CIS Controls, mapped to what Alvor does.
The CIS Critical Security Controls are 18 prioritized safeguards that stop the most common attacks. Here is which of them Alvor helps you implement, and how directly.
All 18 controls in CIS v8.1.
An honest map of where Alvor materially contributes. Control ownership stays with you.
About CIS Controls
Eighteen controls, prioritized by impact
Who it is for
Teams that want a concrete, attack-informed starting point rather than a compliance checklist, and that need to show measurable coverage to leadership.
The CIS Critical Security Controls are a prioritized set of safeguards maintained by the Center for Internet Security. Built from real-world attack data, they answer a practical question: of everything you could do, what should you do first?
Version 8.1 organizes the work into 18 controls, each broken into safeguards and grouped into three Implementation Groups (IG1 to IG3) that scale with organizational maturity. Inventory and continuous vulnerability management sit at the top because you cannot defend what you cannot see.
Control alignment
Which CIS Controls Alvor helps you satisfy
All 18 controls, rated by how directly Alvor contributes. Inventory, vulnerability, and third-party controls are where Alvor does the heavy lifting; operational defenses stay in your security stack with Alvor holding the control and its evidence.
Alvor performs the control or produces the evidence.
Alvor helps you manage, track, and document it.
You implement it operationally; Alvor stores the control and evidence.
CIS Critical Security Controls
v8.139618Inventory and Control of Enterprise Assets
Pull asset inventory in from your cloud and security tooling, spreadsheet import, and shadow-asset reconciliation into one continuously updated register.
AssetsInventory and Control of Software Assets
Inventory installed software and components with PURL/CPE and end-of-life flags, per asset.
AssetsData Protection
Classify data by sensitivity and type and record its retention and encryption status; encryption and DLP enforcement run in your stack.
Data GovernanceSecure Configuration of Enterprise Assets and Software
Track the recorded configuration baseline and its drift in the CMDB; hardening standards are defined in your tooling.
Secure by DesignAccount Management
Maintain an inventory of accounts and owners and the policy that governs them; provisioning is enforced in your identity provider.
PolicyAccess Control Management
Document least-privilege and access-review policy and track the reviews; grants and revocations run in your IdP.
PolicyContinuous Vulnerability Management
Pull CVE findings in from your scanner (Veracode) and cloud posture (AWS, OCI), linked to the affected asset and visible to its owners.
RiskAudit Log Management
Define your logging standard and retention and hold the evidence; collection and storage run in your SIEM.
Security ManagementEmail and Web Browser Protections
Record the control design and configuration evidence; enforcement lives in your mail gateway and endpoint tooling.
Security ManagementMalware Defenses
Reconcile endpoint-protection coverage against the asset inventory to surface unprotected or stale hosts.
AssetsData Recovery
Document recovery objectives and procedures (RTO/RPO) per asset; backups and restore tests run in your stack.
Business ContinuityNetwork Infrastructure Management
Inventory network devices and map the dependencies between them; configuration is managed in your network tooling.
AssetsNetwork Monitoring and Defense
Capture the control design and monitoring evidence; detection runs in your NDR and SIEM.
Security ManagementSecurity Awareness and Skills Training
You run security awareness and training; Alvor holds the control and its evidence.
Security ManagementService Provider Management
Maintain a vendor inventory, send and score security questionnaires, and requeue reassessments on a risk-tiered cadence.
Third-Party Risk ManagementApplication Software Security
Take applications through secure-design review and control implementation, and ingest application findings from Veracode.
Secure by DesignIncident Response Management
You run incident response; Alvor holds the IR control and its evidence.
Security ManagementPenetration Testing
Pentests run externally; their findings can be ingested and linked to the affected assets.
RiskThis mapping shows where Alvor materially contributes to each control. It is a guide for scoping, not an attestation or certification: responsibility for implementing and operating every control remains with your organization. Ratings reflect Alvor's product capabilities and may differ from your audited scope.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.