CIS Controls

At minimum: the list of approved AI tools and the firm accounts staff must use, what data may and may not go into each tool, who has access, how use is logged and reviewed, and how staff request a new tool or an exception. Each rule is stronger when it names the technical control that enforces it, such as web filtering or DLP.

Check who publishes the plugin and whether its code is signed, what project data it sends off the workstation and to which AI provider, whether that provider trains on or retains the data, whether it uses firm-managed or personal accounts, and whether an administrator can disable it. Also check client agreements for confidentiality limits, and record the answers, the date and the version reviewed.

Through the SECURELOAD and TRUSTEDPATHS system variables. Autodesk recommends setting SECURELOAD to 1 or 2 to prevent unauthorized code from executing, keeping executable files in trusted, read-only folders separate from data, confirming third-party executables are digitally signed by a reputable issuer, and not running AutoCAD with administrator privileges. Set these through your deployment instead of on each machine.

An allowlist is the practical approach for firms handling client financial data. Chrome and Edge both support blocking all extensions except those the firm approves, with a request process for new ones. CIS Safeguard 9.4 calls for restricting unauthorized browser extensions. Approved extensions can still be kept off sensitive sites such as the CRM or custodian portals with the runtime_blocked_hosts setting.

Yes. In Microsoft Entra ID you can limit user consent so staff can only approve apps from verified publishers for low-impact permissions, and turn on the admin consent workflow so other requests go to an administrator. Revoking existing consents takes extra steps, so review current app permissions at the same time.

Yes. An extension with permission to read and change data on websites can see what appears on a page, including AI chat prompts and responses. OX Security reported in December 2025 that two look-alike AI sidebar extensions with about 900,000 combined users sent ChatGPT and DeepSeek conversations to an outside server. Firms can limit this with an extension allowlist and by blocking extensions from sensitive sites.

It lowers the risk but does not remove it. OpenAI, for example, says it does not train on business products such as ChatGPT Enterprise and the API by default, while consumer accounts may be used for training unless the user opts out. A firm-managed plan also lets the firm control retention and see usage. Attorneys still need to read the terms, and California's State Bar guidance says confidential client information should not go into any tool that lacks adequate confidentiality and security protections.

California's statute does not define it. In its 2016 Data Breach Report, the California Attorney General said the CIS Critical Security Controls define a minimum level of information security and that failing to implement the applicable controls constitutes a lack of reasonable security. The report is guidance rather than law. The CIS IG1 safeguards in this article come from the current version of those controls.

No. AI can draft and edit specification text, but California law requires specifications to be prepared under the responsible control of a licensed architect, or the responsible charge of a licensed civil engineer for civil work. The specifier's judgment about products, performance and coordination is what the stamp stands behind, so AI works as an assistant whose output a licensed professional reviews and accepts.

No. Under Cal. Civ. Code § 1798.150(b), a consumer seeking statutory damages must first give the business 30 days' written notice, and the business may cure the violation if a cure is possible. The statute also says that implementing and maintaining reasonable security after a breach does not constitute a cure for that breach, so the evidence has to exist before an incident.

Yes, in limited cases. Cal. Civ. Code § 1798.150 lets a consumer sue when nonencrypted and nonredacted personal information is stolen or disclosed because the business failed to maintain reasonable security. Statutory damages are currently $107 to $799 per consumer per incident, or actual damages if greater. The CCPA's GLBA exemption does not apply to this section, so financial firms are not carved out.

Yes, if the firm controls the account and the terms. A personal or free account is the wrong place for client facts, because consumer terms may let the provider keep or use what is typed. On a business plan with no-training and retention commitments, firm sign-in and logging, attorneys can use it for research, and every case and quotation still needs to be checked against the original source.

CIS Safeguard 1.1 lists the minimum fields: network address if static, hardware address, machine name, enterprise asset owner, department, and whether the asset has been approved to connect to the network. It should cover every device that can store or process data, including laptops, mobile devices, servers, network gear, IoT devices and cloud assets, whether in the office, at home or hosted.

CIS Safeguard 1.1 asks firms to review and update the inventory of all enterprise assets bi-annually, or more frequently. Safeguard 2.1 sets the same twice-a-year minimum for the software inventory. Two related IG1 safeguards run faster: unauthorized devices should be addressed weekly (1.2), and the software list should be checked for vendor support at least monthly (2.2).

