npm - bmad-plus - Versions diffs - 0.7.5 → 0.9.0 - Mend

bmad-plus 0.7.5 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (281) hide show

package/src/bmad-plus/packs/pack-shield/references/cis-controls/framework-mappings.md CHANGED Viewed

@@ -1,162 +1,162 @@
-# CIS Controls v8 — Framework Mapping Reference
-## CIS Controls v8 ↔ NIST CSF 2.0 (Detailed)
-| CIS Control | Safeguard | NIST CSF 2.0 Function | NIST CSF Category | NIST CSF Subcategory |
-|------------|-----------|----------------------|-------------------|----------------------|
-| 1.1 | Enterprise Asset Inventory | Identify | Asset Management (ID.AM) | ID.AM-01, ID.AM-02 |
-| 1.2 | Address Unauthorized Assets | Respond | Incident Management (RS.MA) | RS.MA-01 |
-| 2.1 | Software Inventory | Identify | Asset Management (ID.AM) | ID.AM-02, ID.AM-08 |
-| 2.2 | Supported Software | Govern | Policy (GV.PO) | GV.PO-01 |
-| 3.1 | Data Management Process | Govern | Policy (GV.PO) | GV.PO-01, GV.PO-02 |
-| 3.3 | Data Access Control Lists | Protect | Data Security (PR.DS) | PR.DS-01, PR.DS-05 |
-| 3.6 | Encrypt End-User Devices | Protect | Data Security (PR.DS) | PR.DS-01 |
-| 3.10 | Encrypt Data in Transit | Protect | Data Security (PR.DS) | PR.DS-02 |
-| 3.11 | Encrypt Data at Rest | Protect | Data Security (PR.DS) | PR.DS-01 |
-| 3.13 | Data Loss Prevention | Protect | Data Security (PR.DS) | PR.DS-05 |
-| 4.1 | Secure Configuration Process | Protect | Configuration Management (PR.IP) | PR.IP-01, PR.IP-03 |
-| 4.4 | Firewall on Servers | Protect | Network Security (PR.IR) | PR.IR-01 |
-| 5.4 | Separate Admin Accounts | Protect | Identity Management (PR.AA) | PR.AA-05 |
-| 6.3 | MFA External Applications | Protect | Identity Management (PR.AA) | PR.AA-03 |
-| 6.4 | MFA Remote Access | Protect | Identity Management (PR.AA) | PR.AA-03 |
-| 6.5 | MFA Admin Access | Protect | Identity Management (PR.AA) | PR.AA-05 |
-| 7.3 | OS Patch Management | Protect | Configuration Management (PR.IP) | PR.IP-12 |
-| 7.5 | Internal Vulnerability Scans | Identify | Risk Assessment (ID.RA) | ID.RA-01 |
-| 7.7 | Remediate Vulnerabilities | Protect | Configuration Management (PR.IP) | PR.IP-12 |
-| 8.2 | Collect Audit Logs | Detect | Adverse Event Analysis (DE.AE) | DE.AE-02, DE.AE-03 |
-| 8.9 | Centralize Audit Logs | Detect | Adverse Event Analysis (DE.AE) | DE.AE-03 |
-| 8.11 | Log Reviews | Detect | Continuous Monitoring (DE.CM) | DE.CM-09 |
-| 9.3 | Email Anti-Spoofing | Protect | Platform Security (PR.PS) | PR.PS-05 |
-| 9.5 | DMARC | Protect | Platform Security (PR.PS) | PR.PS-05 |
-| 10.1 | Anti-Malware | Protect | Platform Security (PR.PS) | PR.PS-05 |
-| 10.7 | Behavior-Based AV | Detect | Continuous Monitoring (DE.CM) | DE.CM-09 |
-| 11.2 | Automated Backups | Recover | Incident Recovery Plan (RC.RP) | RC.RP-05 |
-| 11.4 | Isolated Backup Copy | Recover | Incident Recovery Plan (RC.RP) | RC.RP-05 |
-| 12.2 | Secure Network Architecture | Protect | Network Security (PR.IR) | PR.IR-01, PR.IR-02 |
-| 13.1 | Security Event Alerting | Detect | Adverse Event Analysis (DE.AE) | DE.AE-06 |
