# CIS Controls v8 — Lite self-mapping (SEA Fleet)

**Date:** 2026-07-31 · Self-mapping only — **not** a CIS certification.

| Control | Status | How |
|---------|--------|-----|
| 1 Inventory | Partial | Org/vessel assets in product DB |
| 3 Data protection | Partial | TLS, RLS, retention policy |
| 4 Secure config | Partial | nginx hardening headers; managed DB |
| 5 Account mgmt | Yes | Auth + roles + license gate |
| 6 Access control | Yes | CE/superintendent gates for PMS edits |
| 7 Continuous vuln | Partial | Smoke suite; no paid scanner |
| 8 Audit logs | Partial | Changelog + auth logs |
| 11 Data recovery | Partial | Backup/retention policy; vendor backups |
| 14 Security awareness | Partial | Ops runbooks in docs |
| 15 Service provider | Yes | Subprocessor list published |
| 16 Application security | Partial | Shared domain tests + readiness |

Unlisted CIS controls: **Not assessed / Not claimed**.