CIS Training Course

Lesson 1 • Introduction to CIS Frameworks

Covers the origin, purpose, and structure of CIS benchmarks and controls. Provides the conceptual baseline for all subsequent framework application.

Lesson 2 • Regulatory and Compliance Context

Maps CIS controls to common compliance obligations without referencing specific legal codes. Students understand how CIS satisfies audit and regulatory requirements.

Lesson 3 • Asset Identification and Classification

Teaches systematic inventory of hardware, software, and data assets. Asset classification directly enables prioritised control implementation.

Lesson 4 • Threat Landscape and Adversary Models

Surveys current threat actors, attack categories, and adversary motivations. Grounds control selection in realistic threat scenarios.

Lesson 1 • Roadmap Planning for Control Adoption

Guides creation of a phased implementation roadmap aligned to business risk tolerance. Output is a prioritised control adoption schedule.

Lesson 2 • IG2 and IG3 Controls Overview

Surveys the additional safeguards introduced at higher maturity levels. Students identify which controls require specialised tooling or expertise.

Lesson 3 • Organisational Maturity Assessment

Provides tools to assess current security posture and select the appropriate starting group. Maturity scores drive the implementation roadmap built later.

Lesson 4 • Implementation Group Structure

Explains the tiered IG1, IG2, and IG3 model and the criteria for group assignment. Establishes the prioritisation logic used throughout the course.

Lesson 1 • Application and Browser Hardening

Covers secure configuration of productivity software, browsers, and common server applications. Reduces client-side and server-side attack vectors.

Lesson 2 • Configuration Validation and Drift Detection

Introduces automated scanning tools to verify compliance and detect configuration drift. Continuous validation sustains the hardened baseline over time.

Lesson 3 • CIS Benchmark Structure and Usage

Explains benchmark document layout, scoring levels, and applicability statements. Students navigate benchmarks efficiently to extract actionable guidance.

Lesson 4 • Network Device Configuration

Applies CIS benchmarks to routers, switches, and firewalls. Properly configured network devices enforce segmentation and access control policies.

Lesson 1 • Access Control Policies and Enforcement

Translates CIS access safeguards into enforceable policy documents and technical controls. Policy enforcement closes gaps between documented intent and actual configuration.

Lesson 2 • Identity Monitoring and Anomaly Detection

Applies log analysis and behavioural baselines to detect unauthorised access attempts. Identity monitoring feeds directly into the incident response process.

Lesson 3 • Account Management Fundamentals

Covers account lifecycle from provisioning to deprovisioning aligned to CIS safeguards. Proper lifecycle management prevents orphaned and over-privileged accounts.

Lesson 4 • Privileged Access Management

Addresses controls for administrative and service accounts with elevated permissions. PAM reduces the blast radius of credential compromise.

Lesson 1 • Secure Data Disposal and Retention

Defines retention schedules and secure disposal methods for physical and digital media. Proper disposal eliminates residual data exposure after asset decommission.

Lesson 2 • Data Inventory and Classification

Establishes a repeatable process for discovering, cataloging, and classifying sensitive data. Classification drives encryption and handling requirements downstream.

Lesson 3 • Data Loss Prevention Strategies

Introduces DLP tooling, policy rules, and endpoint controls to prevent unauthorised data exfiltration. DLP complements encryption by controlling data movement.

Lesson 4 • Backup and Recovery Controls

Aligns CIS backup safeguards with recovery time and recovery point objectives. Tested backups are the last line of defence against ransomware and data loss.

Lesson 1 • Continuous Network Monitoring Operations

Establishes operational procedures for sustained network visibility and threat hunting. Continuous monitoring transforms reactive detection into proactive defence.

Lesson 2 • Security Information and Event Management

Configures SIEM platforms to aggregate, correlate, and alert on security events. SIEM is the operational hub for CIS continuous monitoring requirements.

Lesson 3 • Intrusion Detection and Prevention

Deploys IDS and IPS sensors aligned to CIS monitoring safeguards. Signature and behavioural detection provide layered visibility into network threats.

Lesson 4 • Network Architecture and Segmentation

Applies CIS guidance to design segmented network zones that limit lateral movement. Segmentation is foundational to all subsequent monitoring and detection work.

Lesson 1 • Vulnerability Management Programme Design

Defines scope, cadence, and roles for an enterprise vulnerability management programme. A structured programme ensures consistent identification and remediation of weaknesses.

Lesson 2 • Remediation Prioritisation and Tracking

Applies risk-based scoring to prioritise remediation efforts across large finding sets. Tracking closure rates demonstrates measurable risk reduction to stakeholders.

Lesson 3 • Penetration Testing Fundamentals

Introduces penetration testing methodology, scoping, and rules of engagement aligned to CIS. Students understand how pen test findings map to specific CIS safeguards.

Lesson 4 • Reporting and Continuous Improvement

Structures vulnerability and pen test reports for technical and executive audiences. Trend analysis drives continuous improvement of the security programme.

Lesson 1 • Security Programme Governance and Metrics

Integrates CIS controls into a governance framework with measurable KPIs and executive reporting. Governance structures sustain the security programme beyond individual projects.

Lesson 2 • Incident Detection and Classification

Defines detection sources, triage criteria, and severity classification for security incidents. Accurate classification ensures proportionate and timely response actions.

Lesson 3 • Containment, Eradication, and Recovery

Covers tactical response steps from isolation through root-cause removal and system restoration. Structured containment limits damage while preserving forensic evidence.

Lesson 4 • Incident Response Programme Foundations

Establishes IR policy, team structure, and communication protocols aligned to CIS safeguards. A documented IR programme reduces response time and limits breach impact.