Yes, if the decision is documented. CIS Safeguard 4.1 calls for a documented secure configuration process that includes any enterprise-approved deviations from baselines such as the CIS Benchmarks. Record the setting, the business reason, any compensating control, who approved it and when it will be reviewed again.

CIS describes the Level 1 profile as a base recommendation that can be implemented fairly promptly, and the Level 2 profile as defense in depth, intended for environments where security is paramount. Most small and midsize firms deploy Level 1 across all devices and apply Level 2 selectively, such as on administrator workstations, after testing for user impact.

Yes. CIS states that the CIS Benchmarks are free to download in PDF format. Paid CIS SecureSuite membership adds tools such as automated assessment, tailoring of recommendations and Build Kits that package settings as Group Policy objects. The free PDF is enough to read the recommendations and plan a baseline.

Only Safeguard 15.1 is in Implementation Group 1. It asks a firm to keep an inventory of all known service providers, with a classification and a named internal contact for each, reviewed annually or after significant changes. The policy, classification and contract safeguards (15.2 to 15.4) join at IG2, and assessment, monitoring and decommissioning (15.5 to 15.7) join at IG3.

No. Safeguard 15.5 says assessment scope may vary based on how a provider is classified. It lists SOC 2 reports and PCI Attestations of Compliance as examples, alongside customized questionnaires or other appropriately rigorous processes, and asks for reassessment at least annually or with new and renewed contracts. Most firms reserve SOC 2 review for their critical providers.

Four of the seven. Safeguard 7.1 calls for a documented vulnerability management process, 7.2 for a risk-based remediation process reviewed monthly or more often, and 7.3 and 7.4 for automated operating system and application patching at least monthly. The scanning and remediation safeguards, 7.5 to 7.7, begin at Implementation Group 2 in CIS Controls v8.1.

No law requires the CIS Controls by name. California's Civil Code section 1798.81.5 requires reasonable security without defining it, and the California Attorney General's 2016 data breach report said that not adopting the CIS Controls as the start of a security program would indicate a failure to provide reasonable security. Many firms use IG1 as a documented baseline for that reason.

No. The CIS Controls are voluntary. They are widely used as a benchmark for reasonable security, though: in its 2016 Data Breach Report, the California Attorney General said failing to implement the controls that apply to an organization's environment is a lack of reasonable security.

The CIS Controls are a prioritized set of security safeguards for a whole program, organized into 18 Controls and three Implementation Groups. The CIS Benchmarks are prescriptive configuration recommendations for specific products, such as operating systems, cloud services and network devices. Firms often use the Benchmarks to carry out the secure configuration safeguards in Control 4.

Implementation Group 1 is the set of 56 safeguards in CIS Controls v8.1 that the Center for Internet Security defines as essential cyber hygiene. It is the minimum every organization should meet, regardless of size.

CIS Safeguard 5.3 calls for deleting or disabling dormant accounts after 45 days of inactivity, where supported. It is part of Implementation Group 1, the baseline for small firms. Safeguard 5.1 adds a separate check that all active accounts are authorized at least quarterly, so firms need both a dormancy rule and an authorization review.

Implementation Group 1 contains 56 safeguards, which the Center for Internet Security calls essential cyber hygiene. They appear in 15 of the 18 CIS Controls and cover asset and software inventory, data protection, secure configuration, accounts and MFA, patching, logging, malware defense, backups, security awareness training, service provider inventory and incident reporting.

The three Implementation Groups are cumulative tiers of the CIS Controls. IG1 is the essential cyber hygiene baseline that CIS says every enterprise should start with. IG2 adds safeguards for organizations with more complex environments, multiple departments or more sensitive data, and IG3 adds safeguards for organizations facing sophisticated, targeted attacks or handling highly sensitive data.

Monthly or more often. In CIS Controls v8.1, Safeguard 7.3 calls for automated operating system updates and Safeguard 7.4 for automated application updates on a monthly, or more frequent, basis. Both apply to every Implementation Group. Safeguard 7.2 adds a risk-based remediation process, so urgent flaws can be handled faster than the monthly cycle.

Safeguard 2.2 says only currently supported software should be designated as authorized. If unsupported software is necessary for the business, the firm documents an exception with mitigating controls and residual risk acceptance. Otherwise it is treated as unauthorized and removed. CIS asks firms to check the software list for vendor support at least monthly.

