CIS Controls

What are the CIS Controls?

The CIS Critical Security Controls are a short, prioritised list of the defensive measures that stop the most common attacks. They are published by the Center for Internet Security (CIS), a US nonprofit, and maintained by a community of practitioners. Where a management-system standard such as ISO/IEC 27001 tells you how to run a security programme, the CIS Controls tell you which technical safeguards to put in place first.

The current version is 8.1. It updates version 8 of 2021 by aligning the controls with NIST CSF 2.0, adding its Govern function, sharpening definitions and revising the asset classes each safeguard applies to.

How are they structured?

There are 18 controls, broken down into 153 safeguards. The controls run roughly in the order an organisation should tackle them:

• knowing what you have: inventories of enterprise assets and software;
• protecting it: data protection, secure configuration, account and access control management, and continuous vulnerability management;
• watching and defending: audit log management, email and web browser protections, malware defences, data recovery, network infrastructure management and network monitoring and defence;
• people and partners: security awareness and skills training and service provider management;
• building and testing: application software security, incident response management and penetration testing.

Each safeguard is a single, measurable action, such as keeping an accurate inventory or enabling multi-factor authentication for remote access.

What are Implementation Groups?

Not every organisation can do all 153 safeguards at once, so CIS sorts them into three Implementation Groups:

• IG1 is the foundation: 56 safeguards CIS calls essential cyber hygiene, aimed at small organisations with limited IT and security staff, and the place everyone should start.
• IG2 adds safeguards for organisations that manage more complex systems and more sensitive data.
• IG3 covers the rest, for organisations facing skilled, targeted attackers.

Each group includes the ones before it, which gives a clear route from “basics in place” to a mature programme.

How are they used?

Organisations use the controls to:

• decide what to fix first, and show progress over time;
• answer customer and insurer questionnaires, which often borrow from them;
• turn high-level requirements from frameworks such as NIST CSF or ISO/IEC 27001 into concrete technical tasks.

CIS publishes mappings to other frameworks, and its Controls Navigator shows how each safeguard lines up with them. The CIS Benchmarks, a separate CIS product, give the detailed secure configuration settings that Control 4 asks for.

Common misconceptions

There is no CIS certificate for an organisation. You can assess yourself against the controls, or have an auditor or consultant assess you, but the result is a measure of maturity, not a certification. The controls are also not a full risk management system: pair them with a framework that covers governance, risk assessment and policy.