All frameworks Global

CIS Critical Security Controls v8

Prioritized set of cybersecurity best practices. Three implementation groups mapped to organization size. Widely used as a practical baseline independent of regulatory requirement.

All organizations, security teams, SMBs

14

control domains mapped

49

products applicable

11

other frameworks cross-mapped

CIS Critical Security Controls v8

CIS-6.3 Require MFA for externally-exposed applications

Phishing-resistant MFA using hardware security keys. Software TOTP and SMS are explicitly excluded from "phishing-resistant" in NIST 800-63B and most modern framework guidance.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Amazon affiliate YubiKey Developer board Nitrokey 3A NFC Hacker $100

Same control in other frameworks:

NIST 800-53 IA-2(6) NIST CSF 2.0 PR.AA-03 ISO 27001 A.8.5 SOC 2 CC6.1 NIS2 Art.21(2)(i) CMMC 2.0 IA.L2-3.5.3 PCI DSS 4.0.1 8.4.2 HIPAA Security Rule §164.312(d) DORA Art. 9(4)(d) Essential Eight E8-MFA Cyber Essentials CE-4

CIS-3.11 Encrypt sensitive data at rest

Hardware-bound key generation and storage. Private keys generated and stored inside a certified secure element (EAL 6+) and are non-exportable by design — for login credentials (Nitrokey) and crypto-asset custody (Ledger) alike.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Hardware wallet Ledger Stax $399 Hardware wallet Ledger Flex $249 Hardware wallet Ledger Nano Gen5 $179 Hardware wallet Ledger Nano X $99 Hardware wallet Ledger Nano S Plus $59 Security key Nitrokey Pro 2 $135 Security key Nitrokey Start $60 Developer board Nitrokey 3A NFC Hacker $100 Amazon affiliate YubiKey

Same control in other frameworks:

NIST 800-53 SC-12 NIST CSF 2.0 PR.DS-02 ISO 27001 A.8.24 SOC 2 CC6.1 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.10 PCI DSS 4.0.1 3.7.1 HIPAA Security Rule §164.312(a)(2)(iv) DORA Art. 9(4)(d)

CIS-4.4 Use unique passwords and MFA for all admin access

Hardened mobile OS with per-app sensor controls, verified boot, and no background telemetry. Satisfies mobile device management and bring-your-own-device security requirements.

Products that satisfy this control:

Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Hardened phone NitroPhone 10a $810 Privacy smartphone NovaCustom PrivacyGuard SHIFTphone 8.1 $889 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 AC-19 NIST CSF 2.0 PR.AC-3 ISO 27001 A.8.1 SOC 2 CC6.8 NIS2 Art.21(2)(e) CMMC 2.0 AC.L2-3.1.18 PCI DSS 4.0.1 1.5.1 HIPAA Security Rule §164.310(d)(1) Cyber Essentials CE-2

CIS-2.3 Address unauthorized software

Measured boot chain verified on every power-on. Any firmware modification — supply chain implant, evil-maid attack, or malicious update — fails attestation before the OS loads.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure desktop NitroPC 2 $1,085 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 SI-7 NIST CSF 2.0 DE.CM-09 ISO 27001 A.8.8 SOC 2 CC7.1 NIS2 Art.21(2)(e) CMMC 2.0 SI.L2-3.14.6 PCI DSS 4.0.1 11.5.2 HIPAA Security Rule §164.312(c)(1) DORA Art. 9(2) Cyber Essentials CE-2

CIS-12.2 Establish and maintain a secure network architecture

VM-level compartmentalization means a compromise of one domain (e.g. browser) cannot reach another (e.g. keys, vault). No other consumer laptop provides this by default.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Secure desktop NitroPC 2 $1,085

Same control in other frameworks:

NIST 800-53 SC-3 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.6 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.3 PCI DSS 4.0.1 2.2.1 HIPAA Security Rule §164.312(a)(1) DORA Art. 9(4)(c)

CIS-12.3 Securely manage network infrastructure

Stateful firewall with IPS at the network perimeter. All inbound/outbound traffic inspected with Suricata rule sets. VPN gateway replaces consumer VPN dependency.

