Intermediate level · Module 6: Small Organisation Security Assessment · Lesson 2 of 3
Assessing Essential Safeguards
Check the organisation's practice against essential safeguards and collect evidence.
In this lesson you will
- Use a safeguards checklist
- Collect evidence without attacking systems
Key concepts
CIS Controlsasset inventoryevidenceconfiguration review
The lesson
The CIS Controls are a prioritised set of safeguards; the essential ones cover inventory of devices and software, data protection, secure configuration, account and access management, vulnerability management, logging, email and browser protection, malware defences, backups, awareness and incident response.
Collect evidence by interviewing staff, observing practice and reviewing settings with an administrator — for example, viewing the MFA report rather than trying passwords.
Record each safeguard as in place, partial or missing, with the evidence.
Step by step
- Build the asset inventory.
- Work through the checklist with staff.
- Record evidence for each item.
- Rate each safeguard.
Practice activity
Complete the safeguard checklist with evidence.
Expected result: A checklist with a rating and evidence for every safeguard.
Check your understanding
-
How should MFA coverage be checked in an assessment?
Show answer
By reviewing the admin report or settings with an administrator, not by testing passwords.
-
What three ratings are used for each safeguard?
Show answer
In place, partial or missing.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.