CIS Controls Crosswalk
Purpose: Let a team that uses the CIS Critical Security Controls as its security baseline find the wiki control objectives and test cases that apply each control to AI systems.
Audience: Security engineering, IT operations, GRC teams, auditors.
Using the two together: Use the CIS Controls for the prioritised safeguards that every system needs. Use this wiki for the control objectives and tests that AI systems need on top of them.
About the controls and this page
The CIS Critical Security Controls are published by the Center for Internet Security. Version 8 was released in May 2021 and has 18 controls, each divided into safeguards that are sorted into three implementation groups. Version 8.1, released in June 2024, keeps the same 18 controls.
The wiki maps at control level, for example CIS 3 for Data Protection. Safeguards and implementation groups are not mapped.
The tables are generated each time the site is built. They are read from the CIS Controls field of each control in the AI Security Control Objectives Library. To change a mapping, edit the control; this page follows on the next build.
Verify before use. Control numbers and titles were written from memory of version 8 and were not checked against the published document for this page. The mapping is this wiki's own judgment and has not been reviewed by the Center for Internet Security. A wiki control citing a CIS Control means it supports that control for AI systems, not that it satisfies it.
How to read the tables
- Wiki controls are the control objectives whose record cites the CIS Control.
- Test cases under those controls counts the distinct test cases that test at least one of those controls.
- A CIS Control with no name and "None" in the next column is not cited by any wiki control.
CIS Controls to wiki controls
18 of the 18 CIS Controls are cited by at least one wiki control.
CIS Controls
| Control | Name | Wiki controls | Test cases under those controls |
|---|---|---|---|
| CIS 1 | Inventory and Control of Enterprise Assets | AI-CTRL-001; AI-CTRL-011 | 49 |
| CIS 2 | Inventory and Control of Software Assets | AI-CTRL-001; AI-CTRL-011; AI-CTRL-024; AI-CTRL-031 | 87 |
| CIS 3 | Data Protection | AI-CTRL-002; AI-CTRL-003; AI-CTRL-004; AI-CTRL-007; AI-CTRL-010; AI-CTRL-013; AI-CTRL-017; AI-CTRL-018; AI-CTRL-021; AI-CTRL-026; AI-CTRL-028; AI-CTRL-029 | 217 |
| CIS 4 | Secure Configuration of Enterprise Assets and Software | AI-CTRL-027; AI-CTRL-030; AI-CTRL-032 | 55 |
| CIS 5 | Account Management | AI-CTRL-015; AI-CTRL-016 | 93 |
| CIS 6 | Access Control Management | AI-CTRL-006; AI-CTRL-015; AI-CTRL-016; AI-CTRL-018; AI-CTRL-022; AI-CTRL-025; AI-CTRL-028 | 157 |
| CIS 7 | Continuous Vulnerability Management | AI-CTRL-031; AI-CTRL-032; AI-CTRL-034 | 88 |
| CIS 8 | Audit Log Management | AI-CTRL-006; AI-CTRL-008; AI-CTRL-009 | 56 |
| CIS 9 | Email and Web Browser Protections | AI-CTRL-001; AI-CTRL-003; AI-CTRL-010 | 65 |
| CIS 10 | Malware Defenses | AI-CTRL-021 | 28 |
| CIS 11 | Data Recovery | AI-CTRL-040 | 14 |
| CIS 12 | Network Infrastructure Management | AI-CTRL-027; AI-CTRL-032 | 39 |
| CIS 13 | Network Monitoring and Defense | AI-CTRL-005; AI-CTRL-009; AI-CTRL-032 | 100 |
| CIS 14 | Security Awareness and Skills Training | AI-CTRL-044 | 3 |
| CIS 15 | Service Provider Management | AI-CTRL-007; AI-CTRL-014; AI-CTRL-024; AI-CTRL-031 | 77 |
| CIS 16 | Application Software Security | AI-CTRL-004; AI-CTRL-005; AI-CTRL-020; AI-CTRL-024; AI-CTRL-027; AI-CTRL-030; AI-CTRL-031; AI-CTRL-033 | 154 |
| CIS 17 | Incident Response Management | AI-CTRL-025; AI-CTRL-035; AI-CTRL-043 | 53 |
| CIS 18 | Penetration Testing | AI-CTRL-034 | 38 |
CIS Controls that no wiki control cites
None.
Where the wiki stops
The CIS Controls are technical safeguards and say little about governance. Eleven wiki controls therefore cite none of them, among them AI policy, risk assessment, impact assessment, human oversight, fairness testing and output reliability. The summary table shows "None" in the CIS column for each. A team whose only baseline is the CIS Controls should take those governance controls from this wiki, ISO/IEC 42001 or the NIST AI RMF.
Attribution
The CIS Critical Security Controls are published by the Center for Internet Security under a Creative Commons licence. This page cites control numbers and titles only and does not reproduce the safeguards.