Products that satisfy this control:

Network security NitroWall V1410 $835 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Network Network appliances DIY Raspberry Pi builds

Same control in other frameworks:

NIST 800-53 SC-7 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.7 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.1 PCI DSS 4.0.1 1.4.1 HIPAA Security Rule §164.312(e)(1) DORA Art. 9(4)(b) Cyber Essentials CE-1

CIS-3.11 Encrypt sensitive data at rest

Hardware-encrypted storage and self-hosted file servers replace cloud storage with hardware you control. Encryption keys never leave your environment.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure storage NextBox NAS $450 Hardware security module Nitrokey HSM 2 $135 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure storage Nitrokey Storage 2 (64 GB) $250 Secure desktop NitroPC 2 $1,085

Same control in other frameworks:

NIST 800-53 SC-28 NIST CSF 2.0 PR.DS-01 ISO 27001 A.8.24 SOC 2 CC6.1 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.16 PCI DSS 4.0.1 3.5.1 HIPAA Security Rule §164.312(a)(2)(iv) DORA Art. 9(2)

CIS-15.1 Establish and maintain an inventory of service providers

Open-source firmware is publicly auditable and reproducibly built. EU jurisdiction hardware is not subject to US National Security Letters. Directly addresses hardware supply chain risk in CMMC and NIS2.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Security key Nitrokey Pro 2 $135 Security key Nitrokey Start $60 Developer board Nitrokey 3A NFC Hacker $100 Secure storage Nitrokey Storage 2 (64 GB) $250 Hardened phone NitroPhone 10a $810 Secure desktop NitroPC 2 $1,085 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Privacy smartphone NovaCustom PrivacyGuard SHIFTphone 8.1 $889 Hardened mobile GrapheneOS Pixels Physical Tamper-evident & locks

Same control in other frameworks:

NIST 800-53 SR-3 NIST CSF 2.0 GV.SC-06 ISO 27001 A.5.19 SOC 2 CC9.2 NIS2 Art.21(2)(d) CMMC 2.0 CM.L2-3.4.1 PCI DSS 4.0.1 12.8.1 HIPAA Security Rule §164.308(b)(1) DORA Art. 28

CIS-4.8 Uninstall or disable unnecessary services on assets

Intel Management Engine disabled at the firmware level across every open-firmware machine we carry (NitroPad, NitroPC, PrivacyGuard, SecurityTitan); SecurityTitan models go further — camera and microphone physically removed, anti-tamper seals verified by Heads + Nitrokey attestation. Least functionality, enforced in hardware.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Secure desktop NitroPC Pro 2 $2,230 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Accessory Data blocker (USB-C/C) $15 Accessory Data blocker (USB-A/C) $15 Physical Tamper-evident & locks

Same control in other frameworks:

NIST 800-53 SC-42 NIST CSF 2.0 PR.PS-01 ISO 27001 A.8.9 SOC 2 CC6.8 NIS2 Art.21(2)(e) CMMC 2.0 CM.L2-3.4.6 PCI DSS 4.0.1 9.5.1 HIPAA Security Rule §164.310(d)(1)

CIS-11.5 Manage access control for remote assets

Rated safes and vaults protect physical assets, documents, and hardware backups with UL-certified burglary ratings — from UL 1037 RSC (residential) up to UL 687 TL-15/TL-30 vault-grade for insurance-mandated or enterprise specialty storage (the tier insurers and auditors recognize; see the ratings ladder on /safe). SecurityTitan laptops extend physical protection to devices in transit: glitter-sealed tamper-evident screws with photographic verification make case intrusion detectable.

