CIS Controls

Introduction: The CIS Critical Security Controls

The CIS Critical Security Controls (commonly called the CIS Controls) are a prioritised, prescriptive and community-developed set of safeguards designed to mitigate the most prevalent and dangerous cyber-attacks affecting modern organisations. Maintained by the Center for Internet Security (CIS), a not-for-profit entity headquartered in East Greenbush, New York, the Controls translate the collective knowledge of thousands of security practitioners into a defensible, action-oriented programme. Unlike broad governance frameworks that describe what good security looks like in abstract terms, the CIS Controls tell you precisely what to do, in what order, to obtain the greatest defensive return for the least effort.

The current edition, CIS Controls Version 8 (released May 2021, with an incremental v8.1 update in 2024 that aligns the asset taxonomy with the NIST Cybersecurity Framework 2.0 functions and adds Governance as a security function), consolidates the historically dispersed twenty controls into eighteen top-level Controls comprising 153 individual Safeguards. The Controls are organised around activities rather than around the type of device that performs them, a deliberate shift reflecting the reality of cloud computing, mobility, virtualisation and outsourcing. This guide provides an auditor-grade walk-through of every Control, every Implementation Group, the assessment evidence you should expect to see, and a pragmatic route to adoption for organisations of any size.

What are the CIS Controls?

The CIS Controls are a defence-in-depth model of cyber hygiene expressed as a small number of high-value activities. They began life in 2008 as the 'Consensus Audit Guidelines', were later stewarded by the SANS Institute as the 'SANS Top 20', and since 2015 have been owned and maintained by CIS. Each successive version has been refined using real-world attack data, the MITRE ATT&CK knowledge base and the annual Verizon Data Breach Investigations Report, ensuring the safeguards remain empirically tied to how breaches actually occur.

Three structural concepts define Version 8 and are essential to any assessment:

• Controls: the eighteen top-level categories of defensive activity, numbered CIS Control 1 through CIS Control 18, each addressing a distinct risk area such as asset inventory, data protection, or incident response.
• Safeguards: the 153 discrete, testable actions (formerly called 'Sub-Controls') nested beneath the Controls. Each Safeguard is a single, atomic requirement written so it can be measured as implemented or not implemented.
• Implementation Groups (IG1, IG2, IG3): a tiering mechanism that assigns each Safeguard to a level of organisational maturity and risk exposure, so that a small business and a large enterprise can each adopt a defensible subset. IG1 defines essential cyber hygiene, IG2 builds on IG1 for organisations managing greater complexity, and IG3 addresses organisations with sensitive data and sophisticated adversaries.

Crucially, the CIS Controls are voluntary and framework-agnostic. They are not a law and confer no certification of their own, yet they are explicitly referenced by regulators and standards bodies, map cleanly to NIST CSF, NIST SP 800-53, ISO/IEC 27001, PCI DSS and DPDP-driven security expectations, and are frequently adopted as the technical implementation layer beneath a governance framework.

Who must comply with the CIS Controls?

No statute mandates the CIS Controls by name. However, they are strongly recommended, contractually required or effectively obligatory for a wide range of organisations because they are recognised as a reasonable standard of care and are cross-referenced by binding regimes. The table below summarises typical applicability.

In practice, any organisation seeking a demonstrable, prioritised and cost-effective security programme is a candidate for CIS Controls adoption. The Implementation Group model means the framework scales from a two-person startup to a multinational bank without leaving smaller organisations paralysed by irrelevant requirements.

Structure of the CIS Controls (Version 8)

Version 8 comprises eighteen Controls and 153 Safeguards. Each Control has a defined purpose, an ordered set of Safeguards, and an allocation of those Safeguards across the three Implementation Groups. The table enumerates all eighteen Controls, their Safeguard counts and the number of Safeguards applicable to each Implementation Group (IG1 counts are cumulative into IG2 and IG3).

The Controls are deliberately ordered so that the earliest Controls (asset and software inventory, data protection, secure configuration) deliver the highest marginal risk reduction. An organisation that cannot see its assets cannot protect them, which is why Control 1 sits at the top. The following master assessment section examines every Control and its Safeguards in turn.

