CIS 8]
• DATA-16A cryptographic inventory exists covering TLS endpoints and negotiated suites, certificates, signing keys, VPN/SSH configuration, storage and database encryption, and KMS/HSM key material — generated automatically, not maintained by hand. [IG2] [ID.AM] [PR.DS]
• DATA-17Every Restricted data set has been scored against the L + M vs. planning-horizon calculation, producing a ranked post-quantum migration backlog with owners and target dates. [IG2] [ID.RA]
• DATA-18Standard procurement and renewal templates require vendors to state their FIPS 203 / 204 / 205 support roadmap with dates, and the answers are recorded against the vendor record. [IG1] [GV.SC]
• DATA-19Cipher suites, key sizes and signature algorithms are set from central configuration in systems you build; no algorithm identifier is hard-coded in first-party application code. [IG3] [PR.PS]
• DATA-20Certificate issuance and renewal are fully automated for all first-party services, with a tested rollback path for an algorithm or suite change. [IG2] [PR.PS]
• DATA-21Code and firmware signing keys are inventoried with their expected field lifetime, and any key whose signed artefacts outlive the 2035 disallow date has a documented migration plan. [IG3] [PR.PS] [GV.SC]
• DATA-22A written retention schedule exists per data class, signed by Legal, citing the statutory or contractual basis per line. [IG1] [GV.PO]
• DATA-23Scheduled deletion is automated and produces a log record; no routine deletion depends on a person remembering to run it. [IG2] [GV.PO] [PR.DS]
• DATA-24Object-storage immutability used for evidence or legal hold is configured in compliance mode, not governance mode, and no standing role holds the governance-bypass permission. [IG3] [PR.DS] [A.5.28]
• DATA-25A legal hold placement and release drill is run at least annually against a real data store, timed, and recorded — including confirmation that the hold precedes any containment action in the IR playbook. [IG2] [A.5.28] [RS.MA]

DEPT 25 controls · Departmental Playbooks

• DEPT-01A standalone one-page playbook exists for each of Finance, HR, Legal, Communications, Sales/CS, Engineering and the Executive team, each naming an owner in that department. [IG1] [GV.RR] [CIS 17] [A.5.24]
• DEPT-02Each departmental page is available offline and does not require the corporate network or intranet to retrieve. [IG1] [RS.CO] [A.5.29]
• DEPT-03Every departmental page uses the same severity scale, role names and clocks as the central plan, and is re-versioned whenever the plan changes. [IG1] [GV.PO] [A.5.24]
• DEPT-04A documented payment and bank-detail verification procedure requires an out-of-band callback to a number taken from the vendor master record or a signed contract, never from the request itself. [IG1] [PR.AT] [CIS 14]
• DEPT-05No role, including the CEO and CFO, may waive the payment callback for an individual transaction, and the finance policy says so. [IG1] [GV.PO] [GV.RR]
• DEPT-06The bank fraud-line number, its staffed hours, the confirmed recall window and the law-enforcement fraud reporting path are printed on the Finance page and were verified within the last 12 months. [IG1] [RS.CO]
• DEPT-07No extortion payment can be disbursed without documented sanctions/OFAC screening and written counsel sign-off, with the screening evidence retained. [IG2] [GV.RR] [RS.MA]
• DEPT-08The cyber insurance policy number, 24-hour claims line, notice deadline and panel-vendor list are printed on the Finance page. [IG2] [GV.SC] [A.5.19]
• DEPT-09Offboarding revokes sessions and resets credentials in a single action, and also removes OAuth grants, registered devices, MFA methods, inbox rules and forwarding. [IG1] [PR.AA] [CIS 5]
• DEPT-10A legal hold is placed and identity/access logs are exported before any account is disabled in a suspected insider or compromise case. [IG2] [RS.AN] [CIS 8] [A.5.28]
• DEPT-11A role change recorded in the HRIS automatically triggers an access review for that individual, not only a new-access request. [IG2] [PR.AA] [CIS 6]
• DEPT-12Insider-threat suspicion travels on a named need-to-know list with every addition logged, and no line manager is informed without joint HR and Legal agreement. [IG2] [GV.RR] [A.5.28]
• DEPT-13A responder shift roster with named deputies, an explicit authority to stand a responder down, and a printed EAP contact exist before an incident is declared. [IG1] [GV.RR] [PR.AT]
• DEPT-14Outside breach counsel is retained with a tested after-hours contact, and a per-incident forensic engagement template executed by outside counsel exists. [IG2] [GV.SC] [A.5.24]
• DEPT-15A litigation hold can be issued within one hour of incident declaration by a named person with a named deputy. [IG2] [RS.MA] [A.5.28]
• DEPT-16A contractual notification inventory (customer MSAs, BAAs, insurance, flow-down clauses) is maintained alongside the statutory matrix and refreshed each contract renewal cycle. [IG2] [GV.SC] [CIS 15] [A.5.20]
• DEPT-17Incident-channel writing rules — facts and timestamps only, "observed" distinguished from "assessed" — are issued at declaration and enforced by the Scribe. [IG2] [RS.CO]
• DEPT-18A counsel-approved holding statement exists, is stored offline, and can be published by the Communications Lead without further approval. [IG1] [RS.CO] [A.5.24]
• DEPT-19Standing policy requires staff to receive any external statement before it is published publicly. [IG1] [RS.CO] [RC.CO]
• DEPT-20Every customer-facing employee holds the "were we affected" script and the may-say / may-not-say table, and has rehearsed the script aloud. [IG1] [PR.AT] [CIS 14]
• DEPT-21Outbound security questionnaires, trust-centre updates and contractual security representations pause automatically on a SEV-1 or SEV-2 declaration and route to the Legal Liaison. [IG2] [GV.SC] [RS.CO]
• DEPT-22Evidence capture precedes remediation, enforced by tooling: a host cannot be reimaged nor a node terminated with an open incident ticket unless an evidence manifest is attached. [IG2] [RS.AN] [CIS 8] [A.5.28]
• DEPT-23A change freeze takes effect automatically on SEV-1/SEV-2 declaration, with a single named exception approver and every approved change logged to the incident. [IG2] [RS.MI] [CIS 4]
• DEPT-24Every critical service has a named individual and named deputy authorized to stop it, with a documented default action if neither is reachable within 15 minutes. [IG1] [GV.RR] [A.5.2]
• DEPT-25The materiality assessment convenes on a documented cadence from the first hours of a candidate incident, with attendees, inputs and conclusion minuted each time. [IG2] [GV.OV] [RS.CO]

DET 25 controls · Detection and Monitoring

• DET-01A documented log retention period exists for each of the top five enterprise log-source priority tiers, set against a stated dwell-time assumption and signed by a named executive. [IG1] [DE.CM] [CIS 8] [A.8.15]
• DET-02Identity provider audit and sign-in logs are exported beyond vendor default retention (7 or 30 days) to a destination retaining at least twelve months. [IG1] [DE.CM] [CIS 8] [A.8.15]
• DET-03PowerShell script-block logging, module logging and command-execution logging are enabled on all Windows servers and administrative workstations. [IG1] [DE.CM] [CIS 8]
• DET-04All log timestamps are UTC in ISO 8601 format from a validated time source, and OT systems synchronise time from IT and never the reverse. [IG1] [DE.CM] [CIS 8]
• DET-05Centralized logs are written to a destination in a separate trust domain, using credentials that cannot delete or modify prior records. [IG2] [DE.CM] [PR.DS] [A.8.15]
• DET-06Archived logs held for evidentiary purposes are stored with true immutability (object lock in compliance mode or equivalent), not an overridable governance mode. [IG2] [PR.DS] [A.5.28]
• DET-07A source-health monitor alerts on log sources that fall below an expected event-rate floor, and paging is enabled for silence from any priority tier 1-3 source. [IG2] [DE.CM] [DE.AE]
• DET-08SOC tooling and sensors are managed out of band and do not authenticate against the production identity plane they are used to investigate. [IG2] [PR.IR] [CIS 13]
• DET-09Every detection product in use has a named individual owner, a recorded annual all-in cost including ingest, and a documented list of detections it uniquely delivers. [IG2] [GV.RR] [ID.AM]
• DET-10Detection logic is stored in version control, changed by pull request, and reviewed by someone other than the author before production. [IG2] [DE.CM] [ID.IM]
• DET-11CI validates every detection rule against schema, converts it for every configured backend, confirms it fires on a stored true-positive sample, and confirms it does not fire on a stored benign sample — in that order. [IG3] [DE.CM] [ID.IM]
• DET-12Every production detection documents its ATT&CK mapping, blind spots and assumptions, known false positives, validation procedure and the response action it triggers. [IG3] [DE.CM] [RS.AN]
• DET-13Detection coverage is reported per prioritized technique as three separate values — telemetry, logic, validated — never as a single percentage. [IG2] [DE.CM] [ID.IM]
• DET-14ATT&CK-derived content is version-pinned, and the current coverage baseline has been rebuilt against ATT&CK v19 or later following the Defense Evasion tactic split. [IG2] [DE.CM]
• DET-15Techniques with no supporting telemetry are recorded as ingest gaps with an estimated cost, separately from techniques that lack detection logic. [IG2] [ID.RA] [DE.CM]
• DET-16Every threat-intelligence feed has a named owner and a recorded scope of what it may modify automatically — block, alert, or enrich only. [IG2] [ID.RA] [A.5.7]
• DET-17New indicators of compromise trigger a retrospective hunt across the full retained log window, not only a forward-looking block. [IG2] [DE.AE] [RS.AN] [A.5.7]
• DET-18Documented ingestion lag is recorded for every log source used in a time-sensitive playbook step, so a clean early result is not mistaken for an absence of activity. [IG3] [DE.AE]
• DET-19Every detection at SEV-3 or above maps to a named playbook with a checkable entry criterion. [IG1] [DE.AE] [RS.MA] [CIS 17]
• DET-20False positives are logged as defects against the named detection and its owner, and each detection's defect count is reviewed on a defined cadence. [IG2] [DE.AE] [ID.IM]
• DET-21Every alert suppression has a recorded rationale, a named owner and an expiry date; no suppression is open-ended. [IG2] [DE.CM] [ID.IM]
• DET-22On-call rotas name a deputy for every shift, and out-of-hours coverage is documented in the incident response plan rather than assumed. [IG1] [GV.RR] [RS.MA]
• DET-23At least three honeytokens or canary credentials are deployed across identity, cloud and file storage, each wired to a high-severity alert. [IG1] [DE.CM] [DE.AE]
• DET-24A purple-team or adversary-emulation exercise is run at least annually, with every emulated technique recorded as detected, alerted-only or missed, and every gap assigned an owner and a date. [IG2] [ID.IM] [DE.CM] [CIS 18]
• DET-25Every incident record carries a detection-source field (internal or external), and the internal detection rate is reported quarterly alongside MTTD. [IG2] [ID.IM] [GV.OV]