Products that satisfy this control:

Physical Safe & vault Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Physical Tamper-evident & locks Signal blocking Faraday bags

Same control in other frameworks:

NIST 800-53 PE-3 NIST CSF 2.0 PR.AC-2 ISO 27001 A.7.1 SOC 2 CC6.4 NIS2 Art.21(2)(i) CMMC 2.0 PE.L1-3.10.1 PCI DSS 4.0.1 9.4.1 HIPAA Security Rule §164.310(a)(1) DORA Art. 9(4)(c)

CIS-11.3 Protect recovery data with equivalent controls to the original

UL 72 fire-rated safes keep interiors under 350°F through 30-minute to 4-hour furnace exposure — plus explosion and 30-foot drop tests — so original records, storage media, seed-phrase plates, and offline backups survive a facility fire. Distinct from burglary protection: enterprises with records-retention or continuity obligations typically need BOTH ratings on one unit (dual-rated Gardall UL line or TL-rated composite safes — see /safe).

Products that satisfy this control:

Physical Safe & vault

Same control in other frameworks:

NIST 800-53 MP-4 NIST CSF 2.0 PR.IR-02 ISO 27001 A.7.5 SOC 2 A1.2 NIS2 Art.21(2)(c) CMMC 2.0 MP.L2-3.8.1 HIPAA Security Rule §164.310(d)(1) Essential Eight E8-Backups

CIS-17 Incident Response Management (out-of-band communications)

Encrypted LoRa mesh radios (Meshtastic / MeshCore / Reticulum) move text and GPS with no cellular, WiFi, internet, or subscription — every node relays for every other, on FCC Part 15 unlicensed 915 MHz spectrum. The out-of-band channel for disaster response, incident communications when primary networks are down or untrusted, remote sites, and executive contingency plans.

Products that satisfy this control:

Off-grid comms LoRa mesh radios DIY Raspberry Pi builds

Same control in other frameworks:

NIST 800-53 CP-11 NIST CSF 2.0 RC.CO-04 ISO 27001 A.5.30 SOC 2 A1.3 NIS2 Art.21(2)(j) CMMC 2.0 IR.L2-3.6.1 HIPAA Security Rule §164.308(a)(7)(ii)(C) DORA Art. 11

CIS-3 Data Protection (device data outside controlled environments)

MIL-STD 188-125 / IEEE 299-tested Faraday shielding (80+ dB) physically severs every radio — cellular/5G, WiFi, Bluetooth, GPS, RFID, NFC — so devices cannot be tracked, remotely wiped, or exfiltrated over RF. Covers executive travel through hostile networks, forensic chain-of-custody transport (a seized phone that must not phone home), and anti-relay protection for keyless-entry fobs.

Products that satisfy this control:

Signal blocking Faraday bags Accessory Faraday sleeve (phone) $55

Same control in other frameworks:

NIST 800-53 PE-19 NIST CSF 2.0 PR.IR-01 ISO 27001 A.8.12 SOC 2 CC6.7 NIS2 Art.21(2)(i) CMMC 2.0 PE.L2-3.10.6

CIS-3.10 Encrypt sensitive data in transit

Verified boot ensures the TLS stack is unmodified before communication. VPN gateway encrypts all remote access traffic. Hardware-backed keys prevent interception even if endpoints are observed.

Products that satisfy this control:

Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Network security NitroWall V1410 $835 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Privacy Mullvad VPN Off-grid comms LoRa mesh radios

Same control in other frameworks:

NIST 800-53 SC-8 NIST CSF 2.0 PR.DS-02 ISO 27001 A.8.26 SOC 2 CC6.7 NIS2 Art.21(2)(h) CMMC 2.0 SC.L2-3.13.8 PCI DSS 4.0.1 4.2.1 HIPAA Security Rule §164.312(e)(2)(ii) DORA Art. 9(2)

Also mapped to

NIST 800-53 US NIST CSF 2.0 US ISO 27001 Global SOC 2 US NIS2 EU CMMC 2.0 US DoD PCI DSS 4.0.1 Payments HIPAA Security Rule US HHS DORA EU Essential Eight AU Cyber Essentials UK