Master assessment checklist: every Control and Safeguard

This is the operational heart of the guide. For each of the eighteen Controls, we describe the assessment intent, then provide a verification table listing what an auditor should confirm and the typical evidence that substantiates it. Coverage is complete: no Control or Safeguard family is omitted.

Control 1 — Inventory and Control of Enterprise Assets

Establish and maintain an accurate, detailed and up-to-date inventory of all enterprise assets (end-user devices, network devices, IoT, servers) whether on-premises, virtual, remote or cloud-hosted, so that only authorised devices are granted access.

Control 2 — Inventory and Control of Software Assets

Actively manage all software (operating systems and applications) so that only authorised software is installed and can execute, and unauthorised or unmanaged software is found and prevented from running.

Control 3 — Data Protection

Develop processes and technical controls to identify, classify, securely handle, retain and dispose of data across its entire lifecycle.

Control 4 — Secure Configuration of Enterprise Assets and Software

Establish and maintain secure baseline configurations for assets and software, and manage them through change control to reduce the attack surface.

Control 5 — Account Management

Manage the lifecycle and privileges of all accounts (user, administrator and service) to prevent unauthorised access.

Control 6 — Access Control Management

Create, assign, manage and revoke access credentials and privileges for all accounts, applying least privilege and strong authentication.

Control 7 — Continuous Vulnerability Management

Continuously identify, prioritise and remediate vulnerabilities to minimise the window of exposure.

Control 8 — Audit Log Management

Collect, alert on, review and retain audit logs to detect, understand and recover from attacks.

Control 9 — Email and Web Browser Protections

Reduce the attack surface presented by email and web browsers, the two most common vectors of initial compromise.

Control 10 — Malware Defences

Prevent or control the installation, spread and execution of malicious applications, code and scripts.

Control 11 — Data Recovery

Establish and maintain practices to restore in-scope assets to a trusted, pre-incident state.

Control 12 — Network Infrastructure Management

Establish, implement and actively manage network devices to prevent attackers from exploiting vulnerable services and access points.

Control 13 — Network Monitoring and Defence

Operate processes and tooling to establish and maintain comprehensive network monitoring and defence against threats across the enterprise infrastructure and user base.

Control 14 — Security Awareness and Skills Training

Establish and maintain a security awareness programme to influence behaviour among the workforce so they are security-conscious and appropriately skilled.

Control 15 — Service Provider Management

Develop a process to evaluate service providers who hold sensitive data or are responsible for critical IT platforms, to ensure they protect those assets appropriately.

Control 16 — Application Software Security

Manage the security lifecycle of in-house developed, hosted or acquired software to prevent, detect and remediate weaknesses before they can be exploited.

Control 17 — Incident Response Management

Establish a programme to develop and maintain incident response capability to prepare, detect and quickly respond to attacks.

Control 18 — Penetration Testing

Test the effectiveness and resilience of enterprise assets by identifying and exploiting weaknesses in controls, simulating the actions of an attacker.

Scoping the CIS Controls assessment

Sound scoping ensures the assessment is neither superficially narrow nor unmanageably broad. Because the CIS Controls are activity-based, scope is defined by enterprise assets and data rather than by physical location alone.

• Define the enterprise: identify all business units, subsidiaries and legal entities whose assets and data fall within the programme.
• Establish the target Implementation Group: select IG1, IG2 or IG3 based on data sensitivity, threat exposure, regulatory obligations and resourcing. The chosen IG determines which Safeguards are in scope.
• Enumerate in-scope asset classes: end-user devices, servers, network devices, cloud workloads, mobile devices, IoT/OT and applications, whether on-premises, remote or hosted.
• Include cloud and outsourced services: SaaS, IaaS, PaaS and managed service providers are in scope; Control 15 governs how their obligations are apportioned.
• Document exclusions with justification: any asset, business unit or Safeguard excluded should carry a documented, risk-based rationale and an owner.
• Confirm the assessment boundary in writing and obtain sign-off from the accountable executive before fieldwork begins.

Implementation approach

A phased implementation converts the assessment findings into a durable programme. The following four phases move an organisation from visibility to continuous improvement.

