CIS Controls v8.1: The Practical Security Baseline

When a small or mid-size IT company asks "where do we start with security?", the CIS Controls are often the most practical answer. They are a prioritised list of safeguards based on how real attacks happen, grouped into Implementation Groups so a 15-person agency and a 5,000-person enterprise can each find the right starting point. This guide explains the 18 CIS Controls in version 8.1, the Implementation Groups, and how to use them alongside ISO 27001, SOC 2 and NIST CSF.

What are the CIS Controls?

The CIS Controls are a set of specific, actionable cybersecurity best practices. Unlike outcome frameworks, they say concretely what to do: keep an inventory of devices, enforce MFA, manage audit logs, test backups. They are developed by a community of practitioners and updated based on attack data.

Full form and definition

The full name is the CIS Critical Security Controls, published by the Center for Internet Security. Each Control is a topic area; each Safeguard is a specific action, mapped to an asset type and security function, and assigned to one or more Implementation Groups.

Law, standard or certification?

The CIS Controls are a voluntary framework. Some laws and regulators point to them as an example of reasonable security; for instance, a California Attorney General data breach report in 2016 cited the then Top 20 controls as a minimum level of reasonable security. That does not make them a legal requirement.

History and background of the CIS Controls

The controls began in 2008 as a US government and industry consensus list, later known as the SANS Top 20 Critical Security Controls. Stewardship moved to the Center for Internet Security in 2015. Implementation Groups arrived with version 7.1 in 2019. Version 8 (May 2021) reorganised the list into 18 Controls by activity rather than by who manages a device, reflecting cloud and remote work. Version 8.1 (June 2024) added a Govern security function and refined definitions to align with NIST CSF 2.0.

Why were the CIS Controls introduced?

Organisations were overwhelmed by long control catalogues and unsure which actions actually stopped attacks. The CIS Controls focused on a short, prioritised set of defences that address the most common attack patterns.

Main objectives and purpose

• Prioritise the safeguards that stop the most common attacks.
• Give small organisations an achievable starting point (IG1).
• Provide measurable, specific actions rather than abstract outcomes.
• Map to major frameworks so effort counts towards several goals.

Who needs the CIS Controls?

• Small and mid-size IT companies, agencies and start-ups starting a security programme
• Managed service providers that standardise client security baselines
• Organisations preparing for ISO 27001 or SOC 2 that want a practical control set
• Public sector bodies, schools and local governments
• Companies answering cyber insurance questionnaires, which often mirror IG1 safeguards

The CIS Controls are used worldwide and are not tied to any jurisdiction.

Key requirements: the 18 CIS Controls

1. Inventory and Control of Enterprise Assets
2. Inventory and Control of Software Assets
3. Data Protection
4. Secure Configuration of Enterprise Assets and Software
5. Account Management
6. Access Control Management
7. Continuous Vulnerability Management
8. Audit Log Management
9. Email and Web Browser Protections
10. Malware Defenses
11. Data Recovery
12. Network Infrastructure Management
13. Network Monitoring and Defense
14. Security Awareness and Skills Training
15. Service Provider Management
16. Application Software Security
17. Incident Response Management
18. Penetration Testing

Implementation Groups

CIS Controls v8.1 Implementation Groups

Group	Safeguards	Typical organisation
IG1	56	Small organisations with limited IT expertise; essential cyber hygiene for everyone
IG2	IG1 plus 74 (130 total)	Organisations with dedicated IT staff, multiple departments or regulatory duties
IG3	IG2 plus 23 (153 total)	Organisations with security specialists and sensitive data or services

Examples of IG1 safeguards

• Establish and maintain a detailed enterprise asset inventory
• Establish and maintain a software inventory and allow only authorised software
• Encrypt data on end-user devices
• Establish a secure configuration process
• Require MFA for externally exposed applications and remote network access
• Perform automated operating system and application patch management
• Collect audit logs
• Deploy and maintain anti-malware software
• Perform automated backups and keep an isolated instance of recovery data
• Establish security awareness training
• Designate personnel to manage incident handling

How to implement the CIS Controls: step by step

1. Choose your Implementation Group based on size, data sensitivity and resources. Most small IT companies start with IG1 and aim for IG2.
2. Self-assess using the free CIS Controls Self Assessment Tool (CSAT) or a spreadsheet.
3. Start with Controls 1 and 2: you cannot protect assets you do not know about.
4. Implement identity and access basics (Controls 5 and 6), especially MFA.
5. Harden and patch (Controls 4 and 7), using CIS Benchmarks for configuration guidance.
6. Protect data and recovery (Controls 3 and 11), including tested, isolated backups.
7. Add logging, monitoring and incident response (Controls 8, 13 and 17).
8. Cover people and suppliers (Controls 14 and 15).
9. Secure your software (Control 16) if you develop applications.
10. Measure and reassess quarterly, then move to the next IG.

