12.1
IG1 IG2 IG3

Ensure Network Infrastructure is Up>to>Date

Asset Type: Network
Security Function: Protect

Description

Ensure network infrastructure is kept up-to-date. Example implementations include running the latest stable release of software and/or using currently supported network-as-a-service (NaaS) offerings. Review software versions monthly, or more frequently, to verify software support.

Implementation Checklist

1
Assess current protection controls in place
2
Configure and deploy required security controls
3
Test control effectiveness in non-production environment
4
Deploy to production and verify functionality
5
Document configuration and operational procedures

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Exploitation of Unpatched Network Device Firmware

Confidentiality

Attackers exploit known vulnerabilities in outdated router, switch, and firewall firmware (such as CVEs in Cisco IOS, Fortinet FortiOS, or Palo Alto PAN-OS) to gain control of network infrastructure and intercept, redirect, or disrupt all traffic flowing through compromised devices.

Network Device Compromise via End-of-Life Software

Integrity

Network infrastructure running end-of-life firmware that no longer receives security patches accumulates exploitable vulnerabilities, and attackers who compromise these devices gain persistent network-level access that is difficult to detect and remediate.

Service Disruption from Unsupported Network Equipment Failure

Availability

Network devices running unsupported software experience stability issues and crashes that cannot be resolved because vendor support has ended, causing unpredictable network outages that affect business operations.

Vulnerabilities (When Safeguard Absent)

Outdated Network Device Firmware Without Update Schedule

Routers, switches, firewalls, and other network devices run firmware versions that are months or years behind current releases, containing known and publicly documented vulnerabilities with no scheduled update cadence.

No Network Infrastructure Software Version Tracking

The organization does not maintain an inventory of network device software versions or track them against vendor support timelines, making it impossible to identify devices running unsupported or vulnerable firmware.

Evidence Requirements

Type Evidence Item Collection Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually