CIS Security Assessment
Security That Can Be Reviewed, Tested and Improved
CIS security is supported by independent testing, defined procedures, monitoring, corrective action and ongoing review rather than relying on security claims alone.
The CIS approach combines external assessment, penetration testing, internal procedures, monitoring, incident response and documented improvement activities.
Evidence-based security
A structured approach rather than a one-time assessment
Security is treated as an ongoing management process. External findings, internal reviews and operational observations can all lead to documented corrective actions and further improvement.
Independent Testing
External assessments are used to identify potential security weaknesses and areas requiring attention.
Defined Procedures
Security activities are supported by documented procedures and responsibilities.
Monitoring & Review
Security activity is monitored and reviewed rather than treated as a one-time implementation exercise.
Corrective Action
Findings can be assigned, corrected and reviewed for effectiveness using structured follow-up.
Independent validation
External security assessment
CIS Software has been evaluated using independent cybersecurity assessment tools designed to review externally visible security posture and identify potential areas for improvement.
Independent security assessment of CIS Software
Penetration testing
Testing from an attacker’s perspective
CIS has also undergone independent third-party penetration testing using a black-box approach.
In this type of testing, external cybersecurity specialists attempt to evaluate the system without relying on internal knowledge or privileged access.
- Testing without normal user credentials
- No internal system knowledge provided
- Use of real-world attack techniques
- Identification of potential vulnerabilities
- Recommendations for improvement
Responsible disclosure
Detailed findings are not published publicly
Publishing detailed penetration-test findings could itself create unnecessary security exposure.
The general testing methodology and security approach can instead be discussed with appropriate customer IT or security personnel during qualification and review.
Infrastructure controls
Reduce unnecessary exposure
Dedicated Environment
CIS uses dedicated server infrastructure rather than ordinary shared web-hosting architecture.
Controlled Services
Server and network configuration is designed to limit unnecessary exposed services.
Restricted Administration
Administrative and critical-system access is controlled rather than made generally available.
Backup & Recovery
Secure backup processes support recovery in the event of a system or infrastructure problem.
Access control
Access is limited according to responsibility
CIS includes controls intended to restrict system functions and information according to authorized user access.
Application controls
Control who can do what
- Role-based access controls
- Permissions based on responsibility
- User authentication
- Controlled administrative access
- Encrypted communications
- Restricted database access paths
Closed-loop security management
Findings are meant to lead to action
Security findings can be managed using the same disciplined approach used for other controlled improvement activities.
Testing, monitoring or review identifies a potential issue.
The issue is recorded and responsibility for action is established.
Appropriate corrective or preventive changes are implemented.
The effectiveness of the action can be reviewed and confirmed.
CIS security testing and continuous improvement
Incident response
A defined process for potential security events
CIS is supported by an incident-response approach intended to provide a structured response when a potential security issue is identified.
- Contain the immediate issue
- Investigate the cause
- Recover using available safeguards and backups
- Communicate with appropriate stakeholders
- Review the event and identify improvements
Recovery
Security also includes the ability to recover
Prevention is important, but so is preparedness. Backup, recovery and incident-response procedures provide additional protection when an unexpected event occurs.
Application security
Testing feeds back into software improvement
Security improvements can be driven by assessment results, audits, operational findings and changes in the threat environment.
Web Security
Application development and maintenance include attention to common web-based attack risks.
Input Handling
User input and system data are handled through controlled application processes.
File Handling
File-related functions are controlled to reduce unnecessary exposure.
Updates & Maintenance
Security-related improvements can be incorporated as vulnerabilities and requirements change.
People & procedures
Security is not only technical
Personnel involved with CIS follow defined security procedures and receive security-awareness guidance appropriate to their responsibilities.
Security awareness
Human behaviour remains part of the control system
- Security-awareness training
- Defined procedures
- Threat recognition and response
- Attention to remote-access risks
- Security considerations during development activity
For your IT team
A security approach that can be discussed and reviewed
Defined Controls
Security responsibilities and technical controls are not left entirely informal.
Independent Testing
External testing provides information beyond internal self-assessment.
Ongoing Monitoring
Security continues after implementation through review and monitoring.
Documented Improvement
Findings can be tracked through corrective action and verification.
Security review & qualification
Bring your IT or security team into the conversation
Organizations with technical, contractual or customer-specific security requirements can discuss the CIS security approach and available supporting information during the qualification process.