CIS Critical Security Controls v8.1
Safeguard-to-Event-Code Mapping
The Windows event codes that give an auditor direct evidence for each CIS safeguard below.
Scope: Covers CIS Controls 5 (Account Management) and 8 (Audit Log Management) — the two controls most directly about what this catalog evidences. Only 6 of their 18 combined safeguards are genuinely log-evidenced; the rest are documented process, inventory, or storage-configuration requirements, named honestly in the gap section below rather than force-mapped.
Version: CIS Controls v8.1 (June 2024), the current release — 18 controls, 153 safeguards total across the full framework.
GravityLog