CIS Controls v8 IG1 mapping

<p>Mapping to CIS Critical Security Controls v8, Implementation Group 1 (the 56 safeguards expected of every organization regardless of size). IG1 is our committed baseline.</p> <h2>1. Inventory and Control of Enterprise Assets</h2> <ul><li>1.1 Establish and Maintain Detailed Enterprise Asset Inventory: <a href="/trust/docs/data-map">data map</a>, <a href="/trust/docs/architecture">architecture</a>, cloud inventories in Vercel / GCP consoles</li><li>1.2 Address Unauthorized Assets: access policy enforces provisioning only through the Security Officer</li><li>1.3 Utilize an Active Discovery Tool: N/A at our scale; cloud console inventory is authoritative</li></ul> <h2>2. Inventory and Control of Software Assets</h2> <ul><li>2.1 Establish Software Inventory: <code>package.json</code> + CycloneDX SBOM generated through the manual security workflow and published when the workflow is run from <code>master</code></li><li>2.2 Ensure Authorized Software is Currently Supported: Dependabot + monthly upgrade window</li><li>2.3 Address Unauthorized Software: PR review gates additions; <a href="/trust/docs/acceptable-use">acceptable use</a> controls personnel devices</li></ul> <h2>3. Data Protection</h2> <ul><li>3.1 Establish and Maintain a Data Management Process: <a href="/trust/docs/data-classification">data classification</a></li><li>3.2 Establish and Maintain a Data Inventory: <a href="/trust/docs/data-map">data map</a></li><li>3.3 Configure Data Access Control Lists: Firestore Security Rules default-deny with user-scoped access checks (<code>request.auth.uid</code>) and administrator-role checks; API routes enforce administrator vs. non-administrator access.</li><li>3.4 Enforce Data Retention: <a href="/trust/docs/data-retention">data retention policy</a></li><li>3.5 Securely Dispose of Data: cascading Firestore deletion, Stripe subscription cancellation/verification, and vendor-side deletion through the DSR process where vendor API deletion is not available</li><li>3.6 Encrypt Data on End-User Devices: full-disk encryption mandatory per <a href="/trust/docs/physical-security">physical security</a></li></ul> <h2>4. Secure Configuration of Enterprise Assets and Software</h2> <ul><li>4.1 Establish and Maintain a Secure Configuration Process: <a href="/trust/docs/sdlc">secure development lifecycle</a>, <a href="/trust/docs/change-management">change management</a></li><li>4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure: relies on Vercel + GCP managed configuration</li><li>4.3 Configure Automatic Session Locking: device screen lock ≤10 min</li><li>4.4 Implement and Manage a Firewall on Servers: Cloudflare DNS/reverse proxy, Cloudflare Managed Free Ruleset and L7 DDoS ruleset evidence, and Vercel inherited platform protection apply; no active custom Vercel Firewall configuration or custom Cloudflare WAF/rate-limit entrypoint rulesets were found on 2026-05-07; Cloud Armor is not configured for our Google Cloud project.</li><li>4.5 Implement and Manage a Firewall on End-User Devices: OS-level firewalls enabled per <a href="/trust/docs/acceptable-use">acceptable use</a></li><li>4.6 Securely Manage Enterprise Assets and Software: CI + PR review</li><li>4.7 Manage Default Accounts on Enterprise Assets and Software: no defaults; admin created intentionally</li></ul> <h2>5. Account Management</h2> <ul><li>5.1 Establish and Maintain an Inventory of Accounts: <code>admins</code> Firestore collection + vendor dashboards audited quarterly</li><li>5.2 Use Unique Passwords: password manager required per <a href="/trust/docs/acceptable-use">acceptable use</a></li><li>5.3 Disable Dormant Accounts: JML process per <a href="/trust/docs/access-control-policy">access control policy</a></li><li>5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts: break-glass vs. day-to-day separation</li></ul> <h2>6. Access Control Management</h2> <ul><li>6.1 Establish an Access Granting Process: <a href="/trust/docs/access-control-policy#provisioning--deprovisioning">access control policy — provisioning</a></li><li>6.2 Establish an Access Revoking Process: <a href="/trust/docs/access-control-policy#provisioning--deprovisioning">access control policy — deprovisioning</a></li><li>6.3 Require MFA for Externally-Exposed Applications: Met as an opt-in customer control. Application-level TOTP MFA is available on the user&#39;s <code>/account</code> Security tab (RFC 6238 authenticator apps; one-time backup codes; AES-256-GCM at rest; anti-replay enforced server-side; defined re-challenge window). MFA is opt-in rather than required for customers; institution-enforced MFA is available on enterprise engagement.