--- question: "What are the 5 basic security controls?" title: "What Are the 5 Basic Security Controls" seoTitle: "The 5 Basic Security Controls, Explained" summary: "The five basic security controls are asset inventory, software inventory, secure configuration, vulnerability management, and control of administrative privileges. They come from the CIS Controls, where they were the original Quick Wins because they remove the largest share of practical risk for the least effort. The phrase is often confused with the five functions of the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover." publishedAt: "2026-08-18" keywords: - "5 basic security controls" - "five basic security controls" - "CIS basic controls" - "cybersecurity basics for startups" pillar: "SOC 2 Basics for Founders" faqs: - question: "What are the five basic security controls?" answer: "Asset inventory, software inventory, secure configuration of hardware and software, continuous vulnerability management, and controlled use of administrative privileges. They originate in the CIS Controls as the first and highest-value group." - question: "Are the 5 basic security controls the same as NIST's five functions?" answer: "No. NIST CSF's five functions (Identify, Protect, Detect, Respond, Recover) organise a whole security program at a high level. The five basic controls are specific, implementable safeguards. Both are commonly called the five, which is where the confusion comes from." - question: "Do these five satisfy SOC 2?" answer: "No, but they cover a meaningful portion of the Common Criteria, particularly CC6 logical access and CC7 operations. SOC 2 additionally requires policies, risk assessment, vendor management, incident response, and evidence that each control operated across the audit period." --- ## What are the 5 basic security controls? The five basic security controls are **asset inventory, software inventory, secure configuration, vulnerability management, and control of administrative privileges**. They come from the CIS Controls, where they were the original Quick Wins because they remove the largest share of practical attack paths for the least effort. The phrase is often confused with the five functions of the NIST Cybersecurity Framework, which are Identify, Protect, Detect, Respond, and Recover. ### The five, in implementation order 1. **Inventory of hardware assets.** Know every device that connects. You cannot protect or decommission what nothing tracks. 2. **Inventory of software assets.** Know what runs on them, which is what makes patching and license risk tractable. 3. **Secure configuration.** Systems deployed to a hardened baseline rather than vendor defaults. 4. **Continuous vulnerability management.** Scan, prioritise, and remediate on a schedule that is written down. 5. **Controlled use of administrative privileges.** Few admins, separate accounts for admin work, and a record of who has them. These come from the **CIS Controls**, where the first group was originally published as the Quick Wins on the argument that they remove a disproportionate share of real-world attack paths relative to the effort they take. ## The list they get confused with The other common answer to "the five" is the **NIST Cybersecurity Framework functions**: Identify, Protect, Detect, Respond, Recover. Both lists are widely called the five, and they operate at different levels. | | CIS basic controls | NIST CSF functions | |---|---|---| | What it is | Five specific safeguards | Five categories organising a program | | Granularity | Implementable this quarter | Structural | | Use it to | Decide what to do first | Explain coverage to a board or auditor | | Answers | "What should we actually deploy?" | "Do we have all the bases covered?" | If a question is about what to implement, the CIS list is the useful answer. If it is about how to organise or report a program, NIST CSF is. ## What they cover in a SOC 2 audit The five basic controls map mostly onto the Common Criteria for logical access (CC6) and system operations (CC7). Administrative privilege control and asset inventory in particular do real work against CC6.1, CC6.2, and CC6.3. They do not get you a SOC 2 report. Missing from the list entirely: written policies, risk assessment, vendor management, change management, incident response, and the governance criteria in CC1 through CC5. The larger gap is that SOC 2 Type II tests whether a control **operated throughout a period**, so an inventory that exists today and was not maintained for the preceding six months produces an exception rather than a pass. ## Where to start if you are starting Administrative privileges first. It is the cheapest of the five, it removes the most immediate risk, and it produces evidence an auditor will ask for anyway. Asset and software inventory next, because the remaining two depend on knowing what exists.