EX 25 controls · Exercising the Playbook

• EX-01A documented exercise program exists, naming an owner, the exercise types in use, and a stated frequency for each — with no entry reading "as needed". [IG1] [ID.IM-02] [CIS 17] [A.5.24]
• EX-02Written, testable objectives and evaluation criteria are approved before the scenario is written, for every exercise. [IG1] [ID.IM-02]
• EX-03Every exercise has a named facilitator and a separate named data collector, who meet in advance with the objectives, scoring sheet and prior findings. [IG2] [ID.IM-02]
• EX-04A Master Scenario Events List exists for every operations-influenced exercise, with each inject specifying time, recipient, source, delivery means and message text, and mapped to an objective. [IG2] [ID.IM-02]
• EX-05Senior-level and operational-level exercises are run separately before any combined exercise is attempted. [IG2] [GV.RR] [A.6.3]
• EX-06Every exercise is scored per objective on a four-level scale, records time-to-milestone for declaration, command assembly, first containment approval and first holding statement, and records a count of decisions stalled awaiting an absent authority. [IG2] [ID.IM-02]
• EX-07A verbal hotwash is held immediately after every exercise, before participants leave, and draft findings are circulated for calibration before the written review. [IG1] [ID.IM-02] [A.5.27]
• EX-08Every exercise produces an After-Action Report paired with an Improvement Plan in which each finding carries an ID, owner (a role), due date, written acceptance test and the specific playbook change it requires. [IG1] [ID.IM-02] [A.5.27]
• EX-09Exercise findings are tracked to closure in the same system as vulnerability findings, and closure requires the acceptance test to be run by someone other than the finding's owner. [IG2] [ID.IM-02]
• EX-10Every playbook header carries a last_exercised date, and an automated check flags or fails any playbook whose date exceeds the documented interval. [IG3] [ID.IM-02]
• EX-11The notification/call-tree cascade is tested unannounced at least quarterly, with acknowledgement rate and elapsed time recorded. [IG1] [RS.CO] [CIS 17]
• EX-12An out-of-band incident bridge, reachable without the primary identity provider, is convened as a test at least quarterly, using details held offline. [IG1] [CIS 17] [A.5.29]
• EX-13A printed copy of the plan, the relevant playbooks and the contact list is verifiably held by every named responder, and currency is spot-checked each quarter. [IG1] [A.5.24]
• EX-14At least one defined critical system is restored end-to-end to an isolated environment each quarter, with the measured duration compared against its documented RTO. [IG1] [CIS 11] [RC.RP] [A.5.30]
• EX-15Every break-glass account is used in a controlled window at least quarterly, verifying that access succeeds, the alert fires, and the use is reviewed. [IG2] [PR.AA]
• EX-16The after-hours escalation chain is paged unannounced outside business hours at least twice a year, with acknowledgement times recorded at every tier. [IG2] [RS.MA]
• EX-17The IR retainer and insurer breach-response lines are called annually to confirm reachability, contract currency, and any panel constraint that conflicts with the retained provider. [IG1] [GV.SC-08] [CIS 15]
• EX-18At least one exercise per year includes a critical supplier or third-party provider as a participant. [IG2] [GV.SC-08] [ID.IM-02]
• EX-19Adversary emulation is run against the organization's prioritized techniques at least quarterly, under written authorization naming scope, operator, time window and emergency stop contact. [IG3] [CIS 18] [DE.AE]
• EX-20All emulation activity is deconflicted with the defending team in advance, with a staffed deconfliction channel, an agreed automated-containment exclusion list, and a canary convention that lets an analyst identify the activity as authorized. [IG3] [CIS 18]
• EX-21Detection coverage is reported as a per-technique triple — telemetry present, logic enabled, last validated firing date — and never as a single coverage percentage. [IG3] [DE.CM] [A.8.16]
• EX-22The ATT&CK version underlying every coverage map and purple-team report is recorded, and the coverage baseline is rebuilt at least annually against the current pinned version. [IG3] [DE.AE]
• EX-23Following every SEV-1 or SEV-2 incident, the adversary's observed TTPs are emulated to verify that the newly implemented countermeasures detect or mitigate them. [IG3] [ID.IM-03] [DE.CM]
• EX-24A register of internet-facing systems without enforced phishing-resistant MFA is enumerated at least quarterly, with an owner and an end date against every entry. [IG1] [PR.AA] [CIS 6]
• EX-25A missed scheduled exercise is recorded as a tracked exception with a named accepting authority and a rescheduled date. [IG2] [GV.RR] [ID.IM-01]

GOV 25 controls · Governance, Frameworks and Metrics

• GOV-01A single Information Security Policy exists, approved by the board or senior leadership within the last 12 months, stating authority to disconnect, isolate or shut down technology assets by role. [IG1] [GV.PO-01] [A.5.1]
• GOV-02A written risk appetite and risk tolerance statement exists, states monetary or equivalent thresholds, names the accepting authority at each threshold, and has been communicated beyond the security team. [IG2] [GV.RM-02]
• GOV-03Cybersecurity risk is represented in the enterprise risk management process using the same register, cadence and reporting line as other enterprise risks — not a parallel security-only process. [IG2] [GV.RM-03]
• GOV-04A standardized, documented method for calculating, categorizing and prioritizing cyber risk is in use, and every register entry is scored by that method. [IG2] [GV.RM-06]
• GOV-05The policy library contains no more than one policy plus a numbered set of standards; every technical parameter (key length, MFA type, retention period, patch SLA) lives in a standard, not in a board-approved policy. [IG1] [GV.PO] [A.5.1]
• GOV-06Every standard carries an enforcement evidence field naming the query, report or console view that proves compliance, plus its enumerated exceptions. [IG2] [GV.PO-01]
• GOV-07Every document in the policy library has a named owner role and a review date in the future; zero documents are past their review date. [IG1] [GV.PO-02] [A.5.1]
• GOV-08The risk register contains between 15 and 30 top-level scenarios, each written as actor + action + asset + consequence in one sentence. [IG2] [ID.RA]
• GOV-09Every register entry has a named accountable role, a treatment decision, and — where accepted — a named accepting authority, an acceptance date, and an expiry date no more than 12 months out. [IG1] [ID.RA] [GV.RR-02]
• GOV-10Every register entry carries an aggregate theme tag, and exposure is reported summed by theme as well as by individual entry. [IG2] [ID.RA] [GV.OV-01]
• GOV-11At least the top three risk scenarios are quantified in monetary terms with stated frequency and magnitude inputs, and the inputs' basis is documented. [IG2] [GV.RM-06] [ID.RA]
• GOV-12Every control investment proposal over the organization's defined threshold states which FAIR factor it acts on (threat event frequency, vulnerability, or loss magnitude) and its estimated loss-exposure reduction. [IG3] [GV.RM-06]
• GOV-13Actual costs from completed incidents are fed back as loss-magnitude calibration data within one quarter of incident closure. [IG3] [ID.IM-03]
• GOV-14A CSF 2.0 Target Profile exists — adapted from a Community Profile where one applies — and a gap analysis against the Current Profile has produced a dated action plan with owners. [IG2] [GV.OC] [ID.IM-01]
• GOV-15The organization's framework set is documented with, for each framework, the named external party or internal decision that requires it; no framework is maintained without such a justification. [IG1] [GV.OC-03]
• GOV-16Every framework in use is pinned to a current version, and no framework in use is past a published transition deadline. [IG1] [GV.OC-03] [A.5.36]
• GOV-17A single crosswalk artefact maps IR lifecycle phases to CSF 2.0 Categories, CIS Controls and ISO 27001 Annex A controls, and is published in both phase-ordered and Function-ordered views from one source. [IG2] [GV.OC] [RS.MA]
• GOV-18Every incident record carries a detection-source field (internal or external), and internal detection rate is reported quarterly alongside dwell time. [IG2] [ID.IM] [GV.OV-03]
• GOV-19The board reporting pack contains no metric that lacks either a trend line or an attached decision; attacks-blocked counts and averaged single maturity scores do not appear. [IG2] [GV.OV-01]
• GOV-20Every board cybersecurity session includes at least one explicit decision request with options, costs, loss-exposure deltas, and the stated consequence of deferral — and the decision is recorded in the minutes. [IG2] [GV.OV-01] [GV.RR-01]
• GOV-21The board pack includes a named coverage-gap page listing what the organization cannot currently detect or recover from, with an owner and a cost per gap. [IG2] [GV.OV-02] [DE.CM]
• GOV-22Every control in the control inventory carries a state of Documented, Implemented, Operating or Validated, plus a last-validated date; no control is reported as complete to leadership on Implemented status alone. [IG2] [GV.OV-03] [ID.IM-02]
• GOV-23Coverage for each Operating-state control is expressed as a fraction with an enumerated exception list, not as a binary yes/no. [IG2] [GV.OV-03]
• GOV-24A 1–3 year roadmap exists with decreasing date precision by horizon, is ordered on dependency, and is reviewed at the cadence defined for each horizon band. [IG2] [GV.RM-04]
• GOV-25Every roadmap item names the risk scenario it reduces and the estimated exposure delta, or names the external requirement it satisfies; items meeting neither test are removed. [IG2] [GV.RM-01] [GV.RR-03]