In the Microsoft 365 admin center, open Active users, select the account and choose Convert to shared mailbox on the Mail tab. The mailbox needs a license to convert, and once it is under 50 GB you can remove that license. Microsoft notes the original username and password keep working after conversion, so block sign-in and keep the account, because it anchors the shared mailbox.

Yes, with the right license. Defender Vulnerability Management's browser extensions inventory lists extensions in Edge, Chrome and Firefox on Windows devices, with users, devices, permissions and a risk rating. It requires Defender Vulnerability Management Standalone or the add-on for Defender for Endpoint Plan 2. Chrome Enterprise Core, available at no additional cost, reports extensions on enrolled Chrome browsers, including Macs.

Yes. Endpoint DLP tools such as Microsoft Purview can classify content at the moment it is pasted into a browser and audit it, block it with an override, or block it outright. Rules apply to named groups of websites, so a firm can block pastes to public AI sites while allowing its approved tool. Separate rules cover file uploads.

Largely, yes. CIS lists DLP (Safeguard 3.13) in Implementation Group 3, but DNS filtering (9.2) is in IG1, and URL filtering (9.3) and browser extension restrictions (9.4) are in IG2. Blocking unapproved AI sites and requiring firm accounts on approved tools covers most of the policy. DLP adds control over what data reaches the approved tools.

Reading the last successful sign-in date through Microsoft Graph requires Microsoft Entra ID P1 or P2, according to Microsoft. Microsoft 365 Business Premium includes Entra ID P1. The property, lastSuccessfulSignInDateTime, has been recorded since December 1, 2023 and is not backfilled, so older inactivity cannot be measured with it.

Microsoft Entra ID keeps sign-in and audit logs for 7 days on the free tier and 30 days on Entra ID P1 or P2. If you want a longer history for a shadow AI review or an incident, export the logs or route them to Azure storage now, because upgrading later does not bring back older data.

Mostly, yes. Apps connected through Sign in with Microsoft or Google appear in the tenant's app consent records. Accounts created with an email and password leave welcome or verification messages that an Exchange Online message trace can find for up to 90 days. Card and expense records catch paid plans. Personal accounts on personal devices will not appear in any of these.

Yes. A detection script deployed through device management can list the Revit, AutoCAD and Rhino plugin folders on every machine and report back centrally. In Microsoft Intune this is a detection-only Remediations package, which requires Windows Enterprise E3 or E5, Education A3 or A5, or VDA licensing. Keep the output to plugin names, since Intune caps it at 2,048 characters.

Set an end date tied to the project schedule when access is granted. Microsoft recommends enforcing expiration on access packages for external users and keeping access to no longer than 365 days unless the project runs multiple years. Review remaining guests at least quarterly and disable accounts with no sign-in for 45 days, in line with CIS Safeguard 5.3.

Microsoft recommends assigning the Global Administrator role to fewer than five people, and the admin center shows an alert at five or more. Microsoft also recommends two cloud-only emergency access accounts permanently assigned the role, kept for when normal sign-in fails. Everyone else who does admin work can use a narrower built-in role such as User Administrator or Exchange Administrator.

It can be. ChatGPT counts as shadow AI when staff use it for work without the organization's approval, for example on a personal account. The same tool on an organization account your nonprofit approved, with clear rules on what data goes in, is sanctioned use. What changes is oversight.

Not necessarily. Microsoft states that audit logging is on by default for Microsoft 365 organizations, but that it is not enabled by default for Small and Medium Business licenses, including Business Basic, Business Standard and Business Premium. Microsoft says to verify the setting in Exchange Online PowerShell rather than assume it is on.

GOVERN, MAP, MEASURE and MANAGE. GOVERN sets the policies, roles and culture for AI risk and applies across the other three. MAP establishes context and identifies the risks of each AI system, MEASURE analyzes and tracks those risks, and MANAGE prioritizes and acts on them, including monitoring after deployment and handling incidents.

Keep the documents behind each answer: a board-approved security policy and incident response plan, an MFA enrollment report covering every account, backup reports with the date of the last restore test, training completion records, a vendor list showing who holds client or donor data, and a device inventory showing encryption. Keep a dated copy of every questionnaire you submit and who signed it.

Not for systems holding donor or client data. A shared login hides who did what, forces a password change every time someone leaves, and undermines multifactor authentication. Give each volunteer an individual account. For shared inboxes, use a shared mailbox with sign-in blocked, which people reach through their own accounts.

