Which of the following CIS Controls is used to manage the security lifecycle by validating that the documented controls are in place?

CIS Control 18, "Penetration Tests and Red Team Exercises," is specifically designed to manage and improve the security lifecycle by actively testing and validating the effectiveness of an enterprise's security controls. This control simulates real-world attacker tactics, techniques, and procedures to measure how well the implemented security measures (technical, physical, and personnel) can detect and respond to an attack. The results provide direct feedback on control gaps and misconfigurations, thereby validating that documented controls are in place and functioning as intended.

A. Controlled Use of Administrative Privilege (CIS Control 6) is a preventive control focused on managing and limiting powerful accounts, not a process for validating all security controls.

B. Account Monitoring and Control (now part of CIS Control 5, Account Management) is an operational control for managing the lifecycle of user accounts, not a validation mechanism for the entire security program.

C. Data Protection (CIS Control 3) is a broad set of protective controls (e.g., encryption, access control) for securing data, not the method used to test and validate those or other controls.

---

1. Center for Internet Security (CIS). (2021). CIS Critical Security Controls v8.

Reference: Page 3, Control 18: Penetration Testing.

Quote/Paraphrase: The overview for Control 18 states its purpose is to "test the effectiveness of an organization’s security controls... by simulating the objectives and actions of an attacker." This directly aligns with the concept of validating that controls are in place and effective. In contrast, Controls 3, 5, and 6 are described as implementing specific safeguards, not testing the overall security posture.

2. Whitman, M. E., & Mattord, H. J. (2019). Principles of Information Security (6th ed.). Cengage Learning.

Reference: Chapter 12, "Security Maintenance," Section on "Vulnerability Assessment and Remediation," pp. 518-520.

Paraphrase: This university-level textbook explains that penetration testing is a primary method for assessing security controls. It is described as a set of security tests that "simulate attacks by a malicious external source" to find and demonstrate vulnerabilities. This process serves to validate the effectiveness of existing defensive controls and the organization's incident response capabilities, which is a core component of managing the security lifecycle.