-| 13.3 | Network Intrusion Detection | Detect | Continuous Monitoring (DE.CM) | DE.CM-01, DE.CM-06 |
-| 14.1 | Security Awareness Program | Protect | Awareness and Training (PR.AT) | PR.AT-01, PR.AT-02 |
-| 15.4 | Vendor Security Requirements | Identify | Supply Chain Risk (ID.SC) | ID.SC-02, ID.SC-04 |
-| 16.1 | Secure Dev Process | Protect | Application Security (PR.PS) | PR.PS-04 |
-| 17.4 | Incident Response Process | Respond | Incident Management (RS.MA) | RS.MA-01, RS.MA-02 |
-| 17.7 | IR Exercises | Respond | Incident Management (RS.MA) | RS.MA-05 |
-| 18.2 | External Pen Test | Identify | Risk Assessment (ID.RA) | ID.RA-05, ID.RA-06 |
----
-## CIS Controls v8 ↔ ISO 27001:2022 Annex A (Detailed)
-| CIS Control | CIS Safeguards | ISO 27001:2022 Controls |
-|------------|----------------|-------------------------|
-| **1 (Asset Inventory)** | 1.1, 1.2, 1.3 | 5.9 (Inventory of information and other associated assets), 8.8 (Management of technical vulnerabilities) |
-| **2 (Software Inventory)** | 2.1, 2.2, 2.3 | 5.9 (Inventory), 8.8 (Technical vulnerabilities) |
-| **3 (Data Protection)** | 3.1–3.14 | 5.12 (Classification), 5.13 (Labelling), 5.33 (Protection of records), 8.10 (Info deletion), 8.11 (Data masking), 8.24 (Use of cryptography) |
-| **4 (Secure Config)** | 4.1–4.12 | 8.8 (Vulnerability management), 8.9 (Configuration management), 8.22 (Network segregation) |
-| **5 (Account Management)** | 5.1–5.6 | 5.15 (Access control), 5.16 (Identity management), 5.18 (Access rights) |
-| **6 (Access Control)** | 6.1–6.8 | 5.15 (Access control), 5.17 (Authentication info), 6.7 (Remote working), 8.2 (Privileged access rights), 8.3 (Info access restriction), 8.5 (Secure authentication) |
-| **7 (Vulnerability Mgmt)** | 7.1–7.7 | 8.8 (Management of technical vulnerabilities) |
-| **8 (Audit Logs)** | 8.1–8.12 | 8.15 (Logging), 8.16 (Monitoring activities), 8.17 (Clock synchronization) |
-| **9 (Email/Web)** | 9.1–9.7 | 8.22 (Network segregation), 8.23 (Web filtering) |
-| **10 (Malware)** | 10.1–10.7 | 8.7 (Protection against malware) |
-| **11 (Data Recovery)** | 11.1–11.5 | 8.13 (Information backup), 8.14 (Redundancy) |
-| **12 (Network Infra)** | 12.1–12.8 | 8.20 (Networks security), 8.21 (Security of network services), 8.22 (Network segregation) |
-| **13 (Network Monitoring)** | 13.1–13.11 | 8.15 (Logging), 8.16 (Monitoring), 8.20 (Network security) |
-| **14 (Security Training)** | 14.1–14.9 | 6.3 (Information security awareness/education/training), 6.8 (Information security event reporting) |
-| **15 (Service Providers)** | 15.1–15.7 | 5.19 (Information security in supplier relationships), 5.20 (Addressing security in agreements), 5.21 (Managing security in ICT supply chain) |
-| **16 (App Security)** | 16.1–16.14 | 8.25 (Secure development lifecycle), 8.26 (Application security requirements), 8.27 (Secure system architecture and engineering), 8.28 (Secure coding), 8.29 (Security testing in development/acceptance) |
-| **17 (IR Management)** | 17.1–17.9 | 5.24 (IR planning and preparation), 5.25 (Assessment/decision on events), 5.26 (Response to incidents) |
