CIS Controls for any organisation
CIS Controls v8.1: the 18 controls, the three Implementation Groups and where to start
What the CIS Critical Security Controls are, how the 153 safeguards split across IG1, IG2 and IG3, what changed in v8.1, and how to evidence the work.
In short
The CIS Critical Security Controls (CIS Controls) are a prioritised set of cyber defence practices published by the Center for Internet Security. Version 8.1 has 18 controls broken into 153 safeguards, each assigned to one of three Implementation Groups. IG1, 56 safeguards, is the essential cyber hygiene CIS recommends for every organisation; IG2 and IG3 add safeguards for organisations with more complex environments and higher risk. The Controls are voluntary and are not a certification, but they are widely used as a practical baseline and are named in several US state safe harbor laws.
The 18 CIS Controls
Each control is a group of safeguards around one area of defence. The order reflects priority: the first controls establish what you have and who can reach it, because the rest depend on knowing that.
| Control | What it covers |
|---|---|
| 1. Inventory and control of enterprise assets | Know every device connected to the environment |
| 2. Inventory and control of software assets | Know what software runs, and allow only authorised software |
| 3. Data protection | Classify, handle, retain and dispose of data |
| 4. Secure configuration | Hardened, documented baselines for assets and software |
| 5. Account management | An inventory of user, administrator and service accounts |
| 6. Access control management | Grant, review and revoke access, including MFA |
| 7. Continuous vulnerability management | Find and remediate vulnerabilities on a schedule |
| 8. Audit log management | Collect, review and retain logs |
| 9. Email and web browser protections | Reduce the attack surface of email and browsing |
| 10. Malware defences | Prevent and detect malicious code |
| 11. Data recovery | Back up and restore data |
| 12. Network infrastructure management | Keep network devices current and securely managed |
| 13. Network monitoring and defence | Centralised alerting and monitoring of network traffic |
| 14. Security awareness and skills training | Train the workforce at hire and at least annually |
| 15. Service provider management | Inventory, classify and assess service providers |
| 16. Application software security | Secure development of in-house and hosted software |
| 17. Incident response management | Plan, staff and practise incident handling |
| 18. Penetration testing | Test defences through simulated attacks |
IG1, IG2 and IG3: which safeguards apply to you
CIS assigns each safeguard to an Implementation Group, so an organisation can start with what matters most for its size and risk instead of all 153 at once. The groups are cumulative: IG2 includes IG1, and IG3 is every safeguard.
- IG1: essential cyber hygiene
- 56 safeguards. CIS describes IG1 as an emerging minimum standard of information security for all enterprises, typically small organisations with limited IT and security expertise.
- IG2
- IG1 plus 74 safeguards, 130 in total, for organisations with several departments, dedicated IT staff and sensitive data.
- IG3
- All 153 safeguards, adding 23 for organisations with security specialists and data or services whose compromise would cause significant harm.
What changed in v8.1
CIS released v8.1 on 25 June 2024 as an iterative update to v8. The 18 controls, the 153 safeguards and the Implementation Groups were not changed, and CIS says the spirit of each safeguard remains the same.
- A Govern function: Safeguards are labelled with a security function. v8.1 adds Govern, in line with NIST CSF 2.0, to mark the safeguards that strengthen governance of the program.
- Revised asset classes: New asset classes, including documentation, so each safeguard names more precisely the part of the environment it applies to.
- Clearer wording: Some safeguard descriptions were clarified, and the glossary was expanded.
- Updated mappings: The NIST CSF mappings were realigned to CSF 2.0.
Voluntary, but named in law
No regulator requires the CIS Controls by name, and CIS does not certify organisations against them. They matter legally in a different way: several US states give a defence in data breach litigation to organisations whose written cybersecurity program reasonably conforms to a recognised framework, and those laws list the CIS Controls alongside NIST and ISO standards.
Ohio was first, in 2018, followed by Utah and Connecticut in 2021, then Iowa, and Texas in 2025. The conditions differ by state, including who qualifies and which claims are covered, so take legal advice before relying on any of them.
How CIS Controls relate to NIST CSF, ISO 27001 and SOC 2
The CIS Controls are prescriptive: they say what to do, often how often. NIST CSF and ISO 27001 describe outcomes and a management system, and SOC 2 is an attestation report. That is why many teams use CIS safeguards as the technical how underneath one of the others.
CIS publishes its own mappings from the Controls to NIST CSF 2.0 and other frameworks. Use them to see where one implemented safeguard supports several requirements, and confirm each link against your own controls.