Treat it as an incident. The person reports it to the firm's designated contact right away, and the firm records what was shared, when, in which tool and under which account settings. Only then is the chat deleted and the account's retention and training settings changed. Whether the client must be told and whether privilege is affected are questions for the responsible partner and ethics counsel. Going forward, DLP rules can log, alert on or block these pastes, so the firm learns about the next one as it happens or stops it outright.

Disable access immediately when a volunteer's departure is known, as CIS Safeguard 6.2 describes. For volunteers who simply stop coming, CIS Safeguard 5.3 calls for disabling dormant accounts after 45 days of inactivity. A monthly report of accounts with no recent sign-in, reviewed by each volunteer's staff sponsor, catches both cases.

Yes. CIS Safeguard 6.3 calls for MFA on all externally exposed applications, which includes the Microsoft 365 sites guests use. Microsoft Entra cross-tenant access settings let a firm accept MFA a partner already completed in its own tenant, which avoids double prompts. By default those partner claims are not trusted, so guests are prompted under the firm's own policy.

The rule requires firms to implement and periodically review access controls but does not set a frequency. The firm decides based on its risk assessment and should write the schedule into its information security program. CIS Safeguard 5.1, a common benchmark, calls for validating that all active accounts are authorized at least quarterly.

CIS Safeguard 5.4 calls for restricting administrator privileges to dedicated administrator accounts and doing email, browsing and everyday productivity work from a non-privileged account. In Microsoft 365, that usually means each admin keeps a normal licensed account for daily work and a second cloud-only account, protected by MFA, that holds the admin role. A phishing email then reaches an account that cannot change tenant settings.

No. Microsoft's guidance is to always block sign-in for the account behind a shared mailbox and keep it blocked. People open the shared mailbox through their own accounts, which means their own password and multifactor authentication apply and every action traces to a named person. If staff know a password for info@ or a similar address, that account needs cleanup.

Usually not. Microsoft says a shared mailbox can store up to 50 GB without a license of its own, though each person who opens it needs their own licensed Exchange Online mailbox. A license is needed to raise the limit to 100 GB, to expand the archive, or to place the mailbox on litigation hold. Removing licenses from shared mailboxes that do not need them often frees seats.

No. Microsoft Entra sign-in logs show apps that use the firm's Microsoft identity to sign in. A tool registered with an email address and its own password never appears there, and a personal account on a home computer leaves no trace in firm systems at all. Pair sign-in data with a mail trace, spending records and a short staff survey.

Yes, if anyone at the firm uses AI tools with client drawings, pricing or project data. Without written rules, each person decides which tools see client files, and the firm cannot show a client what its standard was. A one-page firm-wide section plus a short page each for design, proposals and field teams is enough for most small firms.

Most AI acceptable use policies prohibit entering client, customer or other confidential data into unapproved tools, signing up for AI services with personal accounts, installing unapproved AI browser extensions, and sending AI-generated content to clients without the review the firm requires. Each prohibited use should map to a control, such as web filtering, DLP or extension restrictions, that blocks or flags it.

Often, for volunteers who only need Teams, SharePoint or shared files. A Microsoft Entra guest account lets a volunteer sign in with their own email address, keeps them separate from staff accounts, and can be set to expire on a schedule. A volunteer who needs to work in a shared mailbox needs a licensed Exchange Online mailbox instead.

Shadow AI is any AI tool used for work without the organization's approval or oversight. It includes chatbots on personal accounts, AI features switched on inside approved software, browser extensions, meeting notetakers and apps connected to a work account through a Microsoft or Google sign-in. Each one is a place organization data can go without anyone tracking it.

Specification writing is preparing the written technical requirements for a construction project: the materials, products, workmanship, testing and submittals the contractor must provide. Specifications sit alongside the drawings in the construction documents. In California, they are signed by the licensed architect in responsible control of them, or prepared under the responsible charge of a licensed civil engineer for civil work.

Revit reads .addin manifest files at startup from two folders: an all-users folder under C:\ProgramData\Autodesk\Revit\Addins and a per-user folder under the user's AppData\Roaming\Autodesk\Revit\Addins, each with a subfolder for the Revit version year. Each manifest names the file it loads and the vendor, so listing these folders gives a quick add-in inventory.

Usually not. Zero trust network access is typically delivered as a cloud service with a client app on each device and a small software connector inside your network. Microsoft, for example, documents its private network connector as an agent installed on Windows Server that makes only outbound connections. Costs move from appliances to per-user licensing.