-| **18 (Pen Testing)** | 18.1–18.5 | 8.8 (Technical vulnerability management), 5.36 (Compliance with policies/standards) |
----
-## CIS Controls v8 ↔ CMMC 2.0 (NIST SP 800-171)
-| CIS Control | CMMC Domain | NIST 800-171 Requirements |
-|------------|-------------|--------------------------|
-| 1 (Asset Inventory) | Asset Management / System Inventory | Not explicitly in 800-171 but implied by CM.3.068 |
-| 2 (Software Inventory) | Configuration Management (CM) | 3.4.1 (Baseline configurations), 3.4.2 (Configuration settings) |
-| 3 (Data Protection) | Media Protection (MP) | 3.8.1–3.8.9 |
-| 4 (Secure Config) | Configuration Management (CM) | 3.4.1, 3.4.2, 3.4.6, 3.4.7 |
-| 5 (Account Management) | Identification & Authentication (IA) | 3.5.1, 3.5.2, 3.5.3 |
-| 6 (Access Control) | Access Control (AC) | 3.1.1–3.1.22 |
-| 7 (Vulnerability Mgmt) | Risk Assessment (RA) | 3.11.1, 3.11.2, 3.11.3 |
-| 8 (Audit Logs) | Audit & Accountability (AU) | 3.3.1–3.3.9 |
-| 9 (Email/Web) | System & Communications Protection (SC) | 3.13.6, 3.13.7 |
-| 10 (Malware Defenses) | System & Information Integrity (SI) | 3.14.2, 3.14.4, 3.14.5 |
-| 11 (Data Recovery) | Recovery not explicitly in 800-171 | 3.8.9 (Backup CUI on mobile devices) |
-| 12 (Network Infra) | System & Communications Protection (SC) | 3.13.1, 3.13.2, 3.13.5 |
-| 13 (Network Monitoring) | System & Information Integrity (SI) | 3.14.6, 3.14.7 |
-| 14 (Security Training) | Awareness & Training (AT) | 3.2.1, 3.2.2, 3.2.3 |
-| 15 (Service Providers) | Supply Chain Risk not explicitly in 800-171 | Implied by CM and SI |
-| 16 (App Security) | System & Communications Protection (SC) | 3.13.10, 3.13.16 |
-| 17 (Incident Response) | Incident Response (IR) | 3.6.1, 3.6.2, 3.6.3 |
-| 18 (Pen Testing) | Not explicitly in CMMC L2, required at L3 | NIST SP 800-172: 2.11.3 |
----
-## CIS Controls v8 ↔ SOC 2 Trust Services Criteria
-| CIS Control | SOC 2 Criterion | TSC Category |
-|------------|----------------|-------------|
-| 1 (Asset Inventory) | CC6.1 | Common Criteria |
-| 2 (Software Inventory) | CC6.1, CC6.2 | Common Criteria |
-| 3 (Data Protection) | CC6.1, CC6.5, C1.1, C1.2 | Common Criteria / Confidentiality |
-| 4 (Secure Config) | CC6.1, CC7.1 | Common Criteria |
-| 5 (Account Management) | CC6.2, CC6.3 | Common Criteria |
-| 6 (Access Control) | CC6.1, CC6.2, CC6.3 | Common Criteria |
-| 7 (Vulnerability Mgmt) | CC7.1 | Common Criteria |
-| 8 (Audit Logs) | CC4.1, CC7.2, CC7.3 | Common Criteria |
-| 9 (Email/Web) | CC6.1, CC6.6 | Common Criteria |
-| 10 (Malware) | CC6.1, CC6.8 | Common Criteria |
-| 11 (Data Recovery) | A1.2, A1.3 | Availability |
-| 12 (Network Infra) | CC6.1, CC6.6 | Common Criteria |
-| 13 (Network Monitoring) | CC7.2, CC7.3 | Common Criteria |
-| 14 (Security Training) | CC1.4, CC2.2 | Common Criteria |
-| 15 (Service Providers) | CC9.2 | Common Criteria |
-| 16 (App Security) | CC8.1 | Common Criteria |
-| 17 (Incident Response) | CC7.3, CC7.4, CC7.5 | Common Criteria |
-| 18 (Pen Testing) | CC4.1, CC4.2 | Common Criteria |
----
-## CIS Controls v8 ↔ PCI DSS v4.0
-| PCI DSS Requirement | CIS Controls |