Phase 1 — Discover and establish foundational hygiene (IG1)

Activities: build the enterprise asset and software inventories (Controls 1-2); implement secure configuration baselines using CIS Benchmarks (Control 4); enforce account and access hygiene including MFA (Controls 5-6); deploy anti-malware and basic backups (Controls 10-11); launch awareness training (Control 14).

Deliverables: authoritative asset and software registers, hardened baseline standards, MFA enforcement report, backup and recovery policy, initial training completion records, and an IG1 gap assessment.

Phase 2 — Strengthen detection and management (IG2)

Activities: implement continuous vulnerability management (Control 7); centralise audit logging into a SIEM (Control 8); deploy email/web protections and DMARC (Control 9); establish network monitoring and segmentation (Controls 12-13); formalise service provider management (Control 15) and incident response (Control 17).

Deliverables: vulnerability management SLAs and scan reports, centralised log platform with 90-day retention, DMARC enforcement, network architecture diagrams, vendor risk register, and a tested incident response plan.

Phase 3 — Mature and validate (IG3)

Activities: implement application security across the SDLC (Control 16); introduce data-loss prevention and sensitive-data access logging (Control 3); deploy advanced network defences including IPS and NAC (Control 13); stand up a penetration testing and validation programme (Control 18).

Deliverables: secure SDLC evidence and SAST/DAST integration, DLP alerting, IPS/NAC deployment, penetration test reports with validated remediation, and privileged access workstations.

Phase 4 — Operate, measure and improve

Activities: institutionalise metrics and reporting; conduct periodic reassessments using CIS CSAT; run tabletop exercises and purple-team validation; feed lessons learned back into baselines; track Safeguard implementation trend over time.

Deliverables: a live KPI dashboard, quarterly management reports, updated risk register, exercise reports, and a rolling improvement backlog.

Implementation Group model (scoring/maturity)

Rather than a five-level maturity ladder, CIS Version 8 uses three Implementation Groups to express how much of the framework applies to a given organisation. Assessment maturity itself is commonly expressed using the CIS CSAT scoring scale (Not Implemented, Partially Implemented, Implemented, and validated states), which can be overlaid on the Implementation Groups. The table summarises both dimensions.

Assessment and audit approach

A repeatable, evidence-driven methodology produces defensible conclusions. The following ordered steps describe a typical CyberSigma CIS Controls assessment engagement.

1. Kick-off and scoping: agree the enterprise boundary, target Implementation Group, in-scope asset classes and timeline; obtain executive sponsorship.
2. Documentation review: examine policies, standards, inventories, architecture diagrams and prior assessment reports against the in-scope Safeguards.
3. Tooling and data collection: gather configuration exports, scan results, SIEM samples, MFA and patch reports, and CIS CSAT self-assessment inputs.
4. Interviews and walkthroughs: interview asset owners, administrators and process owners to corroborate documented controls and observe them operating.
5. Technical verification: sample-test configurations against CIS Benchmarks, validate MFA enforcement, review log coverage and retention, and inspect backup restorability.
6. Scoring: rate each in-scope Safeguard against the CSAT maturity states, recording evidence references for every rating.
7. Gap analysis and risk rating: identify gaps, assess residual risk using likelihood and impact, and prioritise by risk reduction per Safeguard.
8. Reporting: produce an executive summary, detailed Safeguard-level findings, a prioritised remediation roadmap aligned to the Implementation Groups, and framework mappings.
9. Remediation support and re-test: assist with prioritised fixes, then re-assess remediated Safeguards to confirm closure and update the maturity baseline.

Evidence request list

The following categorised list captures the artefacts typically requested during a CIS Controls assessment. Providing these in advance accelerates fieldwork.

