CIS Control 7: vulnerability management for small firms

CIS Control 7 turns patching into a process an owner can check. Here is what the four Implementation Group 1 safeguards require, when scanning comes in, and how the control lines up with the FTC Safeguards Rule.

Sean Crowley

President & Co-Founder

October 30, 2026 · 5 min read

Key takeaways

CIS Control 7 in CIS Controls v8.1 has seven safeguards for continuous vulnerability management.
Safeguards 7.1 to 7.4 apply to every Implementation Group, including the IG1 baseline for small firms.
Safeguards 7.3 and 7.4 call for automated operating system and application patching on a monthly or more frequent basis.
Internal scans every quarter and external scans every month begin at Implementation Group 2.
The FTC Safeguards Rule requires vulnerability assessments at least every six months unless a firm has effective continuous monitoring.

If your firm answers to a regulator, a cyber insurer or a client's security questionnaire, someone will eventually ask how you patch and ask you to prove it. A yes is not enough. They want a written process, a schedule and records showing the schedule was met. CIS Control 7 gives small firms all three in a form they can run, and it starts with four safeguards in Implementation Group 1.

What is CIS Control 7?

It is the CIS Critical Security Control for continuous vulnerability management. CIS Controls v8.1 describes it as a plan to "continuously assess and track vulnerabilities on all enterprise assets" in order to remediate them and "minimize the window of opportunity for attackers." It also asks firms to monitor public and private sources for new threat and vulnerability information. The control has seven safeguards that span four security functions: Govern for the written process, Protect for patching, Identify for scanning and Respond for remediation.

Which Control 7 safeguards apply to a small firm?

Four of the seven. Implementation Group 1 is CIS's foundational set of 56 safeguards for enterprises with limited IT and security expertise, and CIS says every enterprise should begin there. In Control 7, IG1 covers:

7.1 Vulnerability management process. A documented process for enterprise assets, reviewed annually or when significant changes occur.
7.2 Remediation process. A risk-based remediation strategy, documented, with monthly or more frequent reviews.
7.3 Automated operating system patching. Operating system updates through automated patch management, monthly or more often.
7.4 Automated application patching. Application updates through automated patch management, monthly or more often.

Implementation Group 2 adds the scanning and remediation safeguards. Safeguard 7.5 calls for automated scans of internal assets at least quarterly, both authenticated and unauthenticated. Safeguard 7.6 calls for automated scans of externally exposed assets at least monthly. Safeguard 7.7 calls for remediating detected vulnerabilities at least monthly, based on the remediation process. For how Control 7 fits the rest of the baseline, see the 56 IG1 safeguards a small firm starts with.

Why does Control 7 depend on your asset inventory?

Because a firm cannot patch or scan devices and software it has not listed. Control 7 applies to "all enterprise assets," and the inventories built under CIS Controls 1 and 2 define what "all" means. A laptop that never checks in to device management, or a desktop application installed outside the standard image, will not show up in a monthly patch report. Reconciling the patch report against the inventory each month is the simplest test that the process covers everything.

Does any regulation require vulnerability scanning for a small firm?

Some do, and they move a regulated small firm past IG1 on scanning. The FTC Safeguards Rule, which covers non-bank financial institutions such as tax preparers, mortgage brokers and advisers not registered with the SEC, is the clearest example. Under 16 CFR 314.4(d)(2), a firm without effective continuous monitoring must run annual penetration tests and vulnerability assessments at least every six months, and again after material changes to its operations or business arrangements. For the testing half of that requirement, see whether the FTC Safeguards Rule requires an annual penetration test.

Two other sources point the same way. The California Attorney General's 2016 Data Breach Report recommended the CIS Controls as the starting point for a security program and said failing to implement the applicable controls would indicate a failure to provide reasonable security. That report is guidance, not a regulation, but it is widely cited in California. For firms that handle health information, HHS's proposed HIPAA Security Rule update would require vulnerability scanning at least every six months. A firm subject to any of these should plan for the IG2 scanning safeguards even if it otherwise fits IG1.

What does a workable remediation process look like?

A short written document that says what gets fixed first, by when, by whom and what happens when a fix cannot be applied. Safeguard 7.2 leaves the specifics to the firm as long as the strategy is risk-based and reviewed at least monthly. NIST's SP 800-40 Rev. 4 frames this work as preventive maintenance, a routine cost of running technology. A practical version for a 10 to 100 person firm covers:

Priority tiers, with internet-facing systems such as firewalls, VPN gateways and remote access tools ahead of internal workstations.
A faster track for vulnerabilities that vendors or government advisories report as actively exploited.
A named owner for each tier, whether an internal person or the firm's IT provider.
An exception path for systems that cannot be patched on time, with a compensating control, an approver and an expiry date.
A plan for unsupported software, which CIS Safeguard 2.2 says should not be authorized without a documented exception.

What should a small firm do this quarter?

Get the four IG1 safeguards on paper and producing evidence, then decide whether a regulation pulls you into scanning. In order:

Write or update the vulnerability management and remediation process, and put an annual review date on it.
Confirm automated patching is on for operating systems and for the applications your staff use daily, including browsers, PDF tools and practice software.
Pull a monthly patch compliance report and compare it with your asset inventory.
If the FTC Safeguards Rule or a client contract applies, schedule external and internal vulnerability scans and record the date each finding is closed.
Start an exception log and review it at the same monthly meeting as the patch report.

