ABSTRACT
The center for internet security [3] publishes a set of defense actions which forms a set of defense in depth best practices known as critical security control(CSC) to detect, prevent, respond, and mitigate the cyber attacks against cyber systems and networks. However, no well defined automated measures and metrics are developed to validate the enforcement of these CSCs. Additionally, it is infeasible to directly analyze implementation of security products to verify and validate the enforcement of CSCs in those security products.