IAM 26 controls · Identity and Access: The New Perimeter

• IAM-01A complete inventory of identities exists — human and non-human — with a named owner for every entry, refreshed at least quarterly. [IG1] [PR.AA] [CIS 5]
• IAM-02Phishing-resistant MFA (FIDO2/WebAuthn or PKI) is enforced for every account holding a privileged role on every platform, with no exception group. [IG1] [PR.AA] [CIS 6]
• IAM-03Push, SMS and voice are removed as registered authentication methods on all privileged accounts, not merely deprioritized. [IG2] [PR.AA] [CIS 6]
• IAM-04Privileged accounts require attested, device-bound authenticators; synced passkeys are not accepted for privileged roles. [IG3] [PR.AA]
• IAM-05Every system reachable from the internet — VPN, firewall management, hypervisor console, backup portal, legacy applications — either federates to the identity provider or carries a documented exception with a named approver and an expiry date. [IG1] [PR.AA] [CIS 6]
• IAM-06Standing membership of the highest-privilege groups on each platform is zero, excluding break-glass accounts; privileged roles are activated just-in-time with justification, time-bounding and an audit record. [IG2] [PR.AA] [CIS 5]
• IAM-07Administrators use separate administrative identities that hold no mailbox and are not used for email or general web browsing. [IG1] [PR.AA] [CIS 5]
• IAM-08Every de-elevation step in every runbook is paired with an explicit session revocation, because group-membership changes can take up to a day to reach resource providers. [IG2] [RS.MI]
• IAM-09Identity logs — sign-in, audit, OAuth token and cloud control-plane — are routed to storage whose retention exceeds the organization's median dwell-time assumption, and the configuration date is recorded. [IG1] [DE.CM] [CIS 8] [A.8.15]
• IAM-10Named detections exist and are enabled for: high-risk sign-in, MFA method change, admin consent grant, new inbox rule or forwarding address, privileged role assignment outside a JIT window, and cloud credential use from outside the environment. [IG2] [DE.CM] [A.8.16]
• IAM-11Every non-human identity — service principal, workload identity, API key, CI publishing token, Kubernetes service-account token — has a named human owner and a documented single-command revocation procedure. [IG2] [PR.AA] [CIS 5]
• IAM-12CI/CD pipelines use short-lived federated credentials rather than long-lived static secrets, and third-party actions are pinned by commit SHA. [IG2] [PR.AA]
• IAM-13Secret scanning is enabled on source control, ticketing systems and wikis, and findings are rotated rather than only deleted. [IG1] [PR.AA] [CIS 3]
• IAM-14Every deployed AI agent holds its own scoped, short-lived workload identity and never authenticates using a human user's token, session cookie or personal access token. [IG2] [PR.AA]
• IAM-15An agent register exists listing every deployed agent with its identity, scopes, owner, revocation command and last review date; the revocation command has been tested. [IG2] [ID.AM] [PR.AA]
• IAM-16At least two cloud-only break-glass accounts exist, are excluded from every Conditional Access policy including vendor-managed policies, are excluded from automated lifecycle jobs, and have credentials split under physical dual control. [IG1] [PR.AA]
• IAM-17Any authentication attempt against a break-glass account alerts the SOC and a named executive, and the break-glass procedure is tested at least twice a year — the IG1 floor, raised to quarterly at IG2 by EX-15 in Chapter 18 — with the test and the alert both logged. [IG1] [DE.CM] [PR.AA]
• IAM-18Backup and recovery consoles authenticate with dedicated non-SSO emergency credentials that do not depend on the production identity provider, and a restore has been tested using only those credentials. [IG2] [PR.AA] [RC.RP]
• IAM-19A written help-desk verification script governs all password reset, MFA reset, MFA device transfer and contact-change requests, requiring out-of-band callback to the number of record and a second identity factor. [IG1] [PR.AA] [PR.AT]
• IAM-20Help-desk agents face no handle-time or satisfaction penalty for refusing an unverifiable request, and unannounced test calls are run at least monthly. [IG2] [PR.AT]
• IAM-21A tenant-wide MFA re-enrolment freeze is documented, pre-authorized to a named role, and has been tested. [IG3] [RS.MI]
• IAM-22End-user OAuth consent is restricted or disabled, and a tenant-wide inventory of delegated and application permissions is reviewed monthly with attention to AllPrincipals grants; any community script or module the inventory depends on is downloaded, reviewed and staged in the responder toolkit in peacetime, along with the ExchangeOnlineManagement module and a tested Connect-ExchangeOnline path. [IG2] [PR.AA] [CIS 6]
• IAM-23Every identity containment runbook places token and session revocation before or alongside the credential reset, includes an OAuth-grant revocation branch, includes a non-human identity branch, and ends with an observation-based verification step. [IG1] [RS.MI]
• IAM-24Privileged access reviews run monthly and general access reviews quarterly, each producing a dated before-and-after entitlement export, a list of removals, and a named accountable reviewer. [IG1] [PR.AA] [CIS 5] [CIS 6]
• IAM-25Joiner/mover/leaver reconciliation runs monthly against HR records, and the exception list — directory accounts with no HR record, and the reverse — is worked to zero. [IG2] [PR.AA] [CIS 5]
• IAM-26The risky workload-identity queue — risky service principals and their leaked-credential, anomalous-sign-in and suspicious-API-traffic detections — is worked on the same cadence as the risky-user queue, with a named owner and a record of each disposition. [IG2] [DE.CM] [PR.AA]