• Governance and policy: information security policy, acceptable use policy, data classification and retention policy, vendor risk policy, incident response plan, secure development policy.
• Asset and software: enterprise asset inventory/CMDB export, software inventory, end-of-life register, allowlisting configuration.
• Configuration and hardening: CIS Benchmark-aligned baseline standards, configuration management tool exports, drift/compliance reports, host firewall status.
• Identity and access: account inventory, privileged account register, MFA enforcement reports, access recertification records, RBAC role definitions.
• Vulnerability and patch: vulnerability scan reports, patch compliance dashboards, remediation SLA tracking.
• Logging and monitoring: logging policy, SIEM source list and retention configuration, sample alerts, log review records.
• Data protection: data inventory/map, encryption reports (at rest, in transit, removable media), DLP alerts, disposal certificates.
• Resilience: backup schedules and success reports, restore test results, offline/immutable backup evidence.
• Network: architecture diagrams, segmentation firewall rules, network device patch status, IDS/IPS configuration.
• Third party: service provider inventory, risk tiering, contracts/DPAs, SOC 2 reports, monitoring records.
• Application security: secure SDLC evidence, SAST/DAST reports, software bill of materials, code review records.
• People: awareness training content and completion records, phishing simulation results, role-based training assignments.
• Testing and IR: penetration test reports, remediation/retest evidence, incident records, tabletop exercise reports, post-incident reviews.

Roles and responsibilities

Clear ownership is essential to sustain a CIS Controls programme. The following RACI-style table maps typical roles to programme responsibilities.

KPIs to track

Metrics turn the CIS Controls from a point-in-time assessment into a managed programme. Track a balanced set of coverage, timeliness and outcome measures.

• Percentage of enterprise assets and software in the authoritative inventory (coverage and accuracy).
• Percentage of in-scope Safeguards rated Implemented or higher, trended over time.
• MFA coverage across externally exposed and privileged accounts.
• Mean time to patch critical and high vulnerabilities against SLA.
• Vulnerability remediation SLA adherence rate and open critical-vulnerability count.
• Percentage of assets conforming to CIS Benchmark baselines (configuration drift).
• Log source coverage and percentage of assets forwarding to the SIEM.
• Backup success rate and successful restore test rate.
• Security awareness training completion rate and phishing simulation click/report rates.
• Mean time to detect and mean time to respond to security incidents.
• Percentage of service providers risk-assessed and under contract with security terms.
• Penetration test findings remediated within target timeframe.

Readiness checklist

Use this checklist to gauge whether the organisation is prepared for a formal CIS Controls assessment or attestation.

• Target Implementation Group (IG1/IG2/IG3) selected and justified by risk.
• Enterprise boundary and in-scope asset classes documented and signed off.
• Authoritative asset and software inventories exist and are current.
• Secure configuration baselines aligned to CIS Benchmarks are defined and enforced.
• MFA is enforced for remote, external and privileged access.
• Vulnerability scanning and patch management operate on a defined cadence.
• Audit logs are centralised with at least 90 days retention (IG2+).
• Backups are automated, protected and periodically restore-tested.
• Data classification and protection controls are in place for sensitive data.
• Incident response plan is documented, assigned and exercised.
• Service providers are inventoried and risk-assessed.
• Security awareness training is delivered and completion is tracked.
• A CIS CSAT self-assessment has been completed and gaps recorded.
• Evidence artefacts are collated and owners are identified for each Control.

Common gaps and pitfalls

Across CIS Controls assessments, the same weaknesses recur. Anticipating them accelerates readiness.

• Incomplete or stale asset and software inventories, undermining every downstream Control.
• Attempting all 153 Safeguards at once instead of scoping to the appropriate Implementation Group.
• MFA deployed for email but not for VPN, administrative consoles or cloud management planes.
• Configuration baselines documented but not enforced or monitored for drift.
• Logs collected locally but not centralised, correlated, retained for 90 days or reviewed.
• Backups that are never restore-tested, or that lack an offline/immutable copy vulnerable to ransomware.
• Vulnerability scans run but findings not remediated within defined SLAs or re-validated.
• Service provider risk unmanaged, with sensitive data held by vendors under no security obligations.
• Awareness training treated as an annual tick-box with no role-based depth or phishing simulation.
• Incident response plan that exists on paper but has never been exercised.
• Treating the CIS Controls as a one-time project rather than a continuously operated programme.
• No named owner for individual Controls, so accountability diffuses and gaps persist.

CIS Controls mapped to other frameworks

CIS publishes authoritative mappings that make the Controls an efficient implementation layer beneath governance frameworks. The illustrative table below shows how selected Controls relate to widely used standards; consult the official CIS mapping documents for the full, current cross-references.

How CyberSigma helps

Frequently asked questions

Need help with CIS Controls?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.