-|--------------------|-------------|
-| Req 1: Install network controls | 12, 13 |
-| Req 2: Secure system/network components | 4 |
-| Req 3: Protect stored cardholder data | 3 |
-| Req 4: Protect cardholder data in transit | 3.10 |
-| Req 5: Protect against malicious software | 10 |
-| Req 6: Develop/maintain secure systems | 16 |
-| Req 7: Restrict access by business need | 6 |
-| Req 8: Identify users and authenticate access | 5, 6 |
-| Req 9: Restrict physical access | (Physical — not covered by CIS Controls) |
-| Req 10: Log and monitor all access | 8 |
-| Req 11: Test system/network security | 7, 18 |
-| Req 12: Support information security | 1, 2, 14, 15, 17 |
----
-## CIS Controls v7.1 vs v8 Changes
-Key changes to understand if transitioning from v7.1 to v8:
-| Aspect | CIS Controls v7.1 | CIS Controls v8 |
-|--------|------------------|-----------------|
-| Number of controls | 20 | 18 |
-| Sub-controls | 171 | 153 safeguards |
-| Organization | Technology type | Asset type |
-| Cloud coverage | Limited | Explicit throughout |
-| Mobile coverage | Limited | Integrated |
-| Implementation Groups | Yes (IG1/2/3) | Yes (enhanced) |
-**Controls merged/reorganized:**
-- v7 Controls 4 (Controlled Use of Admin Privileges) + 16 (Account Monitoring) → v8 Control 5 (Account Management)
-- v7 Controls 12 (Boundary Defense) + 13 (Data Protection) → v8 Controls 3 (Data Protection) + 12 (Network Infrastructure)
-- v7 Controls 7 (Email/Web Browsers) + 8 (Malware Defenses) → v8 Controls 9 + 10
-**New in v8:**
-- Explicit cloud asset coverage in all applicable controls
-- Service Provider Management as standalone Control 15
-- Clearer Implementation Group assignments per safeguard
+# CIS Controls v8 — Framework Mapping Reference
+## CIS Controls v8 ↔ NIST CSF 2.0 (Detailed)
+| CIS Control | Safeguard | NIST CSF 2.0 Function | NIST CSF Category | NIST CSF Subcategory |
+|------------|-----------|----------------------|-------------------|----------------------|
+| 1.1 | Enterprise Asset Inventory | Identify | Asset Management (ID.AM) | ID.AM-01, ID.AM-02 |
+| 1.2 | Address Unauthorized Assets | Respond | Incident Management (RS.MA) | RS.MA-01 |
+| 2.1 | Software Inventory | Identify | Asset Management (ID.AM) | ID.AM-02, ID.AM-08 |
+| 2.2 | Supported Software | Govern | Policy (GV.PO) | GV.PO-01 |
+| 3.1 | Data Management Process | Govern | Policy (GV.PO) | GV.PO-01, GV.PO-02 |
+| 3.3 | Data Access Control Lists | Protect | Data Security (PR.DS) | PR.DS-01, PR.DS-05 |
+| 3.6 | Encrypt End-User Devices | Protect | Data Security (PR.DS) | PR.DS-01 |
+| 3.10 | Encrypt Data in Transit | Protect | Data Security (PR.DS) | PR.DS-02 |
+| 3.11 | Encrypt Data at Rest | Protect | Data Security (PR.DS) | PR.DS-01 |
+| 3.13 | Data Loss Prevention | Protect | Data Security (PR.DS) | PR.DS-05 |
+| 4.1 | Secure Configuration Process | Protect | Configuration Management (PR.IP) | PR.IP-01, PR.IP-03 |
+| 4.4 | Firewall on Servers | Protect | Network Security (PR.IR) | PR.IR-01 |
+| 5.4 | Separate Admin Accounts | Protect | Identity Management (PR.AA) | PR.AA-05 |
