https://www.cisecurity.org/controls/
Inventory of Authorized and Unauthorized Devices
Inventory of Authorized and Unauthorized Software
Secure Configurations for Hardware and Software
Continuous Vulnerability Assessment and Remediation
Controlled Use of Administrative Privileges
Maintenance, Monitoring, and Analysis of Audit Logs
Email and Web Browser Protections
Malware Defenses
Limitation and Control of Network Ports
Data Recovery Capability
Secure Configurations for Network Devices
Boundary Defense
Data Protection
Controlled Access Based on the Need to Know
Wireless Access Control
Account Monitoring and Control
Security Skills Assessment and Appropriate Training to Fill Gaps
Application Software Security
Incident Response and Management
Penetration Tests and Red Team Exercises