Implementing the CIS Controls
Start with IG1 and the first controls. Everything else depends on knowing your assets and accounts.
-
01
Choose your Implementation Group
Decide which group fits your risk, and record the reasoning and any higher-group safeguards you will adopt.
Your security lead and leadership
-
02
Inventory assets, software and accounts
Controls 1, 2 and 5 come first. Without them, coverage of every later safeguard is a guess.
Your IT operations team, in Certifyi
-
03
Assess against each safeguard
Record which safeguards are in place, partial or missing, with an owner for each.
Your control owners, in Certifyi
-
04
Collect evidence on a schedule
Many safeguards carry a frequency, such as weekly, quarterly or annual. Set evidence to match, so it shows the safeguard is still operating.
Your control owners
-
05
Review and move up
Reassess at least annually, close the gaps in your group, and decide when to adopt the next one.
Your security lead
Who does what
The Controls are voluntary and self-assessed. Certifyi is a tool for running and evidencing them; it does not certify conformity.
| Task | Your team | Certifyi | Assessor |
|---|---|---|---|
| Assets and software | Keep current inventories (Controls 1 and 2) | Holds the asset register with owners, locations and end-of-life dates | Samples the inventory against the environment |
| Vulnerabilities and patching | Remediate on a schedule (Control 7) | Tracks vulnerabilities and patch status | Checks remediation against your stated timelines |
| Access | Grant, review and revoke access (Controls 5 and 6) | Runs access reviews and records the decisions | Reviews access records |
| Service providers | Inventory and assess providers (Control 15) | Tracks vendor tiering, questionnaires and documents | Reviews provider oversight |
| Incident response | Plan and practise (Control 17) | Holds the incident register and its timelines | Reviews plans and exercise records |
How Certifyi helps
Run the CIS Controls alongside your other frameworks
Certifyi does not implement the safeguards for you. It gives you a workspace to assess them, assign owners and keep the evidence current.
-
All 153 safeguards in the catalogue
The catalogue lists the 18 controls and 153 safeguards, written for v8. Each safeguard is not yet tagged with its Implementation Group, so scope IG1 or IG2 using CIS's own list.
-
Asset and software inventory
Keep enterprise assets in the asset register with an owner, a location and an end-of-life date.
-
Vulnerabilities and patching
Track findings and remediation in vulnerability management and patch status in patch and configuration management.
-
Access reviews
Run periodic access reviews and keep each reviewer's decision as evidence for Controls 5 and 6.
-
Training and service providers
Assign security awareness training, and assess providers in third-party risk.
-
Evidence that stays in date
Evidence carries a validity period, with reminders before it expires, so a safeguard with a weekly or quarterly frequency shows when it last ran.
Questions
CIS Controls, answered
What are the CIS Controls?
A prioritised set of cyber defence practices published by the Center for Internet Security. Version 8.1 has 18 controls made up of 153 safeguards, grouped into three Implementation Groups.
What is CIS IG1?
Implementation Group 1, the 56 safeguards CIS calls essential cyber hygiene: the minimum it recommends for every organisation, regardless of size.
How many CIS Controls are there?
Eighteen controls, containing 153 safeguards. Earlier versions had 20 controls; v8 consolidated them in May 2021.
What changed in CIS Controls v8.1?
v8.1, released in June 2024, added a Govern security function aligned to NIST CSF 2.0, revised the asset classes, clarified some safeguard wording and expanded the glossary. The safeguards and Implementation Groups were not changed.
Is there a CIS Controls certification?
No. CIS does not certify organisations against the Controls. Organisations self-assess or engage an independent assessor, and often use the Controls as the technical baseline beneath an ISO 27001 certification or SOC 2 report.
Are the CIS Controls required by law?
No law requires them by name. Several US states, including Ohio, Utah, Connecticut, Iowa and Texas, offer a defence in data breach litigation to organisations whose written program reasonably conforms to a recognised framework, and they list the CIS Controls among those frameworks.
CIS Controls or NIST CSF?
They work together. NIST CSF describes outcomes; the CIS Controls describe specific safeguards that achieve many of them. CIS publishes a mapping from the Controls to NIST CSF 2.0.
Does Certifyi make us compliant with the CIS Controls?
No. The safeguards are yours to implement and operate. Certifyi provides the workspace to assess them, assign owners and keep evidence current.
Map the CIS Controls to your controls in a 30-minute call.
Bring your Implementation Group and your other frameworks. We will show how the safeguards, owners and evidence connect in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them