This article describes the CIS Controls and cites the rules that reference them. It is not legal advice about which rules apply to your firm.

How does s90 help?

s90 runs automated patching and vulnerability scanning for small regulated firms, maps the work to CIS Control 7, and delivers the monthly reports and exception records an examiner, insurer or client may ask to see. If you would like a second look at your vulnerability management process, we are glad to help.

Applies to

Compliance

CIS Controls FTC Safeguards Rule HIPAA

Regulation reference

CIS Critical Security Controls v8.1, Control 7 (Safeguards 7.1 to 7.7)
Safeguards 7.1 to 7.4 (IG1, IG2, IG3) require a documented vulnerability management process reviewed annually or after significant changes, a risk-based remediation process with monthly or more frequent reviews, and automated operating system and application patching on a monthly or more frequent basis. Safeguards 7.5 to 7.7 (IG2, IG3) add quarterly authenticated and unauthenticated internal scans, monthly external scans, and monthly remediation of detected vulnerabilities.
cas.docs.cisecurity.org/en/latest/source/Controls7/
CIS Critical Security Controls v8.1, Implementation Group 1 (IG1)
Defines IG1 as a foundational set of 56 safeguards (essential cyber hygiene) for enterprises with limited IT and security expertise. CIS states that IG1 represents a minimum standard of information security and that every enterprise should begin with IG1.
www.cisecurity.org/controls/implementation-groups/ig1
CIS Critical Security Controls v8.1, Controls 1 and 2 (Safeguards 1.1 to 1.5 and 2.1 to 2.7)
Control 1 requires a detailed inventory of all enterprise assets that can store or process data, reviewed bi-annually or more frequently (1.1), and a weekly process to address unauthorized assets (1.2). Control 2 requires a software inventory reviewed bi-annually (2.1), a monthly check that authorized software is still supported with documented exceptions (2.2), and monthly handling of unauthorized software (2.3). Safeguards 1.1 to 1.2 and 2.1 to 2.3 are in IG1; the rest start at IG2 or IG3.
cas.docs.cisecurity.org/en/latest/source/Controls1/
16 CFR 314.4(d)(2), (e) and (h)
Absent effective continuous monitoring, requires annual penetration testing and vulnerability assessments at least every six months; requires security awareness training updated to reflect identified risks; and requires a written incident response plan.
www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4
California Attorney General, California Data Breach Report (February 2016)
Recommends that organizations adopt the CIS Critical Security Controls as the start of a comprehensive information security program, stating that not doing so would be indicative of a failure to provide reasonable security. Guidance, not a regulation.
oag.ca.gov/news/press-releases/attorney-general-kamala-d-harris-releases-data-breach-report-over-49-million
HHS OCR, HIPAA Security Rule Notice of Proposed Rulemaking fact sheet (December 27, 2024)
Summarizes the proposed changes, including a written technology asset inventory and a network map of ePHI movement updated at least every 12 months and after relevant changes, risk analyses that review the inventory and map, vulnerability scanning at least every six months, penetration testing at least every 12 months, and annual compliance audits. These are proposals, not current requirements.
www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html
NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology (April 2022)
Guidance, not a regulation. Defines enterprise patch management as identifying, prioritizing, acquiring, installing and verifying patches, updates and upgrades throughout an organization, frames patching as preventive maintenance and a cost of doing business, and recommends an enterprise strategy to simplify and operationalize patching.
csrc.nist.gov/pubs/sp/800/40/r4/final
CIS Critical Security Controls v8.1, Safeguards 2.1, 2.3, 2.5, 3.1, 3.2, 3.3, 3.7, 3.13, 9.2, 9.3 and 9.4
Voluntary framework. Requires a software inventory (2.1), removal or documented exception for unauthorized software (2.3), allowlisting (2.5, IG2), a data management process, inventory and classification scheme (3.1, 3.2, 3.7), need-to-know access (3.3), DLP (3.13, IG3), DNS filtering on all end-user devices (9.2), URL filters for malicious or unapproved sites (9.3, IG2) and restriction of unauthorized browser extensions (9.4, IG2).
www.cisecurity.org/controls/cis-controls-navigator

Related insights

All insights

Six identical closed Dell laptops stacked neatly on a pale wood table.

CIS Controls

How to Write an AI Acceptable Use Policy Your Tools Can Enforce

An AI acceptable use policy that nothing enforces documents a control that does not exist. Here is how to write each rule against a CIS safeguard you can configure, so the policy produces its own evidence.

October 30, 20266 min read

Stacked client folders and printed returns beside a monitor at an empty workstation.

AccountingFTC Safeguards Rule

AI DLP for CPA firms: how to keep AI out of client portals and email

AI now arrives inside the tools CPA firms already use: portal summaries, inbox assistants, attachment previews and browser extensions. Here is a checklist for keeping client tax documents away from AI you have not approved.

October 30, 20265 min read

A professional office reception counter after hours, with a visitor check-in tablet asleep on its stand and dusk through the glass entry doors.

CCPA

AI data exposure and the California data breach notification law: is it a breach?

An employee pastes client data into a consumer AI chatbot. Is it a breach under the California data breach notification law? A walk-through of section 1798.82, the 30-day clock, Reg S-P overlap and the facts a firm needs to decide.