CIS Control 12 Network Infrastructure Management Guide

Routers, switches, firewalls, VPN gateways and wireless controllers are often the oldest, least monitored and most privileged assets on the network, and attackers know it. CIS Control 12 (Network Infrastructure Management) in CIS Controls v8.1 asks organisations to establish, implement and actively manage network devices so that attackers cannot exploit vulnerable network services and access points. This guide works through its eight Safeguards by Implementation Group, explains what each one requires in practice, gives an implementation order with test and rollback steps, and lists the evidence an assessor working from the CIS Controls Assessment Specification will ask for. It is written for network engineers, security architects and GRC teams preparing for a CIS self-assessment, a customer audit or an insurer questionnaire. For the framework as a whole, see the CIS Controls Guide; for wider network design, see the Network Security Guide.

Key takeaways

Only one Safeguard is IG1. Safeguard 12.1 (keep network infrastructure up to date, with software versions reviewed monthly or more often) applies to every organisation. Safeguards 12.2 to 12.7 are IG2, and 12.8 is IG3.
The monthly review is a hard test. The assessment specification fails 12.1 if more than 30 days have passed since network software versions were last reviewed, regardless of how current the devices actually are.
Diagrams are a dependency, not paperwork. Safeguard 12.4 (architecture diagrams, reviewed annually or after significant change) feeds 12.2, 12.3, 13.3 and 13.6. Without a current diagram you cannot enumerate segments or boundaries, so you cannot measure them.
Network devices are full of non-human credentials. SNMP community strings, TACACS+ and RADIUS shared secrets, local admin accounts, SSH keys and API tokens for network automation all sit inside Control 12, and the Salt Typhoon intrusions showed how far they reach when nobody rotates them.
Management is the attack surface. Centralised AAA (12.5), secure management protocols (12.6) and dedicated administrative resources with no internet access (12.8) protect the management plane, which is where most network device compromises start.

What it is and who it applies to

CIS describes Control 12 as establishing, implementing and actively managing (tracking, reporting and correcting) network devices, in order to prevent attackers from exploiting vulnerable network services and access points. "Network infrastructure" covers on-premises routers, switches, firewalls, load balancers, wireless controllers and access points, VPN concentrators, and the cloud equivalents: virtual networks, security groups, cloud firewalls, transit gateways and network-as-a-service offerings. Safeguard 12.1 names supported NaaS explicitly, so cloud networking is in scope, not an afterthought.

Control 12 is about the devices and the architecture. Control 13 (Network Monitoring and Defense) is about watching traffic and responding, and Control 4 covers secure configuration baselines, including Safeguard 4.2 for network infrastructure. Assessors usually look at 4.2, 12 and 13 together. See the CIS Control 13 Network Monitoring and Defense Guide and the CIS Control 4 Secure Configuration of Enterprise Assets and Software Guide.

IG1: CIS calls IG1 essential cyber hygiene. For Control 12 it is just 12.1. A small business with a firewall, a few switches and a cloud tenant must still know what firmware runs on them and check it monthly against vendor support status.
IG2: organisations with dedicated IT staff and regulated data add a documented secure architecture (12.2), secure management (12.3), diagrams (12.4), centralised network AAA (12.5), secure management and communication protocols (12.6) and VPN plus AAA for remote devices (12.7).
IG3: organisations facing sophisticated attackers add dedicated, segmented administrative computing resources without internet access (12.8).

CIS released v8.1 in June 2024. It added a Governance security function, revised asset classes, clarified Safeguard wording and realigned mappings to NIST CSF 2.0, but did not change any Implementation Group assignments. The Safeguard numbers, titles and IGs below are the same in v8 and v8.1. The asset type and security function columns are the values published in the CIS Controls Assessment Specification (v8); if you report those fields formally, take them from the v8.1 spreadsheet published by CIS.

Structure and key requirements

Safeguard	Title	IG	Asset type / function (v8)	What it requires
12.1	Ensure Network Infrastructure is Up-to-Date	IG1, IG2, IG3	Network / Protect	Run the latest stable release or currently supported NaaS; review software versions monthly or more often to verify support
12.2	Establish and Maintain a Secure Network Architecture	IG2, IG3	Network / Protect	A documented architecture that addresses segmentation, least privilege and availability at a minimum
12.3	Securely Manage Network Infrastructure	IG2, IG3	Network / Protect	Secure management, for example version-controlled infrastructure as code and secure protocols such as SSH and HTTPS
12.4	Establish and Maintain Architecture Diagram(s)	IG2, IG3	Network / Identify	Diagrams or other network documentation, reviewed annually or after significant enterprise change
12.5	Centralize Network Authentication, Authorization, and Auditing (AAA)	IG2, IG3	Network / Protect	Network device logins, authorisation and accounting run through central AAA services
12.6	Use of Secure Network Management and Communication Protocols	IG2, IG3	Network / Protect	Secure protocols, for example 802.1X and WPA2 Enterprise or greater
12.7	Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure	IG2, IG3	Devices / Protect	Users authenticate to enterprise-managed VPN and authentication services before reaching enterprise resources from end-user devices
12.8	Establish and Maintain Dedicated Computing Resources for All Administrative Work	IG3	Devices / Protect	Physically or logically separate resources for administrative tasks, segmented from the primary network and without internet access

Reading the Safeguards carefully

12.1 is about support, not just patches: the assessment compares each device's version with an authoritative source of the latest version. A device on a release the vendor no longer supports fails, even if it has every patch that release will ever get. Track end-of-sale and end-of-life dates in the asset inventory. See the Edge Device Security Guide.
12.2 is tested by trying to connect: the specification's operation for 12.2 is to attempt to connect an unauthorised device to each segment and to check that availability monitoring covers every segment. A segmentation diagram that does not stop a rogue laptop is not evidence. See the Network Segmentation Guide.
12.3 measures encryption and IaC separately: the specification counts devices using encrypted management sessions, segments managed by infrastructure as code, and whether that code is in version control.
12.5 includes consolidation: assessors count AAA services and ask which are unnecessary or could be consolidated, then count network devices not covered by any AAA system. A router with only local accounts is a direct gap.
12.6 covers both management and communication protocols: management means SSHv2, SNMPv3, HTTPS and NETCONF over SSH instead of Telnet, SNMPv1/v2c and HTTP; communication means 802.1X and WPA2 Enterprise or WPA3 Enterprise on the access layer. See the Wi-Fi Security Guide.
12.8 means no internet access: a privileged access workstation that can browse the web does not meet 12.8. The specification counts admin assets that are both separated from the primary network and blocked from the internet.

Protocol reference for 12.3 and 12.6

Function	Replace	With	Notes
CLI management	Telnet (TCP 23)	SSHv2 (TCP 22)	CISA, NSA and partners recommend SSHv2 only, with at least 3072-bit RSA keys; restrict VTY lines with ACLs
Monitoring	SNMPv1 and v2c community strings (UDP 161/162)	SNMPv3 with authentication and encryption	Restrict SNMP by ACL to the management network
Web management	HTTP (TCP 80)	HTTPS with a PKI certificate, or disable the web server	Prefer TLS 1.3; avoid self-signed certificates
File and config transfer	TFTP (UDP 69), FTP (TCP 21)	SCP or SFTP over SSH	Device configurations contain credentials and must not travel in clear text
Device administration AAA	Local accounts only	TACACS+ (TCP 49) or RADIUS (UDP 1812/1813) with MFA	Keep local accounts for emergency use; use strong password hashing types
Access layer	Open or pre-shared key wireless, open switch ports	802.1X with EAP-TLS, WPA2/WPA3 Enterprise	Port-level control is also CIS Safeguard 13.9 (IG3)

Identity and NHI requirements

Control 12 is not usually described as an identity control, but most of its Safeguards depend on how machines and administrators authenticate to network devices. Network gear holds a dense cluster of non-human credentials that rarely appear in an NHI inventory.

Credential	Where it lives	Safeguard	What good looks like
SNMP community strings	Device configs, monitoring platform	12.6	Removed in favour of SNMPv3 users; v3 credentials stored in a vault and rotated
TACACS+ and RADIUS shared secrets	Every device and the AAA server	12.5	Unique per device or device group, encrypted in config, rotated on a schedule and after any suspected compromise. See the RADIUS Security Guide.
Local emergency accounts	Each device	12.5	One per device, unique password in a vault, used only when AAA is unreachable, password changed after each use
Automation service accounts and API tokens	Ansible, Terraform, controllers, NaaS APIs	12.3	Owned, least privilege, short-lived where possible, never stored in the IaC repository. See the Infrastructure as Code Security Guide.
Device and 802.1X certificates	Switches, access points, endpoints	12.6	Issued from a managed PKI with inventory and renewal before expiry. See the Machine Identity, PKI and Certificate Lifecycle Guide.
VPN and directory bind accounts	VPN gateways, AAA proxies	12.7	Read-only directory access, monitored for use from anywhere other than the gateway

The joint CISA, NSA, FBI and Five Eyes guidance on communications infrastructure (December 2024) adds two identity points worth adopting into your 12.5 narrative: use phishing-resistant MFA for administrative access, and run network AAA on a server separate from the primary corporate identity store, so that a compromise of the corporate directory does not hand over the network too. Record how each automation account authenticates and who owns it. See the Service Account Security Guide.