IR 26 controls · The Incident Response Lifecycle

• IR-01A written incident response plan names the lifecycle model in use, the six incident command roles by title, and the escalation and elevation paths, and has been reviewed within the last 12 months. [IG1] [CIS 17] [A.5.24] [GV.RR]
• IR-02Any responder on the security on-call rotation is explicitly authorized to declare an incident at any severity without prior approval, and this authority is stated in the plan. [IG1] [A.5.25] [RS.MA]
• IR-03Declaration criteria are written as observable triggers (second team involved, customers affected, unresolved after one hour of focused analysis, lateral movement, credential access, exfiltration, more than one user or system, compromised administrator account). [IG1] [A.5.25] [DE.AE]
• IR-04A deconfliction path exists to confirm within minutes whether suspected activity is authorized administrative work, with a named on-call contact in IT operations. [IG2] [A.5.25]
• IR-05The four-level severity scale (SEV-1 to SEV-4) is documented with a response obligation per level — who is paged, in what time, who is told, what is pre-authorized — and includes an explicit round-up-under-uncertainty rule. [IG1] [CIS 17] [RS.MA-03]
• IR-06Severity is keyed to business impact and names functional impact, information impact and recoverability as dimensions; the plan states that severity is separate from regulatory materiality determination. [IG2] [RS.MA-03]
• IR-07Incident Commanders and Deputy ICs are named by person, the rotation is published, and the plan states that the IC performs no technical work. [IG1] [CIS 17] [A.5.24] [GV.RR]
• IR-08A Scribe is assigned at declaration for every SEV-1 and SEV-2 incident and records decisions and rationale — not only events — with all timestamps in UTC. [IG2] [RS.AN] [A.5.28]
• IR-09A written shift handover template is in the plan, and handover requires explicit verbal confirmation of the transfer of command. [IG2] [A.5.24]
• IR-10For every critical service, the plan names who may take it offline, who must be told, and the default action if that person is unreachable within 15 minutes. [IG1] [RS.MI] [A.5.26]
• IR-11A pre-authorized actions table and an approval-gated actions table exist, each naming the authorizing role and the out-of-hours reach path. [IG2] [RS.MI]
• IR-12An out-of-band communications channel and voice bridge exist that do not authenticate against the production identity provider, and have been successfully joined in a test within the last 6 months. [IG1] [A.5.29] [RC.CO]
• IR-13A printed copy of the plan and contact list is held by every person with a named response role, and the contact list has been cascade-tested within the last 6 months. [IG1] [A.5.24] [RS.CO]
• IR-14SOC and IR tooling — SIEM, case management, credential vault, backup catalog — is segmented from enterprise IT and does not depend on the identity plane it would be used to investigate. [IG2] [CIS 13] [PR.IR]
• IR-15Log retention for identity, cloud control plane, endpoint and network sources is documented, exceeds the organization's assessed dwell-time risk, and the shortest-retention source is known by name. [IG1] [CIS 8] [A.8.15] [DE.AE]
• IR-16Every playbook's containment section begins with exporting logs approaching retention expiry and placing legal hold, before any isolation or credential action. [IG2] [A.5.28] [RS.AN]
• IR-17Evidence is collected in order of volatility, analyzed only from working copies, and stored in a repository accessible only to responders, encrypted, with documented retention. [IG2] [A.5.28] [RS.AN]
• IR-18A chain-of-custody record is completed for every acquired artefact, covering acquisition, hash verification, storage, every custody transfer with no gaps, and every examination. [IG2] [A.5.28]
• IR-19Every playbook states the containment considerations — mission impact, duration and effectiveness, evidence impact — before any containment action, and requires the IC to record which one drove the decision. [IG2] [RS.MI] [A.5.26]
• IR-20The loop-back rule is written into every playbook: new signs of compromise during containment or after eradication require returning to technical analysis and re-scoping, not proceeding. [IG1] [RS.AN] [A.5.26]
• IR-21The eradication gate is enforced and documented — persistence accounted for, activity contained, evidence collected, external providers and law enforcement coordinated with — before eradication begins. [IG2] [RS.MI] [A.5.26]
• IR-22A recovery dependency order is documented service by service, identity plane first, with a validation gate including a security controls assessment between tiers before production return. [IG2] [CIS 11] [RC.RP] [A.5.30]
• IR-23A blameless post-incident review is held for every SEV-1 and SEV-2 incident, scheduled at declaration, with findings circulated for calibration before the meeting. [IG1] [CIS 17] [A.5.27] [ID.IM]
• IR-24Every post-incident finding carries a named owner, a due date, a written acceptance test, an independent verification step and an identified playbook change, and is tracked to closure in the same system as vulnerability findings. [IG2] [A.5.27] [ID.IM]
• IR-25The privilege posture is decided in writing before an incident: who retains the forensics firm, under what engagement, and which channel carries legal-strategy discussion. [IG2] [A.5.24] [RS.CO]
• IR-26Responder welfare provisions are in the plan: a mandatory IC rotation interval, a named welfare owner outside the response chain, and staffing for the incident's long tail. [IG1] [A.5.24] [GV.RR]

LAND 15 controls · Why 2026 Broke the Old Playbook

• LAND-01An inventory of enterprise assets, software, cloud accounts and internet-facing services exists, is refreshed at a documented interval, and a named role owns it. If false, start at Chapter 6 and Chapter 10 — nothing else in this book works without it. [IG1] [ID.AM] [CIS 1] [CIS 2]
• LAND-02Phishing-resistant MFA (FIDO2/WebAuthn or PKI) is enforced for every account holding a privileged role, with a documented, time-bounded exception list reviewed at least quarterly. If false, read Chapter 4 first. [IG1] [PR.AA] [CIS 5] [CIS 6]
• LAND-03A written procedure exists for verifying the identity of anyone requesting a password reset or MFA re-enrolment through the IT service desk, using out-of-band verification. If false, read Chapter 4. [IG1] [PR.AA]
• LAND-04Identity containment is defined as session and token revocation followed by password reset, and the responder-facing runbook states that order and why. If false, read Chapter 4 and Chapter 14.4. [IG2] [RS.MI]
• LAND-05A restore from backup to a production-equivalent environment has been completed and timed within the last 12 months, and the measured restore time is recorded. If false, read Chapter 12 before anything else — this is the control that decides whether a ransomware incident is a bad week or an existential one. [IG1] [RC.RP] [CIS 11]
• LAND-06Backup integrity, identity services, hypervisor management and certificate services are verified as a named pre-check inside the ransomware playbook, before restoration begins. If false, read Chapter 12 and Chapter 14.1. [IG2] [RC.RP]
• LAND-07Every internet-facing edge appliance is inventoried with its vendor, version and management-interface exposure, and KEV-listed vulnerabilities in that inventory carry a tracked remediation SLA. If false, read Chapter 10 and Chapter 14.12. [IG1] [ID.AM] [CIS 7]
• LAND-08A complete inventory of OAuth grants, connected applications, service principals and CI publishing tokens exists, with an owner and an expiry for each. If false, read Chapter 4 and Chapter 11. [IG2] [PR.AA] [GV.SC]
• LAND-09A documented incident trigger exists for "a vendor has disclosed a breach," and its first steps are enumerate, revoke and hunt — not wait for the vendor's final report. If false, read Chapter 11 and Chapter 14.5. [IG2] [GV.SC] [CIS 15]
• LAND-10A verification procedure applies to any voice, video or messaging instruction that moves money or grants access, requiring call-back to a directory-sourced number plus a challenge the caller must answer. If false, read Chapter 14.2 and Chapter 14.9. [IG1] [PR.AT] [CIS 14]
• LAND-11An inventory of AI systems, models, agents and their tool permissions exists, and each entry names a human owner. If false, read Chapter 7. [IG2] [ID.AM]
• LAND-12Every incident record captures four distinct timestamps — awareness, reasonable belief an incident occurred, materiality determination, and any ransom disbursement — and the notification owner is a named role separate from the Incident Commander. If false, read Chapter 15. [IG2] [RS.CO]
• LAND-13Every playbook carries an owner, a version, a last_tested date and a status, and any playbook untested for more than 12 months is marked Draft rather than Active. If false, read Chapter 2 and Chapter 18. [IG2] [RS.MA] [CIS 17]
• LAND-14The incident response contact list, escalation ladder and out-of-band communication channel exist in printed form, held by every person with a response role, and were tested within the last 12 months. If false, read Chapter 13. [IG1] [RS.CO] [CIS 17]
• LAND-15Mean time to detect is reported separately for internally-detected and externally-notified incidents, and both figures go to the board. If false, read Chapter 9 and Chapter 16. [IG2] [DE.CM] [ID.IM]