+| 6.3 | MFA External Applications | Protect | Identity Management (PR.AA) | PR.AA-03 |
+| 6.4 | MFA Remote Access | Protect | Identity Management (PR.AA) | PR.AA-03 |
+| 6.5 | MFA Admin Access | Protect | Identity Management (PR.AA) | PR.AA-05 |
+| 7.3 | OS Patch Management | Protect | Configuration Management (PR.IP) | PR.IP-12 |
+| 7.5 | Internal Vulnerability Scans | Identify | Risk Assessment (ID.RA) | ID.RA-01 |
+| 7.7 | Remediate Vulnerabilities | Protect | Configuration Management (PR.IP) | PR.IP-12 |
+| 8.2 | Collect Audit Logs | Detect | Adverse Event Analysis (DE.AE) | DE.AE-02, DE.AE-03 |
+| 8.9 | Centralize Audit Logs | Detect | Adverse Event Analysis (DE.AE) | DE.AE-03 |
+| 8.11 | Log Reviews | Detect | Continuous Monitoring (DE.CM) | DE.CM-09 |
+| 9.3 | Email Anti-Spoofing | Protect | Platform Security (PR.PS) | PR.PS-05 |
+| 9.5 | DMARC | Protect | Platform Security (PR.PS) | PR.PS-05 |
+| 10.1 | Anti-Malware | Protect | Platform Security (PR.PS) | PR.PS-05 |
+| 10.7 | Behavior-Based AV | Detect | Continuous Monitoring (DE.CM) | DE.CM-09 |
+| 11.2 | Automated Backups | Recover | Incident Recovery Plan (RC.RP) | RC.RP-05 |
+| 11.4 | Isolated Backup Copy | Recover | Incident Recovery Plan (RC.RP) | RC.RP-05 |
+| 12.2 | Secure Network Architecture | Protect | Network Security (PR.IR) | PR.IR-01, PR.IR-02 |
+| 13.1 | Security Event Alerting | Detect | Adverse Event Analysis (DE.AE) | DE.AE-06 |
+| 13.3 | Network Intrusion Detection | Detect | Continuous Monitoring (DE.CM) | DE.CM-01, DE.CM-06 |
+| 14.1 | Security Awareness Program | Protect | Awareness and Training (PR.AT) | PR.AT-01, PR.AT-02 |
+| 15.4 | Vendor Security Requirements | Identify | Supply Chain Risk (ID.SC) | ID.SC-02, ID.SC-04 |
+| 16.1 | Secure Dev Process | Protect | Application Security (PR.PS) | PR.PS-04 |
+| 17.4 | Incident Response Process | Respond | Incident Management (RS.MA) | RS.MA-01, RS.MA-02 |
+| 17.7 | IR Exercises | Respond | Incident Management (RS.MA) | RS.MA-05 |
+| 18.2 | External Pen Test | Identify | Risk Assessment (ID.RA) | ID.RA-05, ID.RA-06 |
+---
+## CIS Controls v8 ↔ ISO 27001:2022 Annex A (Detailed)
+| CIS Control | CIS Safeguards | ISO 27001:2022 Controls |
+|------------|----------------|-------------------------|
+| **1 (Asset Inventory)** | 1.1, 1.2, 1.3 | 5.9 (Inventory of information and other associated assets), 8.8 (Management of technical vulnerabilities) |
+| **2 (Software Inventory)** | 2.1, 2.2, 2.3 | 5.9 (Inventory), 8.8 (Technical vulnerabilities) |
+| **3 (Data Protection)** | 3.1–3.14 | 5.12 (Classification), 5.13 (Labelling), 5.33 (Protection of records), 8.10 (Info deletion), 8.11 (Data masking), 8.24 (Use of cryptography) |
+| **4 (Secure Config)** | 4.1–4.12 | 8.8 (Vulnerability management), 8.9 (Configuration management), 8.22 (Network segregation) |
+| **5 (Account Management)** | 5.1–5.6 | 5.15 (Access control), 5.16 (Identity management), 5.18 (Access rights) |
+| **6 (Access Control)** | 6.1–6.8 | 5.15 (Access control), 5.17 (Authentication info), 6.7 (Remote working), 8.2 (Privileged access rights), 8.3 (Info access restriction), 8.5 (Secure authentication) |
