[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Free CIS Controls 7.1 Security Questionnaire Template](/blog/cis-controls-7-1-security-questionnaire-template) Publish date June 29, 2025 {x} minute read # Free CIS Controls 7.1 Security Questionnaire Template [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-third-party-risk-management) [Free trial](/demo) Written by [Leah Sadoian](/team/leah-sadoian) Content Writer Leah is an experienced cybersecurity writer. Her work is read by leaders in security, tech, education, healthcare, and government. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) [The CIS Controls 7.1,](https://www.cisecurity.org/controls/v7) also known as CIS critical security controls, are a set of best practices designed by the[ Center for Internet Security](https://www.cisecurity.org/) to help organizations automate their defenses and mitigate prevalent[ cyber-attacks](https://www.upguard.com/blog/cyber-attack). Recognized for their effectiveness and practicality in[ information security](https://www.upguard.com/blog/information-security) and across operating systems, these controls cover a broad spectrum of[ cybersecurity](https://www.upguard.com/blog/cyber-security) strategies for various organizations and entities. This blog post will start by exploring CIS Controls 7.1 and provide a free[ security questionnaire](https://www.upguard.com/blog/security-questionnaire) template for organizations to assess compliance with these benchmarks. This template can be customized to any specific needs, including security requirements and security standards, and is also used to evaluate the[ cybersecurity posture](https://www.upguard.com/blog/security-posture) of third parties, ensuring[ cyber hygiene](https://www.upguard.com/blog/cyber-hygiene) and reducing[ security risk.](https://www.upguard.com/blog/cybersecurity-risk) ## What are the CIS Controls 7.1? Introduced in 2019 by the Center for Internet Security (CIS),[ CIS Controls 7.1](https://www.upguard.com/blog/cis-controls) is an updated set of[ best cybersecurity practices](https://www.upguard.com/blog/reduce-cybersecurity-risk). These controls, including various sub-controls, provide organizations with a scalable framework for cyber defense and align with different[ regulatory standards](https://www.upguard.com/blog/regulation-vs-cyber-framework). Implementing the CIS Controls also provides a pathway to compliance with other cybersecurity frameworks such as the[ NIST cybersecurity framework](https://www.upguard.com/blog/nist-cybersecurity-framework),[ PCI DSS](https://www.upguard.com/glossary/pci-dss),[ ISO 27001](https://www.upguard.com/glossary/iso-iec-27001), and[ NIST SP 800-53](https://www.upguard.com/blog/nist-sp-800-53). Additionally, CIS provides a self-assessment tool called CIS CSAT, which helps security leaders track their implementation. The latest version, 7.1, addresses the evolving digital landscape and the increasing complexity of cyber threats like[ ransomware](https://www.upguard.com/blog/ransomware-examples). The controls are categorized into three tiers: Basic, Foundational, and Organizational Controls, and include 20 different security controls, each addressing a distinct level of security maturity and operational complexity. ### Basic Controls Basic Controls are essential for establishing a foundation in asset inventory, configuration management, and patch management. They are the cornerstone of any[ cybersecurity program](https://www.upguard.com/blog/cybersecurity-important), focusing on[ endpoint security](https://www.upguard.com/blog/endpoint-detection-and-response) and[ incident handling](https://www.upguard.com/blog/incident-response-plan). These controls address aspects like identifying hardware and software on the network and ensuring secure configurations. By implementing these controls, an organization can establish a robust foundation for its cybersecurity strategy, covering the most critical and frequently exploited security gaps. Included in this category are: * Inventory and Control of Hardware Assets * Inventory and Control of Software Assets * Continuous[ Vulnerability Management](https://www.upguard.com/blog/vulnerability-management) * Controlled Use of[ Administrative Privileges](https://www.upguard.com/blog/access-control) * Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers * Maintenance, Monitoring, and Analysis of Audit Logs ### Foundational Controls: Organizations that have successfully implemented Basic Controls focus on prioritizing Foundational Controls. Foundational Controls provide a deeper layer of security against more complex[ vulnerabilities](https://www.upguard.com/blog/vulnerability), including strategies like[ web application protection](https://www.upguard.com/blog/the-website-security-checklist),[ data recovery](https://www.upguard.com/blog/disaster-recovery-plan) capabilities, and[ malware defense](https://www.upguard.com/blog/malware). By implementing Foundational Controls, organizations can fortify their defenses beyond the basics and establish a more comprehensive and[ resilient cybersecurity framework](https://www.upguard.com/blog/cyber-resilience). This category includes the following controls: * Email and Web Browser Protections * [Malware](https://www.upguard.com/blog/malware) Defenses * Limitation and Control of Network Ports, Protocols, and Services * [Data