Implementation steps

Inventory network assets (weeks 1 to 2): from the Control 1 inventory, list every network device and cloud network service with model, software version, management IP, owner and vendor support dates. See the CIS Control 1 Inventory and Control of Enterprise Assets Guide.
Start the monthly version review (12.1, from week 2): compare each device against vendor advisories and the recommended release, record the review date, and raise changes for anything unsupported or vulnerable. Prioritise internet-facing devices and anything on the CISA Known Exploited Vulnerabilities catalogue. Test upgrades on a lab or low-risk device, keep the previous image and configuration for rollback, and verify image hashes against the vendor's published values before installing.
Draw and date the diagrams (12.4, weeks 2 to 6): physical and logical topology, segments and VLANs, trust boundaries, internet and cloud connections, management network and data flows. Set an annual review and a trigger for significant change.
Lock down management (12.3, 12.6, weeks 4 to 10): disable Telnet, HTTP, SNMPv1/v2c, TFTP and unused discovery and legacy features (for example Cisco Smart Install); enforce SSHv2 and SNMPv3; restrict management to a management VLAN or out-of-band network with ACLs. Apply changes by device class, starting with a pilot site, and keep console access available as the rollback path.
Centralise AAA (12.5, weeks 6 to 12): point every device at TACACS+ or RADIUS with command authorisation and accounting enabled, enforce MFA for administrators, reduce local accounts to one emergency account per device, and consolidate duplicate AAA servers left from acquisitions. Configure fallback to the local account only when AAA is unreachable, and test that fallback before enforcing.
Move configuration into code (12.3, weeks 8 onwards): store golden configurations in version control, deploy through a pipeline with peer review, and compare running configurations against the repository on a schedule. Rollback becomes a revert and redeploy.
Write the secure architecture (12.2) and secure remote access (12.7): document segments, permitted flows and availability design (redundant links, monitoring of every segment), then verify by connecting an unauthorised device to each segment. Require remote devices to authenticate to an enterprise-managed VPN or ZTNA service backed by central AAA. See the VPN Security Guide and the ZTNA Guide.
Build dedicated admin resources (12.8, IG3): privileged access workstations or a hardened jump environment on an isolated admin segment, with no internet access and no email or browsing, as the only source allowed by management ACLs.

Small versus large organisations

Small (IG1): a managed firewall and cloud-managed switches and Wi-Fi often satisfy 12.1 if the provider keeps firmware current; you still need a dated monthly record that someone checked.
Large (IG2/IG3): the effort sits in coverage and drift across thousands of devices, several vendors and cloud accounts. Invest in automation for 12.1 version checks, IaC for 12.3 and a single AAA plane for 12.5.

Evidence and assessment

The CIS Controls Assessment Specification defines inputs, operations and measures for each Safeguard, and assessors using it, or the CIS Controls Self Assessment Tool (CSAT), expect counts and dates.

Safeguard	Evidence an assessor expects	Measure to report
12.1	Network asset list with versions; authoritative latest-version source; dated monthly review record	Devices up to date versus not; days since last review (fails above 30)
12.2	Architecture document covering segmentation, least privilege and availability; results of unauthorised device connection tests	Segments that refuse unauthorised devices; segments covered by availability monitoring
12.3	Configuration standard; exports showing SSH/HTTPS only; IaC repository and commit history	Devices using encrypted sessions; segments managed by version-controlled IaC
12.4	Current diagrams with review date and change triggers	Documentation exists; months since last review (fails above 12)
12.5	List of AAA services; device AAA configuration; accounting logs	Network devices covered by AAA versus not; AAA services that could be consolidated
12.6	Authorised protocol list; config audit per segment; wireless and 802.1X settings	Segments using only authorised, correctly configured protocols
12.7	VPN configuration requiring authentication; remote asset list; AAA configuration	Remote assets covered by VPN; VPN and AAA services requiring authentication before access
12.8	Admin asset list; network ACLs and proxy rules showing no internet access; segmentation evidence	Admin assets both separated and without internet access