MAP 25 controls · The Coverage Model

• MAP-01A documented coverage model covering the full scope of the security program exists, is dated, and is accessible to the whole security team. [IG1] [GV.OC]
• MAP-02Every domain in the coverage model has exactly one accountable owning role recorded, or is explicitly recorded as unowned. [IG1] [GV.RR]
• MAP-03Owners were assigned before any coverage scoring took place, and the assignment record predates the scoring record. [IG2] [GV.RR]
• MAP-04Every domain is marked in-scope or out-of-scope, each with a one-line written rationale approved by the executive sponsor. [IG1] [GV.OC]
• MAP-05Each in-scope domain carries two independent scores — coverage and confidence — refreshed within the last 12 months. [IG2] [ID.IM]
• MAP-06Every domain scored green for confidence names a specific evidence artefact that a third party could inspect. [IG2] [GV.OV]
• MAP-07Every domain scored green for coverage and red for confidence has a dated remediation action with a named owner. [IG2] [ID.IM]
• MAP-08The scoring session included at least one participant from outside the security function whose stated role was to challenge evidence. [IG2] [GV.OV]
• MAP-09A current one-page list of unowned domains exists and has been presented to the executive sponsor with a dated decision against each line (owner assigned, funded, risk accepted, or descoped). [IG1] [GV.RR]
• MAP-10The Legal and Regulatory domain — notification obligations, attorney-client privilege posture, legal hold, ransom payment authority, regulator engagement — has a named owning role and a named legal counterpart. [IG1] [GV.OC]
• MAP-11Coverage-model status is derived from the control checklist responses in the master checklist, not from independent freehand judgement. [IG2] [GV.OV]
• MAP-12Domain scores are reported as a list of specific findings; no aggregate maturity score or average is reported to leadership. [IG2] [GV.OV]
• MAP-13The coverage model has been checked within the last 12 months against at least one independent external scope model, and any branch with no home in our model was recorded as a finding. [IG2] [ID.IM]
• MAP-14Where a domain is descoped, the descoping decision names the accepting executive role and the date it was accepted. [IG2] [GV.RM]
• MAP-15The coverage model carries an explicit expiration or review date, and a calendar entry exists to refresh it before that date. [IG1] [GV.OV]
• MAP-16At least one domain or category has been removed or merged in the last review cycle, or the review record states explicitly that none warranted removal. [IG3] [ID.IM]
• MAP-17New scope arriving from regulation, acquisition or platform change is mapped to a domain and an owner before implementation work begins. [IG3] [GV.OC]
• MAP-18A complete inventory of security tools exists, recording annual all-in cost, owning role, the unique control or detection each delivers, and the date its output was last acted upon. [IG1] [CIS 2] [ID.AM]
• MAP-19Every security tool with no named owner, or with no acted-upon output in the last 90 days, has a documented retain-or-retire decision. [IG2] [ID.AM]
• MAP-20At least one redundant or under-utilized tool has been retired in the last 12 months, with the released budget explicitly reallocated. [IG2] [GV.RM]
• MAP-21An inventory of AI systems, tools and agents in use exists, recording owner, data touched, autonomous actions permitted, and upstream model or vendor. [IG1] [ID.AM] [GV.SC]
• MAP-22The incident response plan includes staff welfare provisions: named deputies for every authority, a duty rotation schedule, and out-of-hours coverage arrangements. [IG1] [GV.RR] [A.5.24]
• MAP-23On-call hours per person, unplanned out-of-hours work, and vacancy days are reported to executive leadership alongside technical security metrics. [IG2] [GV.OV]
• MAP-24Training budget for the security team is a protected, named line item rather than a residual, and includes AI skills development. [IG2] [PR.AT]
• MAP-25Post-incident reviews are run as blame-aware investigations producing documented insights, and each insight is traced to a playbook or control change. [IG2] [ID.IM] [A.5.27]
• PROV-01A register lists every organization holding administrative access into this estate and every organization this estate administers, with a named owner per row; managed service relationships are tiered on standing administrative control rather than contract value. [IG1] [GV.SC] [ID.AM] [CIS 15] [Both]
• PROV-02A written authority matrix exists for every managed relationship, marking each disruptive action — isolate endpoint, isolate server, isolate domain controller, disable account, tenant-wide credential reset, block egress, suspend a production service, restore over live data, engage forensics — into one of four buckets — done without asking, done only with a named person's yes, done only with an executive's yes, or never done at all — with the approving role written beside every entry, and a paper copy within reach of whoever is on call. [IG1] [GV.RR-02] [A.5.24] [Both]
• PROV-03A primary authority holder and a named deputy are recorded, each reachable out of hours on a personal number and able to approve a production-affecting containment action without further escalation. [IG1] [GV.RR-02] [Customer]
• PROV-04Both parties can point to the same number: how many minutes of documented failed contact attempts must elapse before the provider may act alone, which actions that permission covers, and how soon afterwards the customer must be told. Countersigned, and carried in the tenant record rather than only in the agreement. [IG2] [Both]
• PROV-05The out-of-hours contact path has been dialled end to end within the last 180 days, unannounced, with the date, caller and outcome recorded. [IG1] [Both]
• PROV-06The agreed authority tier is enforced technically as well as contractually: the provider's standing roles, EDR permissions and device scopes do not permit actions the matrix marks approval-required. [IG2] [PR.AA-05] [Both]
• PROV-07Provider accounts are not members of internal administrator groups, are scoped to the systems the provider actually manages, and are reviewed at least quarterly against the services being bought. [IG1] [PR.AA-05] [CIS 6] [Customer]
• PROV-08Provider access is disabled within a defined number of business days of contract termination, service-line reduction, or notification that a named technician has left, and the removal is evidenced. [IG1] [PR.AA-01] [A.5.20] [Customer]
• PROV-09The delegated administrative relationships granted to each provider have been inspected within the last 90 days, with the roles listed and any role granting authentication-method reset or role-assignment management removed absent a documented need. [IG2] [PR.AA-05] [Customer]
• PROV-10The provider has attested in writing, with a date, that none of the consoles through which this estate is administered answers on a public address, and has named the access path — VPN, allow-list or broker — for each product in that list. [IG1] [GV.SC] [Both]
• PROV-11Remote-access, RMM, PSA and backup platforms carry a patch deadline stated in hours and driven by known-exploited status, and a dated follow-up check confirms, no sooner than three days after each fix, that the vendor has not superseded it. [IG1] [Provider]
• PROV-12Every account capable of touching a customer environment or a management platform — vendor support logins inside those products included — authenticates with a phishing-resistant factor, and no exemption group exists. [IG1] [PR.AA-03] [Provider]
• PROV-13Bulk deployment is gated: an account reaching ten or more machines inside a single hour with a command, script or installer triggers both an alert and a fresh authentication challenge before the job runs. [IG2] [DE.CM-09] [Provider]
• PROV-14Administrative credentials, backup repositories and encryption keys are unique per customer, and retention locks sit in the storage platform itself, where nobody holding backup-console administration can lift them. [IG1] [PR.AA-01] [RC.RP-01] [Provider]
• PROV-15A cross-customer hunting query library exists, has been run end to end within the last 90 days against a benign indicator with the elapsed time recorded, and separately identifies tenants that came back clean from tenants the query never reached, naming the obstacle in each case. [IG2] [DE.CM-01] [Provider]
• PROV-16A written self-check procedure determines whether the provider's own platform, technician identities or delegated access are implicated, can be worked from paper by a single technician inside half an hour, and has been exercised at least once in the past year. [IG2] [A.5.24] [Provider]
• PROV-17The provider has stated in writing, with a date, how long it takes to check every customer it serves for a single indicator, and what it would tell this organization if the result were positive elsewhere. [IG2] [GV.SC] [Customer]
• PROV-18The contract specifies a notification period in hours, banded by severity, with a legal notice address and a named operational recipient with an out-of-hours number, in both directions. [IG1] [RS.CO-02] [A.5.20] [Both]
• PROV-19A standing written instruction forbids holding a customer notification back while cause, risk or data impact are still being worked out, and identifies by role who is cleared to send one outside business hours. [IG1] [RS.CO-02] [Both]
• PROV-20The contract obliges the provider to notify the customer of confirmed or suspected security events affecting the provider's own infrastructure, not only events inside the customer's environment. [IG2] [GV.SC] [RS.CO-02] [Both]
• PROV-21The contract grants access, on written request within a stated number of business days, to the provider's records of its own presence and activity in this environment — access logs, delegation history, change records, alerting configuration and its change history, ticket timelines with audit trails — during and after an incident and after termination. [IG2] [A.5.28] [A.8.15] [Customer]
• PROV-22Provider-side audit records — delegated-access activity, remote-session audit, RMM and PSA activity logs, and the object-ID-to-technician mapping with employment dates — are exported at least monthly to a store those platforms cannot alter or delete, are still retrievable six months later, and carry a segment index wherever an export row cap applies. [IG2] [A.8.15] [A.5.28] [Provider]
• PROV-23The contract contains an evidence-preservation obligation on written notice, an express legal-hold carve-out to the data deletion and return clause, and a default prohibition on reimaging a host before it has been imaged, departed from only where an identified role on each side signs off in writing. [IG2] [A.5.28] [Both]
• PROV-24The provider's assurance report is held with its period of coverage, a bridge letter for the gap since, the certificate scope statement and the complementary user entity controls list — and each user entity control has an internal owner and is confirmed as implemented. [IG2] [GV.SC] [Customer]
• PROV-25The full notification and authority chain has been exercised at least annually against a realistic scenario, and two durations were timed and recorded: how long a pretend discovery took to reach this customer as a notice, and how long it took to produce an approved containment decision. Both numbers go to an accountable executive on both sides. [IG3] [A.5.24] [CIS 17] [Both]