Recovery](https://www.upguard.com/blog/disaster-recovery-plan) Capabilities * Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches * Boundary Defense * [Data Protection](https://www.upguard.com/blog/data-security) * Controlled Access Based on the Need to Know * Wireless[ Access Control](https://www.upguard.com/blog/access-control) * Account Monitoring and Control ### Organizational Controls Organizational Controls emphasize the human and procedural factors in[ cybersecurity](https://www.upguard.com/blog/cybersecurity-fields), integrating technology-based defenses with security program considerations and[ cyber hygiene](https://www.upguard.com/blog/cyber-hygiene) practices. These controls recognize that well-informed, prepared individuals and well-designed organizational processes must complement technology-based defenses. They emphasize[ security awareness training](https://www.upguard.com/blog/developing-a-culture-of-cybersecurity),[ incident handling](https://www.upguard.com/blog/cybersecurity-triage), and regular testing like[ penetration tests](https://www.upguard.com/blog/penetration-testing). These controls are essential for creating[ a security-conscious culture](https://www.upguard.com/blog/developing-a-culture-of-cybersecurity) within the organization, ensuring that personnel integrate security practices into every level of the organization's operations and decision-making processes. Included in this category are: * Implementing a Security Awareness and Training Program * Application Software Security * Incident Response and Management * Penetration Tests and Red Team Exercises ## CIS Controls 8 In 2021,[ CIS Controls 8](https://www.cisecurity.org/controls/v8) introduced changes reflecting the modern digital ecosystem and modules for[ multi-factor authentication](https://www.upguard.com/blog/mfa-multi-factor-authentication). Most notably, CIS 8 reduced the total controls from 20 to 18 by merging similar topics and added[ Service Provider Management](https://www.upguard.com/blog/evaluating-managing-service-provider-security-risks), which focuses on[ cloud computing](https://www.upguard.com/blog/cloud-misconfiguration),[ supply chain security](https://www.upguard.com/blog/supply-chain-resilience), and[ software-as-a-service](https://www.upguard.com/blog/saas-security-risks). ## CIS Controls 7.1 Security Questionnaire The following[ security questionnaire](https://www.upguard.com/blog/security-questionnaire) is an assessment tool designed to check an organization's implementation of the CIS controls and the effectiveness of its safeguards. Organizations can map this self-assessment and validation tool to fit specific needs, including[ security policies](https://www.upguard.com/blog/information-security-policy), mitigation strategies, and[ risk management](https://www.upguard.com/blog/coso-erm-framework) goals. ### Basic Controls **Inventory and Control of Hardware Assets** Do you maintain a complete and updated inventory of all hardware devices? * Yes * No * \[Open Field] Are unauthorized devices automatically detected and prevented from accessing the network? * Yes * No * \[Open Field] Is there a process to regularly review and validate the hardware inventory? * Yes * No * \[Open Field] **Inventory and Control of Software Assets** Is there an up-to-date inventory of all installed software? * Yes * No * \[Open Field] Are unauthorized software installations detected and resolved promptly? * Yes * No * \[Open Field] Do you regularly review and validate the software inventory for compliance? * Yes * No * \[Open Field] **Continuous Vulnerability Management** Do you conduct regular vulnerability scanning on all systems? * Yes * No * \[Open Field] Is there a process for timely remediation of identified vulnerabilities? * Yes * No * \[Open Field] Are vulnerability scan reports reviewed and acted upon regularly? * Yes * No * \[Open Field] **Controlled Use of Administrative Privileges** Are administrative privileges granted only based on roles and responsibilities? * Yes * No * \[Open Field] Do you track and audit the use of administrative privileges? * Yes * No * \[Open Field] Is there a process to revoke administrative privileges when they are no longer required? * Yes * No * \[Open Field] **Secure Configuration for Hardware and Software** Are secure configurations applied to all hardware and software upon installation? * Yes * No * \[Open Field] Do you regularly update and validate secure configurations? * Yes * No * \[Open Field] Are deviations from secure configurations detected and corrected promptly? * Yes * No * \[Open Field] ### Foundational Controls **Email and Web Browser Protections** Do you have mechanisms to filter out malicious email and web content? * Yes * No * \[Open Field] Are email and web browser security settings configured and regularly updated? * Yes * No * \[Open Field] Do you regularly train employees on email and web security best practices? * Yes * No * \[Open Field] **Malware Defenses** Is anti-malware software installed and active on all systems? * Yes * No * \[Open Field] Are anti-malware definitions updated regularly? * Yes * No * \[Open Field] Do you regularly review and respond to anti-malware alerts? * Yes * No * \[Open Field] **Limitation and Control of Network Ports, Protocols, and Services** Are unnecessary network ports, protocols, and services disabled on all systems? * Yes * No * \[Open Field] Is there a process to regularly review