SOC 2 Basics for Founders
What are the 5 basic security controls?
What are the 5 basic security controls?
The five basic security controls are asset inventory, software inventory, secure configuration, vulnerability management, and control of administrative privileges. They come from the CIS Controls, where they were the original Quick Wins because they remove the largest share of practical attack paths for the least effort. The phrase is often confused with the five functions of the NIST Cybersecurity Framework, which are Identify, Protect, Detect, Respond, and Recover.
The five, in implementation order
- Inventory of hardware assets. Know every device that connects. You cannot protect or decommission what nothing tracks.
- Inventory of software assets. Know what runs on them, which is what makes patching and license risk tractable.
- Secure configuration. Systems deployed to a hardened baseline rather than vendor defaults.
- Continuous vulnerability management. Scan, prioritise, and remediate on a schedule that is written down.
- Controlled use of administrative privileges. Few admins, separate accounts for admin work, and a record of who has them.
These come from the CIS Controls, where the first group was originally published as the Quick Wins on the argument that they remove a disproportionate share of real-world attack paths relative to the effort they take.
The list they get confused with
The other common answer to "the five" is the NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, Recover. Both lists are widely called the five, and they operate at different levels.
| CIS basic controls | NIST CSF functions | |
|---|---|---|
| What it is | Five specific safeguards | Five categories organising a program |
| Granularity | Implementable this quarter | Structural |
| Use it to | Decide what to do first | Explain coverage to a board or auditor |
| Answers | "What should we actually deploy?" | "Do we have all the bases covered?" |
If a question is about what to implement, the CIS list is the useful answer. If it is about how to organise or report a program, NIST CSF is.
What they cover in a SOC 2 audit
The five basic controls map mostly onto the Common Criteria for logical access (CC6) and system operations (CC7). Administrative privilege control and asset inventory in particular do real work against CC6.1, CC6.2, and CC6.3.
They do not get you a SOC 2 report. Missing from the list entirely: written policies, risk assessment, vendor management, change management, incident response, and the governance criteria in CC1 through CC5. The larger gap is that SOC 2 Type II tests whether a control operated throughout a period, so an inventory that exists today and was not maintained for the preceding six months produces an exception rather than a pass.
Where to start if you are starting
Administrative privileges first. It is the cheapest of the five, it removes the most immediate risk, and it produces evidence an auditor will ask for anyway. Asset and software inventory next, because the remaining two depend on knowing what exists.