RES 24 controls · Resilience, Backup and Recovery

• RES-01Every backup repository is documented with its exact immutability mode (compliance/governance, Locked/Enabled), and no repository holding a last-resort copy is in a mode a sufficiently privileged principal can override. [IG1] [PR.DS] [CIS 11]
• RES-02At least one copy of every T0 and T1 asset exists in a repository where retention cannot be shortened, nor the copy deleted, by any account in the production identity domain. [IG1] [PR.DS] [CIS 11]
• RES-03Backup and recovery systems authenticate using dedicated credentials that do not depend on the production identity provider, and those credentials are stored offline. [IG1] [PR.AA] [CIS 5]
• RES-04The offline backup credentials have been physically retrieved and used in a restore test within the last 12 months, with the retrieval logged. [IG2] [RC.RP]
• RES-05No account is simultaneously a member of a production privileged group and a backup administrator group, verified by an automated check rather than assertion. [IG2] [PR.AA] [CIS 6]
• RES-06Destructive backup operations — shortening retention, disabling immutability, removing a legal hold, deleting a vault — require multi-person approval, enforced by the platform wherever the platform supports it. [IG2] [PR.AA]
• RES-07Backup vaults for cloud workloads reside in a separate account, subscription or project from the production workloads they protect, with a distinct break-glass path. [IG2] [PR.IR]
• RES-08A predefined list of assets essential to health, safety, revenue or operations exists, is owned by a named role, and is reviewed at least annually. [IG1] [ID.AM] [CIS 1]
• RES-09Every T1 service has a documented RTO and RPO derived from a business impact analysis, with its dependency chain down to identity, DNS and the secrets store documented. [IG2] [ID.AM] [A.5.30]
• RES-10Time-to-restore is measured from restore authorization to business-owner verification, recorded per test, and compared against the stated RTO. [IG2] [RC.RP]
• RES-11Restore testing runs on a documented cadence covering all five tiers (file, full system, application-consistent, identity plane, clean-room drill), and an aborted test is recorded as a failure. [IG2] [RC.RP] [CIS 11]
• RES-12An identity-plane restore — one writeable domain controller or the IdP configuration into an isolated network — has been successfully executed within the last 12 months. [IG2] [RC.RP]
• RES-13A documented, step-ordered identity-first recovery procedure exists, covering forest-root-before-child ordering, authoritative SYSVOL restore on the first DC only, Tier-0 credential and gMSA reset before additional DCs are installed, the RID pool raise, and the double krbtgt reset with at least 10 hours between resets. [IG2] [RC.RP]
• RES-14The full-stack recovery order (network and out-of-band comms → identity → DNS/DHCP/PKI/NTP → secrets → core data services → applications → user data → endpoints) is documented and has been walked with the teams who would execute it. [IG2] [RC.RP]
• RES-15A clean-room / isolated recovery environment is defined with separate infrastructure, separate credentials, no routed path to production before validation, and its own independently installed security tooling. [IG3] [RC.RP]
• RES-16Written promotion criteria specify the checks a restored system must pass before it is granted a route to production, name the role authorized to sign off, and require a restore point predating the earliest confirmed adversary activity rather than the encryption event. [IG2] [RC.RP]
• RES-17The identity plane — directory, PKI/AD CS, secrets vault, MFA registration state, policy configuration — is backed up and covered by a tested restore procedure separate from application data. [IG2] [PR.AA] [RC.RP]
• RES-18Endpoint recovery capacity is measured (devices reimaged and re-enrolled per hour, per technician, per site) and that measured rate is reflected in the business impact analysis. [IG2] [RC.RP]
• RES-19Manual fallback procedures exist in printed or offline-accessible form for every T1 business process, each with a named process owner and a documented invocation authority. [IG1] [A.5.29]
• RES-20At least one manual fallback procedure has been executed as a live drill within the last 12 months, with observed throughput recorded. [IG3] [A.5.29]
• RES-21Recovery coordination uses an out-of-band communications channel and a printed contact list that do not depend on the systems being restored. [IG1] [RC.CO]
• RES-22The cyber insurance notification requirement, panel-vendor consent process, business-interruption waiting period, and every control attested to at underwriting are extracted onto a single page held with the IR plan. [IG1] [GV.RM]
• RES-23Every control attested to on the most recent cyber insurance application has been verified as true in its current implemented state, with evidence, and any divergence reported to the broker. [IG2] [GV.OV]
• RES-24The board receives, at least annually, the date of the last tested identity-first restore and its measured time-to-restore against the stated recovery objective. [IG2] [GV.OV] [RC.RP]

ROAD 27 controls · The First 180 Days

• ROAD-01A written 180-day plan exists in which every line has one named individual owner, a due date, and a defined artefact. [IG1] [GV.RR]
• ROAD-02A dated baseline document from the discovery phase exists and records, at minimum: internet-facing assets, asset inventory, identity inventory, privileged-account list, log coverage and retention, backup state, AI inventory, vendor and OAuth-grant list, and incident-readiness status. [IG1] [ID.AM] [CIS 1] [CIS 2]
• ROAD-03No security product was purchased before the discovery-phase baseline was completed, or the exception is documented with its rationale. [IG1] [GV.RM]
• ROAD-04Every asset and identity in the inventory has a named owner, and the count of unowned entries is reported as a tracked metric rather than omitted. [IG1] [ID.AM] [CIS 1]
• ROAD-05Log retention figures are recorded per platform from configuration output rather than assumption, with the date of verification. [IG1] [DE.CM] [CIS 8] [A.8.15]
• ROAD-06Phishing-resistant MFA is enforced on every account holding a privileged role, and push, SMS and voice are removed as registered methods for those accounts. [IG1] [PR.AA] [CIS 6]
• ROAD-07Every internet-facing system either federates to the identity provider or holds a written MFA exception with a named approver and a future expiry date. [IG1] [PR.AA] [CIS 6]
• ROAD-08A KEV-driven remediation SLA is signed by the Executive Sponsor, defines when the clock starts, and has completed at least one full cycle with exceptions recorded and owned. [IG1] [ID.RA] [CIS 7]
• ROAD-09At least one backup copy is configured in its platform's enforcing immutability state, and the configuration output is retained as evidence. [IG1] [PR.DS] [CIS 11]
• ROAD-10A restore of a defined business service has been completed using only out-of-band credentials that do not depend on the production identity provider, with the elapsed time recorded. [IG1] [RC.RP] [CIS 11] [A.5.30]
• ROAD-11An incident response plan exists with incident command roles assigned to named individuals, a severity schema, declaration criteria, an out-of-band communications channel, and a printed contact list distributed to every expected responder. [IG1] [RS.MA] [CIS 17] [A.5.24]
• ROAD-12The ransomware, business email compromise and account takeover playbooks exist in version control with owner and last-tested fields populated. [IG1] [RS.MA] [CIS 17]
• ROAD-13At least one tabletop exercise has been run against a written playbook, with evaluation criteria authored before the exercise. [IG1] [ID.IM-02] [CIS 17] [A.5.24]
• ROAD-14Every exercise and post-incident finding is recorded in an improvement plan with a named owner and a due date, and closure against due date is tracked. [IG1] [ID.IM] [A.5.27]
• ROAD-15The list of pre-authorized containment actions, and the roles permitted to take them without further approval, is documented and approved before any incident. [IG1] [RS.MI] [GV.RR]
• ROAD-16Detection coverage is reported as three separate values per prioritized technique — telemetry available, logic deployed, last successful validation date — and never as a single percentage. [IG2] [DE.CM] [ID.IM]
• ROAD-17A complete security tool inventory exists recording, per tool: named owner, all-in annual cost, unique contribution, date output was last acted upon, and renewal date with notice period. [IG2] [GV.RM] [ID.AM]
• ROAD-18No tool is retired before the evidence and log classes it retains have been exported and the ingest re-pointed. [IG2] [DE.CM] [CIS 8]
• ROAD-19Incident Commander duty rotates on a published schedule, and every decision authority in the plan has a named deputy. [IG1] [GV.RR] [RS.MA]
• ROAD-20Shift handover during an extended incident follows a written script rather than an informal conversation. [IG2] [RS.MA]
• ROAD-21On-call hours per person and unplanned out-of-hours work are measured and reported to the Executive Sponsor alongside technical metrics. [IG2] [GV.OV] [GV.RR]
• ROAD-22Post-incident reviews are conducted blamelessly, with a calibration document circulated before the review meeting. [IG2] [ID.IM-03] [A.5.27]
• ROAD-23A defined set of leading indicators is baselined, reported monthly with unchanged definitions for at least two consecutive quarters, and presented alongside lagging indicators rather than instead of them. [IG2] [GV.OV] [ID.IM]
• ROAD-24The board report includes internal-detection rate, dwell time, containment time for the highest severity class, named coverage gaps with owner and cost, and the date and measured duration of the last tested restore. [IG2] [GV.OV] [RC.RP]
• ROAD-25For organizations without dedicated security staff: a named individual holds accountability for security with recurring protected time on a calendar, and the written control standard is CIS Implementation Group 1 or an equivalent documented baseline. [IG1] [GV.RR] [GV.PO]
• ROAD-26A cryptographic inventory exists recording, per system, algorithm, key size, protocol, whether the algorithm is configurable, and the confidentiality lifetime of the data it protects. [IG2] [ID.AM]
• ROAD-27The standard procurement and vendor-renewal template includes a post-quantum roadmap question, and the answers are recorded in the cryptographic inventory. [IG2] [GV.SC]