+| **7 (Vulnerability Mgmt)** | 7.1–7.7 | 8.8 (Management of technical vulnerabilities) |
+| **8 (Audit Logs)** | 8.1–8.12 | 8.15 (Logging), 8.16 (Monitoring activities), 8.17 (Clock synchronization) |
+| **9 (Email/Web)** | 9.1–9.7 | 8.22 (Network segregation), 8.23 (Web filtering) |
+| **10 (Malware)** | 10.1–10.7 | 8.7 (Protection against malware) |
+| **11 (Data Recovery)** | 11.1–11.5 | 8.13 (Information backup), 8.14 (Redundancy) |
+| **12 (Network Infra)** | 12.1–12.8 | 8.20 (Networks security), 8.21 (Security of network services), 8.22 (Network segregation) |
+| **13 (Network Monitoring)** | 13.1–13.11 | 8.15 (Logging), 8.16 (Monitoring), 8.20 (Network security) |
+| **14 (Security Training)** | 14.1–14.9 | 6.3 (Information security awareness/education/training), 6.8 (Information security event reporting) |
+| **15 (Service Providers)** | 15.1–15.7 | 5.19 (Information security in supplier relationships), 5.20 (Addressing security in agreements), 5.21 (Managing security in ICT supply chain) |
+| **16 (App Security)** | 16.1–16.14 | 8.25 (Secure development lifecycle), 8.26 (Application security requirements), 8.27 (Secure system architecture and engineering), 8.28 (Secure coding), 8.29 (Security testing in development/acceptance) |
+| **17 (IR Management)** | 17.1–17.9 | 5.24 (IR planning and preparation), 5.25 (Assessment/decision on events), 5.26 (Response to incidents) |
+| **18 (Pen Testing)** | 18.1–18.5 | 8.8 (Technical vulnerability management), 5.36 (Compliance with policies/standards) |
+---
+## CIS Controls v8 ↔ CMMC 2.0 (NIST SP 800-171)
+| CIS Control | CMMC Domain | NIST 800-171 Requirements |
+|------------|-------------|--------------------------|
+| 1 (Asset Inventory) | Asset Management / System Inventory | Not explicitly in 800-171 but implied by CM.3.068 |
+| 2 (Software Inventory) | Configuration Management (CM) | 3.4.1 (Baseline configurations), 3.4.2 (Configuration settings) |
+| 3 (Data Protection) | Media Protection (MP) | 3.8.1–3.8.9 |
+| 4 (Secure Config) | Configuration Management (CM) | 3.4.1, 3.4.2, 3.4.6, 3.4.7 |
+| 5 (Account Management) | Identification & Authentication (IA) | 3.5.1, 3.5.2, 3.5.3 |
+| 6 (Access Control) | Access Control (AC) | 3.1.1–3.1.22 |
+| 7 (Vulnerability Mgmt) | Risk Assessment (RA) | 3.11.1, 3.11.2, 3.11.3 |
+| 8 (Audit Logs) | Audit & Accountability (AU) | 3.3.1–3.3.9 |
+| 9 (Email/Web) | System & Communications Protection (SC) | 3.13.6, 3.13.7 |
+| 10 (Malware Defenses) | System & Information Integrity (SI) | 3.14.2, 3.14.4, 3.14.5 |
+| 11 (Data Recovery) | Recovery not explicitly in 800-171 | 3.8.9 (Backup CUI on mobile devices) |
+| 12 (Network Infra) | System & Communications Protection (SC) | 3.13.1, 3.13.2, 3.13.5 |
+| 13 (Network Monitoring) | System & Information Integrity (SI) | 3.14.6, 3.14.7 |
+| 14 (Security Training) | Awareness & Training (AT) | 3.2.1, 3.2.2, 3.2.3 |
+| 15 (Service Providers) | Supply Chain Risk not explicitly in 800-171 | Implied by CM and SI |
+| 16 (App Security) | System & Communications Protection (SC) | 3.13.10, 3.13.16 |
+| 17 (Incident Response) | Incident Response (IR) | 3.6.1, 3.6.2, 3.6.3 |
