Request a demo

CIS Controls file integrity monitoring

Evidence for the safeguards on configs, logs and backups.

CIS Controls v8.1 asks you to keep secure configurations, review logs every week, run automated backups and protect them. Alertica checks the files behind those safeguards from outside your servers, and records who reviewed each alert and why. The table says which safeguards it covers, and how far.

Request a demo See the safeguard mapping
  • Agentless, nothing to install
  • Safeguards in IG1, IG2 and IG3

Who it's for

Practitioners working down the CIS Controls by Implementation Group, who want to know which safeguards a tool really covers.

Built for

  • Small IT teams and MSPs implementing CIS Controls for themselves or their clients
  • Linux and Unix servers, file exchanges and backup targets reachable over SFTP
  • Anyone scored against CIS by a customer, an insurer or an auditor

What Alertica covers in CIS Controls

Six safeguards across Controls 3, 4, 8 and 11, from IG1 up, with what stays with you in the last column.

CIS Critical Security Controls v8.1 (release 8.1.2, March 2025). IG is the Implementation Group where the safeguard starts.
Safeguard What it asks What Alertica does What you still do
11.2 Automated backups, IG1 Run automated backups of in-scope assets, weekly or more often. Alerts when a scheduled backup file doesn't arrive, or shrinks sharply since the last scan. Run the backups.
8.10 Retain audit logs, IG2 Keep audit logs for at least 90 days. Keeps 12 months of alert and scan history on Pro. Keep your server logs for 90 days or more.
4.1 Secure configuration process, IG1 Establish and maintain a documented secure configuration process for assets and software. Alerts when a watched config file changes, so drift from the secure configuration shows up the next scan. Write and maintain the process and the configurations.
11.3 Protect recovery data, IG1 Protect backups with the same controls as the original data. Alerts when a stored backup changes or is deleted. Encrypt the backups and keep them apart.
8.11 Audit log reviews, IG2 Review audit logs for anomalies, weekly or more often. The weekly health email and the acknowledgement notes show file alerts were reviewed every week. Review your other audit logs.
3.14 Log sensitive data access, IG3 Log access to sensitive data, including changes and disposal. Records every change and deletion of files in the folders you watch. Log who read or opened the data.

What your assessor sees

For most teams CIS is a self-assessment, and the evidence is for your own scoring, a customer, an insurer or an auditor using CIS as the yardstick. They ask what happened on given dates. Alertica keeps the answer for every date.

  • Every alert, with who reviewed it

    Each alert is acknowledged with a name, a time and a required note. That note is the review record 8.11 asks for, for file alerts.

  • Twelve months of history

    Pro keeps a year of alerts and scans, well past the 90 days 8.10 asks for logs.

  • Proof it ran every week

    Every Monday, a health email per rule: scans that ran, scans that failed, alerts, and what is still open. It matches the weekly rhythm of 8.11 and 11.2.

  • The record in one download

    Pick the period and download every alert with who reviewed it, when and the note. A PDF to hand over, or a spreadsheet to filter.

Why from outside the server

  • Nothing to install

    No agent to roll out or patch, and no change request on the server. Alertica logs in over SFTP with a read-only login.

  • Nothing to switch off

    An attacker on the server can stop an agent. Alertica runs on our servers, out of their reach.

  • Only fingerprints leave

    Alertica works out a fingerprint of each file on your server. File contents never leave it.

  • One console for every client

    MSPs see every client's servers, rules and alerts in one place, with nothing on each server to keep updated.

Live in three steps

  1. Connect a server

    Add a server with an SFTP, FTPS or FTP login. A read-only login is enough.

  2. Set your rules

    Pick a folder and say what matters. We set up the rules for your Implementation Group with you on Pro.

  3. Choose who hears about it

    Add the people who should get alerts, by email, SMS or Slack. Each one is kept on record.

Questions about CIS Controls

Which safeguards Alertica covers, and how far.

Scoring CIS for your clients? See the partner programme
  • Does CIS require file integrity monitoring?

    CIS Controls name outcomes, not tools. File monitoring gives you evidence for safeguards in Controls 3, 4, 8 and 11, as the table shows.

  • Which Implementation Group does it help with?

    4.1, 11.2 and 11.3 are in IG1. 8.10 and 8.11 start at IG2, and 3.14 at IG3.

  • What does Alertica record for each change?

    What changed and when it was found, who was told, and who reviewed it, with their note. Who made the change is in your server's own logs, and the note is the place to record it.

  • Do you copy our files?

    No. Alertica works out a fingerprint of each file on your server and reads back only that, with the file's name, size and date. File contents never leave the server.

More compliance frameworks

Set up the rules for your IG with our team

Tell us which Implementation Group you are working to. We'll set up the rules with you and go through the first scan together.

Request a demo