What CIS Controls 5 and 6 (v8.1) ask of your accounts

The CIS Controls are a prioritized list of security safeguards published by the Center for Internet Security (CIS), a US nonprofit. Version 8.1 has 18 Controls and 153 safeguards. Two of the Controls deal with accounts: Control 5, Account Management, and Control 6, Access Control Management. Between them they hold 14 safeguards, and most of them belong to the first implementation group, the starting point CIS recommends for everyone.

What the CIS Controls are

CIS’s FAQ describes the Controls as a short list of defensive actions, chosen because they work well against the most common attacks. It also says anyone may use them free of charge to improve their own security. The same FAQ says they don’t replace any regulatory, compliance or authorization scheme. They do map to other frameworks, among them the NIST Cybersecurity Framework, NIST SP 800-53, the ISO 27000 series and PCI DSS.

Version 8.1 is an update to version 8. It adds the “Govern” security function from NIST’s Cybersecurity Framework 2.0 and updates the mappings to that framework. It also clarifies some safeguard descriptions and expands the glossary.

Implementation groups decide how far you go

CIS sorts the safeguards into three implementation groups (IGs), based on an organization’s risk and the resources it has. CIS says “Every enterprise should start with IG1” and calls IG1 “essential cyber hygiene.” IG1 has 56 safeguards. The typical IG1 organization, in CIS’s description, is a small or mid-sized company without much in-house IT or security staff. IG2 adds safeguards to IG1, and IG3 contains all of them.

Here are the 14 safeguards in Controls 5 and 6, with the group each one first appears in.

What Control 5 asks

Control 5 is about using processes and tools to manage who is authorized to use each account. That covers user accounts, admin accounts and service accounts, which are accounts that programs use.

Safeguard 5.1’s inventory must include user, admin and service accounts. CIS says each entry should have, at a minimum, the person’s name, the username, start and stop dates, and the department. You then check that every active account is authorized, at least every quarter.

Safeguard 5.2 asks for a unique password on every account. As best practice, it names at least 8 characters for accounts with multi-factor authentication (MFA) and at least 14 for accounts without it. Under 5.3, you delete or disable any account that has gone 45 days without use, where the system supports it. Safeguard 5.4 keeps admin rights on separate admin accounts. Everyday work such as web browsing and email happens from the person’s regular account, which has no admin rights.

IG2 adds two more. Safeguard 5.5 is an inventory of service accounts, listing at least the owning department, the review date and the purpose, reviewed at least quarterly. Safeguard 5.6 puts account management in one directory or identity service, such as Okta or Microsoft Entra ID.

What Control 6 asks

Control 6 is about the whole life of access: creating it, granting it, managing it and taking it away. It covers user, admin and service accounts.

Safeguards 6.1 and 6.2 are the processes for joining and leaving. Safeguard 6.1 asks for a written process for granting access when someone joins or changes roles, automated if possible. Safeguard 6.2 asks for the same kind of process for taking access away. Under 6.2, that means disabling the account right away when a person leaves, loses rights or changes roles. CIS adds that disabling instead of deleting may be needed to keep audit trails.

Safeguards 6.3 to 6.5 are about MFA, which means checking a second factor besides the password. Safeguard 6.3 requires MFA on all internet-facing applications, your own or a third party’s, where supported. CIS says enforcing it through a directory service or single sign-on (SSO) provider counts. Safeguard 6.4 covers remote access to your network. Safeguard 6.5 requires MFA on all admin accounts, where supported, whether you run the system or a service provider does.

IG2 adds 6.6, an inventory of your sign-in and permission systems reviewed at least once a year, and 6.7, running access control through a directory or SSO provider. In IG3, 6.8 asks you to write down the access each role needs. You then check at least once a year that every permission is authorized.

Applying it to the cloud apps your team uses

The cloud apps your team works in are third-party applications reachable from the internet. So 6.3 reads as covering them, and their accounts belong in the 5.1 inventory.

But 6.3, 6.5 and 6.7 all say “where supported.” An app that can’t connect to your directory falls outside 6.7. An app with no MFA option falls outside 6.3 and 6.5. For those apps, the 5.1 inventory and the 6.1 and 6.2 processes are what’s left to keep track of who can get in.

Where a shared login doesn’t fit

No safeguard in Controls 5 or 6 mentions shared accounts by name. Still, several assume one person per account, and a shared login breaks them.

• Safeguard 5.1 asks for the person’s name on each account. A shared login has several people behind one row, so the quarterly check has to find out separately who is using it.
• A shared login used by anyone in the last 45 days never counts as dormant under 5.3. A person who left and still knows the password won’t show up in that check.
• Safeguard 6.2 revokes access by disabling the account. Disabling a shared login locks out everyone who stays, so in practice you change the password and send it to the rest. The audit trail that 6.2 preserves is also per account, so it can’t show which person acted.
• If a shared admin login sends its MFA code under 6.5 to one person’s phone, admin work stops on days that person is away.

Where an app lets you create one account per person, splitting the login fits the safeguards best. Where it doesn’t, list who may use each shared login and decide how you’ll record who used it and when. Then you can still answer the quarterly check. For the cases that can’t be split, see When shared accounts can’t be split into personal ones.