CIS Control 1.4: Use Dynamic Host Configuration Protocol (DHCP) Logging
DHCP logging is your foundation for maintaining an accurate, up-to-date enterprise asset inventory. By capturing every IP address assignment across your network, you gain visibility into connected devices and can quickly identify unauthorized or rogue assets. This control is critical for asset management and security posture.
What this means
CIS Control 1.4 requires you to enable DHCP logging on all DHCP servers and IP address management tools to automatically capture device connections and IP assignments. You must review these logs at least weekly to identify new, removed, or modified assets, then update your enterprise asset inventory accordingly. This creates an audit trail of network activity and ensures your inventory stays current without manual discovery.
How to comply
- 1.Enable DHCP logging on all DHCP servers in your environment
- 2.Configure your IP address management (IPAM) tools to capture and log all IP assignments
- 3.Establish a weekly review schedule for DHCP logs (or more frequently for high-risk environments)
- 4.Document all new devices discovered through DHCP logs in your asset inventory
- 5.Track additions, modifications, and removals of assets in a centralized inventory
- 6.Retain DHCP logs for audit and forensic purposes per your retention policy
- 7.Automate log aggregation and alert on unusual assignment patterns
Evidence auditors look for
- DHCP server logs showing IP address assignments with timestamps and MAC addresses
- IPAM tool configuration documentation with logging enabled
- Weekly asset inventory update reports cross-referenced with DHCP logs
- Log retention records demonstrating compliance with data preservation requirements
- Change management records showing inventory updates from DHCP findings
- Audit logs of unauthorized or unrecognized devices detected through DHCP monitoring
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates DHCP log ingestion and weekly asset inventory updates, eliminating manual log reviews and keeping your CIS Control 1.4 compliance current without extra overhead.
See how GRCWatch handles this control automatically
Start free trial