SOAR 25 controls · Automation and Orchestration

• SOAR-01Every step in every active playbook is classified AUTO, AUTO+GATE, or HUMAN, and the classification is recorded in the playbook itself. [IG1] [RS.MA] [CIS 17]
• SOAR-02Every playbook step carries an explicit precondition, a machine-checkable done-when condition, and a named evidence artefact. [IG1] [RS.MA] [A.5.26]
• SOAR-03Playbooks are composed from a library of atomic, individually-owned response actions; no command is inlined in more than one playbook. [IG2] [RS.MA]
• SOAR-04Every automated action is documented as idempotent or explicitly marked non-idempotent, with retry behavior defined accordingly. [IG2] [RS.MI]
• SOAR-05Every automated action has a tested rollback procedure that does not depend on the connectivity or credentials the action removes; rollbacks are tested at least annually. [IG2] [RS.MI] [CIS 17]
• SOAR-06A pre-authorized action table and an approval-gated action table exist, each naming the authorizing role, a named deputy, and an out-of-hours reach path. [IG1] [GV.RR] [A.5.24]
• SOAR-07Approval requests render on one screen with proposed action, trigger, blast radius, reversibility, and a stated default on timeout, and are delivered through the paging channel rather than a console behind SSO. [IG2] [RS.MA]
• SOAR-08Every gated action logs the rendered approval payload, the resolved approver identity, the automation's own acting identity, the exact API call and raw response, and an independently verified end state. [IG2] [RS.AN] [A.5.28]
• SOAR-09No automated closure is permitted without an attached evidence artefact justifying the closure. [IG2] [RS.AN]
• SOAR-10Automation autonomy is defined per severity level, decreasing as severity rises, and severity rounds up under classifier uncertainty. [IG2] [RS.MA]
• SOAR-11A critical-asset list exists (domain controllers, DNS, DHCP, PKI, hypervisor hosts, OT assets, break-glass and executive accounts) and is enforced as a hard exclusion from every autonomous containment action. [IG1] [RS.MI] [CIS 1]
• SOAR-12Every automated action enforces a per-run entity cap, a per-window rate limit, and a global daily cap. [IG2] [RS.MI]
• SOAR-13A global automation kill switch exists, is reachable by the on-call responder in under one minute without dependency on the corporate identity provider, and is tested quarterly. [IG2] [RS.MI]
• SOAR-14Workflows include loop-detection guards preventing an automation from re-triggering on telemetry it generated. [IG2] [RS.MI]
• SOAR-15When an investigation into a suspected intrusion is open, related automated containment switches from execute to stage, and staged actions are released by the Incident Commander as a single remediation event. [IG3] [RS.MI] [RS.MA]
• SOAR-16The orchestration platform, case system and evidence store do not authenticate through the identity provider they may be required to contain, and hold out-of-band emergency credentials. [IG2] [PR.AA] [A.5.24]
• SOAR-17Each integration link (ingest, SIEM→SOAR, EDR, IAM, ticketing, comms) has a documented failure mode, a health check that alerts on absence of activity, and a manual fallback procedure held in printed form. [IG2] [DE.CM] [CIS 8]
• SOAR-18Containment is verified by independent observation of end state — no new tokens issued, no new sessions, no new API calls, traffic stopped — never by the write operation's return code. [IG2] [RS.MI] [A.8.16]
• SOAR-19Identity, endpoint and cloud control-plane evidence is exported automatically on incident declaration, within the shortest applicable log-retention window, and before any containment action executes. [IG1] [RS.AN] [A.5.28] [CIS 8]
• SOAR-20An automated, append-only incident timeline is generated in UTC ISO 8601 for every declared incident, and a human Scribe records decisions and rationale alongside it. [IG2] [RS.AN] [A.5.28]
• SOAR-21Any AI agent operating on live alert data holds read-only credentials; all write actions are executed by the orchestrator under a separate scoped identity with its own gates and rate limits. [IG2] [PR.AA] [RS.MI]
• SOAR-22AI agents that read attacker-controllable fields are tested against prompt-injection payloads placed in those fields before production use, and re-tested after any model or prompt change. [IG3] [ID.IM] [DE.AE]
• SOAR-23No automation publishes external communications; automated comms are limited to internal assembly and distribution of status, with a named human sender. [IG1] [RS.CO]
• SOAR-24Autonomous closure rate is reported only alongside a blind weekly human spot-check of a random sample of autonomously closed alerts, and the spot-check was operating before the first autonomous closure rule was enabled. [IG2] [ID.IM]
• SOAR-25Gate response time (median and p95 by hour of day), gate timeout rate, rollback rate by action type, and orchestrator availability are tracked and reviewed at least monthly. [IG3] [ID.IM]

TPRM 25 controls · Third-Party and Supply Chain Risk

• TPRM-01A single vendor register exists, reconciled from accounts-payable data, the IdP application list, OAuth grant exports, egress DNS and the contract repository, with no row lacking a named individual owner. [IG1] [GV.SC] [ID.AM] [CIS 15]
• TPRM-02Every register row records the data classes accessed, the access mechanism(s), and the direction of every credential (issued by us, issued to us, or both). [IG1] [ID.AM] [A.5.19]
• TPRM-03Vendor tier is calculated from data/system access and operational dependency, not contract value, and tier is assigned per integration rather than per company. [IG1] [GV.SC] [ID.RA]
• TPRM-04Any vendor holding a tenant-wide (AllPrincipals) OAuth grant is classified Tier 1 or Tier 2 by policy, irrespective of spend. [IG2] [GV.SC] [PR.AA]
• TPRM-05Tiering is performed at intake, before commercial terms are agreed, and no Tier 1 or Tier 2 vendor is onboarded without security sign-off. [IG2] [GV.SC]
• TPRM-06For every Tier 1 and Tier 2 vendor, the assurance report is recorded with its in-scope TSC categories, in-scope products, report type, period end date and exception count. [IG2] [GV.SC]
• TPRM-07Complementary user entity controls from each Tier 1 assurance report are extracted, assigned an internal owner, and confirmed as implemented on our side. [IG2] [GV.SC]
• TPRM-08Subservice organizations carved out of a Tier 1 vendor's assurance report are recorded as fourth parties in the register. [IG3] [GV.SC]
• TPRM-09Any ISO/IEC 27001 certificate accepted as evidence is against the 2022 edition, and the scope statement and Statement of Applicability are held on file, not just the certificate. [IG2] [GV.SC]
• TPRM-10A standard security addendum is mandatory for Tier 1 and Tier 2, is incorporated into the agreement, and prevails over the vendor's standard terms under the order-of-precedence clause. [IG2] [GV.SC] [A.5.20]
• TPRM-11Contractual breach-notification windows for Tier 1 and Tier 2 vendors are measured from the vendor becoming aware, are stated in hours, and are shorter than our shortest applicable regulatory clock. [IG2] [GV.SC] [RS.CO]
• TPRM-12Contracts require a maintained sub-processor list, advance notice of changes, a right to object, and flowdown of equivalent security terms to subcontractors. [IG2] [GV.SC] [A.5.21]
• TPRM-13Every register row carries a renewal-review date with a named owner, and terms are re-verified at renewal rather than assumed to persist. [IG1] [GV.SC]
• TPRM-14A register of SaaS-to-SaaS and OAuth integrations exists recording publisher, application ID, consent type, exact scopes, approver, owner and expiry date. [IG2] [ID.AM] [PR.AA]
• TPRM-15Integration grants are re-attested at a fixed cadence (quarterly for Tier 1 and Tier 2), with non-response resulting in revocation rather than a reminder. [IG2] [PR.AA] [GV.SC]
• TPRM-16Vendor offboarding follows a documented order — revoke the OAuth grant, then remove IdP assignment and SCIM, then disable accounts, then close network paths, then request certified data deletion — and the order is tested. [IG2] [PR.AA]
• TPRM-17Free-text stores that vendors can read (support cases, ticket comments, CRM notes, chat exports) are secret-scanned on a schedule, with a triaged rotation queue. [IG2] [PR.DS] [DE.CM]
• TPRM-18Every third-party dependency and CI Action is pinned to an immutable identifier — commit SHA, image digest, or committed lockfile — with no floating tags in build configuration. [IG2] [PR.PS] [CIS 2]
• TPRM-19An adoption cooldown of at least three days is configured for automated dependency updates in every repository. [IG2] [PR.PS]
• TPRM-20No long-lived registry or cloud publishing credential exists in any CI repository or runner; publishing uses short-lived OIDC-federated credentials, and publish jobs run isolated with human approval. [IG3] [PR.AA] [PR.PS]
• TPRM-21SBOMs from Tier 1 and Tier 2 software vendors are requested in SPDX or CycloneDX, conform to the 2026 CISA minimum elements, and are ingested somewhere that answers "which vendors ship component X" in under an hour. [IG3] [ID.AM] [GV.SC]
• TPRM-22Procurement for Tier 1 software requires the vendor to state its SSDF (SP 800-218) practices and its SLSA build level, and the answers are recorded against the vendor record. [IG3] [GV.SC]
• TPRM-23A function-to-vendor concentration map exists, single points of dependency are identified, and each has a written five-day degraded-mode procedure tested at least annually. [IG2] [GV.SC] [RC.RP]
• TPRM-24A third-party evidence-demand template is pre-drafted and stored with the vendor register, and named security contacts for Tier 1 vendors are verified by direct contact at least twice a year. [IG1] [RS.CO] [GV.SC]
• TPRM-25At least one incident exercise per year includes Tier 1 suppliers or walks the vendor notification path end to end, with findings fed into program improvement. [IG3] [GV.SC-08] [ID.IM-02]