Monitoring and KPIs

Supported version coverage: percentage of network devices on a vendor-supported, current release (target 100 per cent, exceptions with expiry).
Critical advisory latency: days from a vendor critical advisory or KEV listing to remediation or mitigation on affected devices.
AAA coverage: percentage of network devices whose administrative logins go through central AAA with MFA.
Insecure protocol count: devices with Telnet, HTTP, SNMPv1/v2c or TFTP enabled, trending to zero.
Configuration drift: devices whose running configuration differs from the version-controlled baseline, and mean time to reconcile.

Log to the SIEM every AAA failure, local account login, configuration change, new local account, AAA server change and SSH key addition on network devices. See the Log Management and Retention Guide.

Mapping to other frameworks

Safeguards	NIST CSF 2.0	NIST SP 800-53 Rev 5	ISO/IEC 27001:2022 Annex A	ATT&CK techniques reduced
12.1	PR.PS-02	SI-2, SA-22	A.8.8 Management of technical vulnerabilities	T1190 Exploit Public-Facing Application
12.2, 12.4	PR.IR-01, ID.AM-03	SC-7, AC-4	A.8.20 Networks security, A.8.22 Segregation of networks	T1021 Remote Services, T1599 Network Boundary Bridging
12.3, 12.6	PR.PS-01	CM-2, CM-7, SC-8, AC-18	A.8.9 Configuration management, A.8.21 Security of network services	T1040 Network Sniffing, T1557 Adversary-in-the-Middle, T1601 Modify System Image
12.5	PR.AA-05	IA-3, AC-17	A.8.5 Secure authentication	T1078 Valid Accounts, T1556.004 Network Device Authentication
12.7	PR.IR-01	AC-17	A.6.7 Remote working	T1133 External Remote Services
12.8	PR.IR-01	SC-7(13), MA-4	A.8.2 Privileged access rights	T1078 Valid Accounts

CIS publishes official mappings from v8.1 to CSF 2.0 and other frameworks; use those for a formal crosswalk and treat this table as a working guide. For rule-level firewall governance see the Firewall Management Guide.

Common pitfalls

Unrotated device secrets: in the Salt Typhoon telecom intrusions, Cisco Talos found attackers mostly used valid credentials, pulled device configurations over TFTP and FTP, recovered SNMP strings and weakly encrypted local passwords from them, and captured TACACS+ and RADIUS secrets. Every one of those is a 12.5 or 12.6 gap.
Legacy features left on: the one exception in that campaign was likely CVE-2018-0171 in Cisco Smart Install, a feature joint guidance says to disable. Version currency (12.1) does not help if unneeded services stay enabled.
Edge appliances treated as set and forget: VPN and firewall appliances are exposed to the internet and often lag on firmware. The Ivanti Connect Secure exploitation showed how quickly a gateway flaw becomes credential theft.
Diagrams nobody maintains: a diagram from a previous refresh fails 12.4 at 12 months and silently breaks every Control 13 boundary measurement that depends on it.
Admin workstations with a browser: jump hosts that can reach the internet or receive email defeat 12.8 and give phishing a direct path to network administration.
AAA with a permanent local fallback: local accounts with shared, never changed passwords remain the real way in, and their use is not logged centrally.

Practitioner checklist

Confirm your Implementation Group and which Control 12 Safeguards apply.
Hold a network asset list with software version and vendor support dates, and record a dated version review every month (12.1).
Date your architecture diagrams and set annual and change-driven review triggers (12.4).
Test each segment by connecting an unauthorised device and record the result (12.2).
Remove Telnet, HTTP, SNMPv1/v2c, TFTP and unused legacy features from every device (12.3, 12.6).
Route all device administration through central AAA with MFA, and limit local accounts to vaulted emergency use (12.5).
Inventory and rotate SNMPv3 credentials, AAA shared secrets, automation tokens and device certificates as non-human identities.
Store golden configurations in version control and alert on drift (12.3).
Require enterprise VPN or ZTNA with central authentication for remote devices (12.7).
For IG3, restrict network management to dedicated admin resources with no internet access (12.8).

CIS Control 12 Network Infrastructure Management Guide: Safeguards, Implementation Groups and Evidence