and validate network port, protocol, and service configurations? * Yes * No * \[Open Field] Do you monitor and log network port, protocol, and service activities? * Yes * No * \[Open Field] **Data Recovery Capabilities** Do you have a data backup and recovery plan in place? * Yes * No * \[Open Field] Are backups tested regularly to ensure they can be restored? * Yes * No * \[Open Field] Is backup data stored in a separate and secure location? * Yes * No * \[Open Field] **Secure Configuration for Network Devices** Are secure configurations applied to network devices such as firewalls, routers, and switches? * Yes * No * \[Open Field] Do you regularly review and update network device configurations? * Yes * No * \[Open Field] Are changes to network device configurations logged and audited? * Yes * No * \[Open Field] **Boundary Defense** Do you have perimeter defenses (e.g., firewalls, intrusion detection systems)? * Yes * No * \[Open Field] Are inbound and outbound network traffic monitored for suspicious activities? * Yes * No * \[Open Field] Do you regularly update and test the effectiveness of boundary defenses? * Yes * No * \[Open Field] **Data Protection** Is sensitive data identified and classified? * Yes * No * \[Open Field] Are controls in place to prevent unauthorized access to sensitive data? * Yes * No * \[Open Field] Is data encrypted during transit and at rest? * Yes * No * \[Open Field] **Controlled Access Based on the Need to Know** Is access to sensitive information restricted based on a need-to-know basis? * Yes * No * \[Open Field] Are access controls reviewed and updated regularly? * Yes * No * \[Open Field] Do you maintain logs of access to sensitive information? * Yes * No * \[Open Field] **Wireless Access Control** Are wireless networks secured and encrypted? * Yes * No * \[Open Field] Do you monitor and control wireless network access? * Yes * No * \[Open Field] Are unauthorized wireless access points detected and disabled? * Yes * No * \[Open Field] **Account Monitoring and Control** Are user accounts regularly reviewed for necessary permissions? * Yes * No * \[Open Field] Are inactive accounts disabled promptly? * Yes * No * \[Open Field] Do you monitor and log account activity, especially for privileged accounts? * Yes * No * \[Open Field] ### Organizational Controls **Implement a Security Awareness and Training Program** Do you have a formal security awareness training program for all employees? * Yes * No * \[Open Field] Is security training conducted regularly and updated to address new threats? * Yes * No * \[Open Field] Do you test employee awareness, for example, through phishing simulations? * Yes * No * \[Open Field] **Application Software Security** Are security practices integrated into your software development lifecycle? * Yes * No * \[Open Field] Do you conduct regular security testing of applications? * Yes * No * \[Open Field] Are application security incidents logged and analyzed? * Yes * No * \[Open Field] **Incident Response and Management** Do you have an incident response plan? * Yes * No * \[Open Field] Is the incident response plan regularly tested and updated? * Yes * No * \[Open Field] Are all employees trained on their roles in the incident response plan? * Yes * No * \[Open Field] **Penetration Tests and Red Team Exercises** Do you conduct regular penetration tests to evaluate security? * Yes * No * \[Open Field] Are results from penetration tests used to improve security measures? * Yes * No * \[Open Field] Do you employ red team exercises to simulate real-world attacks? * Yes * No * \[Open Field] ## Enhance Your Organization’s Cybersecurity Posture with UpGuard The CIS Controls 7.1 is the perfect foundation for a strong[ cybersecurity posture](https://www.upguard.com/blog/security-posture), but if your organization wants to take a step further, UpGuard is here to help. Our all-in-one[ external attack surface management platform](https://www.upguard.com/blog/what-is-external-attack-surface-management), Breach Risk, has everything you need to comprehensively manage your cybersecurity efforts, from risk identification to remediation and beyond. [Breach Risk](https://www.upguard.com/product/breach-risk) helps you understand the risks impacting your external security posture and ensures your assets are constantly monitored and protected. Our user-friendly platform makes it easy to view your organization’s cybersecurity at a glance and communicate internally about risks, vulnerabilities, or current security incidents. Other features include: * **Data Leak Detection:** Protect your brand, intellectual property, and customer data with timely detection of data leaks and avoid data breaches * **Continuous Monitoring:** Analysis tools provide real-time information and manage exposures, including domains, IPs, and employee credentials * **Attack Surface Reduction:** Reduce your attack surface by discovering exploitable vulnerabilities and domains at risk of typosquatting * **Shared Security Profile:** Eliminate having to answer security questionnaires by creating an UpGuard Trust Page * **Workflows and Waivers:** Simplify and accelerate how you remediate issues, waive risks, and respond to security queries * **Reporting and Insights:** Access tailor-made reports for different stakeholders and view information about your external attack surface eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)