VULN 25 controls · Vulnerability and Exposure Management

• VULN-01A documented vulnerability response process exists covering Preparation, Identification, Evaluation, Remediation, and Reporting, approved by both security and IT operations leadership. [IG1] [ID.RA] [CIS 7]
• VULN-02The CISA KEV catalog is ingested automatically and creates tickets within one business day of publication, with no manual transcription step. [IG1] [ID.RA] [CIS 7]
• VULN-03An asset inventory covering on-premises, cloud, contractor and service-provider systems is reconciled against at least three independent sources monthly, and coverage percentage is reported alongside every remediation metric. [IG1] [ID.AM] [CIS 1] [CIS 2]
• VULN-04A maintained register of all internet-exposed IP ranges, domains, appliances and SaaS tenants exists with a named owner, reviewed at least quarterly. [IG1] [ID.AM] [CIS 12]
• VULN-05Every vulnerability ticket records a per-asset state from the set Not Affected / Susceptible / Compromised / Remediated / Mitigated, not a per-CVE count only. [IG2] [ID.RA]
• VULN-06A written SLA matrix assigns remediation deadlines from exposure, exploitation status, automatability and technical impact, and IT operations has formally signed up to it. [IG1] [GV.PO] [CIS 7]
• VULN-07SLA clocks start at advisory or KEV publication time, not at internal ticket creation, and feed-ingestion latency is inside the measured SLA. [IG2] [ID.RA]
• VULN-08Applicability is confirmed before an SLA clock is assigned, and the query or method used to determine applicability is recorded on the ticket. [IG2] [ID.RA]
• VULN-09Every KEV-applicable internet-facing asset receives a documented compromise assessment (IOC sweep plus review of authentication and administrative logs for the exposure window), not only a patch. [IG2] [DE.CM] [RS.MI]
• VULN-10Confirmed exploitation in the environment automatically escalates from the vulnerability process into incident response, with the vulnerability ticket cross-linked to the incident case. [IG1] [RS.MA]
• VULN-11Internet-facing edge appliances (VPN, firewall, load balancer, file transfer, management gateway) are a distinct, shortest-deadline SLA tier in written policy. [IG1] [PR.IR] [CIS 12]
• VULN-12For any KEV-listed edge appliance, the standing procedure requires patching and credential/certificate/key rotation and vendor-documented firmware integrity verification. [IG2] [PR.IR] [RS.MI]
• VULN-13Every internet-facing appliance has a recorded vendor end-of-support date and a budgeted decommissioning or replacement date preceding it. [IG1] [ID.AM] [CIS 12]
• VULN-14Authenticated or agent-based scanning covers all servers and endpoints, and authentication success rate is measured and reported at 90% or above of in-scope assets. [IG2] [DE.CM] [CIS 7]
• VULN-15External unauthenticated scanning of all declared external ranges runs at least weekly and on demand for any relevant advisory. [IG1] [DE.CM] [CIS 7]
• VULN-16Container images are scanned at build and re-scanned in the registry at least daily, and running workloads are scanned independently of the registry. [IG2] [PR.PS] [CIS 7]
• VULN-17Penetration test and red team findings enter the same queue, with the same tiers, deadlines and exception process as scanner findings — no separate tracker. [IG2] [ID.RA] [CIS 18]
• VULN-18Compensating controls are selected from a closed, approved catalog, and applying one sets the asset state to Mitigated with the ticket remaining open. [IG2] [RS.MI] [PR.PS]
• VULN-19Every exception carries a specific CVE, enumerated asset IDs, an expiry date, a named individual owner, and a documented compensating control — no exception is open-ended. [IG1] [GV.PO] [ID.RA]
• VULN-20Exceptions for internet-facing assets expire within 90 days, and expiry reopens the ticket at its original SLA tier rather than auto-renewing. [IG2] [GV.PO]
• VULN-21Exception renewals require Executive Sponsor approval in writing, and the count of multiply-renewed exceptions is reported to leadership quarterly. [IG2] [GV.OV]
• VULN-22No remediation ticket can be closed without an attached verification artefact — an authenticated post-remediation scan result or the advisory-specified verification check. [IG2] [PR.PS] [CIS 7]
• VULN-23Verification is performed by someone other than the person who applied the fix, and at least 10% of closed tickets are independently re-verified by sampling each month. [IG3] [PR.PS]
• VULN-24Median time from advisory publication to verified remediation is measured per SLA tier and reported monthly, alongside KEV SLA attainment and asset inventory coverage. [IG2] [ID.IM] [GV.OV]
• VULN-25EPSS and CVSS are used as sequential gates with documented thresholds, never combined into a single multiplied risk score. [IG3] [ID.RA]

ZT 23 controls · Zero Trust Architecture

• ZT-01A dated Zero Trust target-state document exists, scored against all five CISA ZTMM pillars and all three cross-cutting capabilities, with a current stage, a target stage, a named owner and a target date per pillar. [IG1] [GV.RM] [GV.RR]
• ZT-02A current architecture document names every Policy Decision Point and Policy Enforcement Point in the environment, and explicitly lists resources protected by neither. [IG1] [ID.AM] [CIS 12]
• ZT-03A single list enumerates every internet-reachable remote-access path (VPN, RDP gateway, Citrix, jump host, vendor portal, ZTNA broker) with owner, authentication method and last-patched date, and no entry lists "none" for MFA. [IG1] [PR.AA] [CIS 12]
• ZT-04No remote-access account or profile exists that is not bound to an active directory identity; dormant profiles are disabled within 30 days of last use. [IG1] [PR.AA] [CIS 5]
• ZT-05A crown-jewel register exists listing system, business owner, data classification and dependencies, reviewed at least annually with owner sign-off. [IG1] [ID.AM] [CIS 1]
• ZT-06Break-glass/emergency-access accounts are excluded from every access policy including vendor-managed ones, are alerted on every use, and are tested at least quarterly. [IG1] [PR.AA]
• ZT-07Every new or changed access policy is deployed in report-only (or equivalent audit) mode for a defined period before enforcement, and the report-only evidence is retained with the change record. [IG1] [PR.AA] [A.8.9]
• ZT-08Host-based firewalls are enabled and default-deny inbound on all managed workstations, with a documented, owned and reviewed exception list. [IG1] [PR.IR] [CIS 4]
• ZT-09Every access-policy exclusion group has a named owner and an expiry date, and its membership count is reported at least quarterly. [IG1] [PR.AA] [GV.OV]
• ZT-10Device compliance is an enforced condition of access to at least the top five crown-jewel applications. [IG2] [PR.AA] [CIS 6]
• ZT-11East-west flow logging is enabled for every crown-jewel segment and retained for at least 90 days. [IG2] [DE.CM] [CIS 8] [CIS 13] [A.8.15]
• ZT-12At least one crown-jewel segment is in deny-by-default enforcement — not log-only — with a documented allow-list and a recorded enforcement date, and the next segment has an enforcement date already booked. [IG2] [PR.IR] [CIS 12]
• ZT-13Enforcement of every segmentation policy has been empirically verified by attempting a connection that should be denied, with the test output retained. [IG2] [PR.IR] [CIS 13]
• ZT-14Third-party and vendor access is brokered per application rather than granted at network level, is time-bounded, and is reviewed at least quarterly. [IG2] [PR.AA] [GV.SC] [CIS 15]
• ZT-15The incident response plan contains a containment lever table naming each available lever, its authority, and its measured time-to-effect, including token-lifetime and policy-propagation limits. [IG2] [RS.MI] [CIS 17]
• ZT-16Identity containment is executed as a single atomic action — session revocation plus credential reset — with the block policy applied afterwards, and this order is written into the runbook with the reason. [IG2] [RS.MI] [PR.AA]
• ZT-17A cloud quarantine mechanism that cannot be removed from within the affected account (for example an SCP applied from the management account) is pre-written and has been tested in a non-production account. [IG2] [RS.MI]
• ZT-18Endpoint isolation has been exercised on a live host within the last quarter, and the documented constraints — auto-lift window, offline retry window, VPN and proxy caveats, per-batch device limits — are recorded in the runbook. [IG2] [RS.MI] [CIS 17]
• ZT-19In every Kubernetes cluster, NetworkPolicy enforcement has been verified against a policy-enforcing CNI rather than assumed from the presence of the policy object. [IG2] [PR.IR]
• ZT-20Backup infrastructure, identity/Tier-0 systems and the virtualization management plane are each in their own enforced segment with distinct, non-shared administrative credentials. [IG3] [PR.IR] [CIS 11] [CIS 12]
• ZT-21Identity risk signals and device posture are consumed by the policy engine automatically, and an elevation in risk terminates or forces reauthentication of existing sessions without manual intervention. [IG3] [PR.AA] [DE.CM]
• ZT-22Blast radius for each crown jewel — the count of identities and network sources able to reach it — is measured, trended, and reported to executive leadership at least twice a year. [IG3] [ID.RA] [GV.OV]
• ZT-23A segmentation or containment exercise is run at least annually that measures actual achieved blast radius and actual time-to-useless, with findings tracked to closure. [IG3] [ID.IM] [CIS 18]