+| 18 (Pen Testing) | Not explicitly in CMMC L2, required at L3 | NIST SP 800-172: 2.11.3 |
+---
+## CIS Controls v8 ↔ SOC 2 Trust Services Criteria
+| CIS Control | SOC 2 Criterion | TSC Category |
+|------------|----------------|-------------|
+| 1 (Asset Inventory) | CC6.1 | Common Criteria |
+| 2 (Software Inventory) | CC6.1, CC6.2 | Common Criteria |
+| 3 (Data Protection) | CC6.1, CC6.5, C1.1, C1.2 | Common Criteria / Confidentiality |
+| 4 (Secure Config) | CC6.1, CC7.1 | Common Criteria |
+| 5 (Account Management) | CC6.2, CC6.3 | Common Criteria |
+| 6 (Access Control) | CC6.1, CC6.2, CC6.3 | Common Criteria |
+| 7 (Vulnerability Mgmt) | CC7.1 | Common Criteria |
+| 8 (Audit Logs) | CC4.1, CC7.2, CC7.3 | Common Criteria |
+| 9 (Email/Web) | CC6.1, CC6.6 | Common Criteria |
+| 10 (Malware) | CC6.1, CC6.8 | Common Criteria |
+| 11 (Data Recovery) | A1.2, A1.3 | Availability |
+| 12 (Network Infra) | CC6.1, CC6.6 | Common Criteria |
+| 13 (Network Monitoring) | CC7.2, CC7.3 | Common Criteria |
+| 14 (Security Training) | CC1.4, CC2.2 | Common Criteria |
+| 15 (Service Providers) | CC9.2 | Common Criteria |
+| 16 (App Security) | CC8.1 | Common Criteria |
+| 17 (Incident Response) | CC7.3, CC7.4, CC7.5 | Common Criteria |
+| 18 (Pen Testing) | CC4.1, CC4.2 | Common Criteria |
+---
+## CIS Controls v8 ↔ PCI DSS v4.0
+| PCI DSS Requirement | CIS Controls |
+|--------------------|-------------|
+| Req 1: Install network controls | 12, 13 |
+| Req 2: Secure system/network components | 4 |
+| Req 3: Protect stored cardholder data | 3 |
+| Req 4: Protect cardholder data in transit | 3.10 |
+| Req 5: Protect against malicious software | 10 |
+| Req 6: Develop/maintain secure systems | 16 |
+| Req 7: Restrict access by business need | 6 |
+| Req 8: Identify users and authenticate access | 5, 6 |
+| Req 9: Restrict physical access | (Physical — not covered by CIS Controls) |
+| Req 10: Log and monitor all access | 8 |
+| Req 11: Test system/network security | 7, 18 |
+| Req 12: Support information security | 1, 2, 14, 15, 17 |
+---
+## CIS Controls v7.1 vs v8 Changes
+Key changes to understand if transitioning from v7.1 to v8:
+| Aspect | CIS Controls v7.1 | CIS Controls v8 |
+|--------|------------------|-----------------|
+| Number of controls | 20 | 18 |
+| Sub-controls | 171 | 153 safeguards |
+| Organization | Technology type | Asset type |
+| Cloud coverage | Limited | Explicit throughout |
+| Mobile coverage | Limited | Integrated |
+| Implementation Groups | Yes (IG1/2/3) | Yes (enhanced) |
+**Controls merged/reorganized:**
+- v7 Controls 4 (Controlled Use of Admin Privileges) + 16 (Account Monitoring) → v8 Control 5 (Account Management)
+- v7 Controls 12 (Boundary Defense) + 13 (Data Protection) → v8 Controls 3 (Data Protection) + 12 (Network Infrastructure)
+- v7 Controls 7 (Email/Web Browsers) + 8 (Malware Defenses) → v8 Controls 9 + 10
+**New in v8:**
+- Explicit cloud asset coverage in all applicable controls
+- Service Provider Management as standalone Control 15
+- Clearer Implementation Group assignments per safeguard