</li><li>6.4 Require MFA for Remote Network Access: N/A (no VPN / on-prem networks)</li><li>6.5 Require MFA for Administrative Access: Current administrative accounts are required by policy to use Google Account MFA at the identity-provider layer. Administrators may also enable application-level TOTP MFA on their own accounts via <code>/account/security</code>.</li></ul> <h2>7. Continuous Vulnerability Management</h2> <ul><li>7.1 Establish and Maintain a Vulnerability Management Process: <a href="/trust/docs/patch-management">patch management</a></li><li>7.2 Establish and Maintain a Remediation Process: SLAs defined</li><li>7.3 Perform Automated Operating System Patch Management: OS auto-update on endpoints; runtime patched by Vercel</li><li>7.4 Perform Automated Application Patch Management: Dependabot</li></ul> <h2>8. Audit Log Management</h2> <ul><li>8.1 Establish and Maintain an Audit Log Management Process: see the <a href="/trust/docs/logging-retention">logging &amp; retention</a>.</li><li>8.2 Collect Audit Logs: Firestore append-only audit log, Sentry, and the Vercel log drain to Sentry for selected production and preview platform sources.</li><li>8.3 Ensure Adequate Audit Log Storage: 2-year audit-log retention and 1-year AI call audit retention enforced by a scheduled retention runner.</li><li>8.4 Standardize Time Synchronization: server clocks via Vercel / GCP (NTP)</li></ul> <h2>9. Email and Web Browser Protections</h2> <ul><li>9.1 Ensure Use of Only Fully Supported Browsers and Email Clients: personnel policy</li><li>9.2 Use DNS Filtering Services: browser + OS defaults; optional Pi-hole / NextDNS on personnel networks</li></ul> <h2>10. Malware Defenses</h2> <ul><li>10.1 Deploy and Maintain Anti-Malware Software: OS-native (Defender, XProtect)</li><li>10.2 Configure Automatic Anti-Malware Signature Updates: OS-managed</li><li>10.3 Disable Autorun and Autoplay for Removable Media: OS policy</li></ul> <h2>11. Data Recovery</h2> <ul><li>11.1 Establish and Maintain a Data Recovery Process: <a href="/trust/docs/drp">disaster recovery plan</a></li><li>11.2 Perform Automated Backups: Firestore PITR and managed daily Firestore backups with 98-day retention confirmed in live GCP review</li><li>11.3 Protect Recovery Data: primary backup/export bucket uses US multi-region storage, versioning, public access prevention, uniform bucket-level access, 90-day soft delete, and a 90-day retention policy</li><li>11.4 Establish and Maintain an Isolated Instance of Recovery Data: separate US multi-region backup/export bucket is configured; restore drill from managed backup remains pending</li></ul> <h2>12. Network Infrastructure Management</h2> <ul><li>12.1 Ensure Network Infrastructure is Up-to-Date: Vercel + GCP managed</li></ul> <h2>14. Security Awareness and Skills Training</h2> <ul><li>14.1 Establish and Maintain a Security Awareness Program: <a href="/trust/docs/security-awareness-training">security awareness training</a> defines the program; the required onboarding module suite includes <a href="/trust/docs/security-awareness-training-module">security awareness training module</a>, <a href="/trust/docs/privacy-data-handling-training-module">privacy and data handling training module</a>, <a href="/trust/docs/responsible-ai-training-module">responsible AI training module</a>, <a href="/trust/docs/incident-reporting-training-module">incident reporting training module</a>, and <a href="/trust/docs/device-physical-security-training-module">device and physical security training module</a>; role-specific accessibility training is assigned through <a href="/trust/docs/accessibility-training-module">accessibility training module</a>; restricted training evidence records signed acknowledgments for audit review</li></ul> <h2>15. Service Provider Management</h2> <ul><li>15.1 Establish and Maintain an Inventory of Service Providers: <a href="/trust/docs/sub-processors">sub-processors</a></li></ul> <h2>17. Incident Response Management</h2> <ul><li>17.1 Designate Personnel to Manage Incident Handling: Security Officer</li><li>17.2 Establish and Maintain Contact Information for Reporting Security Incidents: <code>[email protected]</code>; <code>.well-known/security.txt</code></li><li>17.3 Establish and Maintain an Enterprise Process for Reporting Incidents: IR runbook</li></ul> <h2>IG2/IG3 aspirational (not yet claimed)</h2> <p>Red teaming, external pen testing, dedicated log management platform, formal SOC. Tracked as future work.</p> <h2>Change log</h2> <table><thead><tr><th>Date</th><th>Change</th></tr></thead><tbody><tr><td>2026-04-24</td><td>Initial mapping</td></tr><tr><td>2026-05-07</td><td>Updated Cloudflare/Vercel logging, retention enforcement, and training-current-state mapping.</td></tr></tbody></table>