Documentation required

The framework does not mandate documents, but each Control implies records:

• Asset and software inventories
• Data inventory and data management process
• Secure configuration standards
• Account and access management procedures and reviews
• Vulnerability management process and remediation records
• Audit log management process
• Backup and recovery tests
• Training records
• Service provider inventory and assessments
• Incident response plan
• Penetration test reports (IG2 and IG3)

Audit and assessment requirements

There is no formal certification. Organisations self-assess, or engage a consultant or managed security provider to assess implementation. Results can be presented to clients and insurers, and mapped to ISO 27001 or SOC 2 evidence.

Estimated implementation timeline

• IG1 for a small IT company: 3 to 6 months
• IG2: a further 6 to 12 months
• IG3: ongoing, typically 12 months or more beyond IG2

Cost considerations

The Controls are free. Costs are for tools (endpoint management, EDR, backup, logging), staff time and optional assessments. Many IG1 safeguards can be met with features already included in common productivity and cloud platforms when configured properly.

Benefits of the CIS Controls

• Concrete, prioritised actions that reduce real-world attack risk quickly.
• Achievable for small teams.
• Aligns with cyber insurance questionnaires.
• Maps to NIST CSF, ISO 27001, SOC 2, PCI DSS and others.

Risks of ignoring them

No penalties apply. But missing IG1 basics such as MFA, patching and backups is behind many ransomware and account takeover incidents, and can lead to declined insurance cover or failed client reviews.

Common implementation mistakes

• Jumping to advanced tools before completing inventories.
• MFA on email but not on admin consoles, VPN or cloud provider accounts.
• Backups that are not isolated or never restored in a test.
• Collecting logs without anyone reviewing them.
• Self-assessing generously without evidence.

Compliance challenges for IT companies

• Bring-your-own-device and contractor laptops complicate asset inventories.
• SaaS sprawl makes software inventory and account management harder.
• Developers need admin rights, which must be balanced with least privilege.
• Client environments managed by MSPs need clear responsibility splits.

Best practices and recommendations

• Use the CIS Controls as the implementation layer under ISO 27001 or SOC 2.
• Apply CIS Benchmarks for operating systems and cloud accounts.
• Automate inventory and patch reporting.
• Pair Control 16 with the OWASP Top 10 for application security.
• Report progress by Control to leadership each quarter.

Tools and technologies that help

• CIS CSAT for self-assessment and CIS Benchmarks for hardening
• Unified endpoint management and EDR
• Identity providers with SSO and MFA
• Vulnerability scanners and patch management tools
• Backup platforms with immutable storage
• Log management or managed detection and response services

Relationship with other compliance frameworks

CIS Controls and related frameworks

Framework	Relationship
NIST CSF	v8.1 aligns to CSF 2.0 functions; CIS provides the concrete safeguards
ISO 27001	CIS safeguards help implement many Annex A controls
NIST SP 800-53	CIS is a prioritised subset mapped to 800-53
OWASP Top 10	Supports Control 16, Application Software Security
CERT-In Directions	Logging and incident response Controls help meet Indian reporting and log retention duties

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

20-person web agency

An agency with no security staff used IG1 as its roadmap: enrolled all laptops in device management, enforced MFA on every client and hosting account, automated patching, set up isolated cloud backups and ran quarterly phishing training. Its cyber insurance renewal questionnaire went from multiple "no" answers to full coverage.

MSP standard baseline

A managed service provider built its standard client package on IG1 and IG2 safeguards and reported each client's coverage monthly.

Frequently asked questions

What is the latest version of the CIS Controls?

Version 8.1, released in June 2024.

How many CIS Controls are there?

18 Controls containing 153 Safeguards in version 8.1.

What is IG1?

Implementation Group 1, the 56 Safeguards CIS defines as essential cyber hygiene for every organisation.

Is there a CIS Controls certification?

No. Organisations self-assess or use a third party to assess implementation.

Are the CIS Controls free?

Yes. They can be downloaded from the Center for Internet Security after registration.

What is the difference between CIS Controls and CIS Benchmarks?

The Controls are a prioritised security programme; the Benchmarks are detailed secure configuration guides for specific products such as Windows, Linux, AWS or Microsoft 365.

Do CIS Controls replace ISO 27001?

No. They are an implementation guide, while ISO 27001 is a certifiable management system. They work well together.

Which Implementation Group should we target?

Start with IG1. Move to IG2 if you have dedicated IT staff, store sensitive client data or face regulatory requirements.

How long does IG1 take?

Typically 3 to 6 months for a small IT company.

Conclusion and next steps

The CIS Controls turn security from a vague goal into a prioritised to-do list. Complete IG1, measure honestly and build from there.

1. Pick your Implementation Group.
2. Self-assess with CSAT.
3. Fix inventories, MFA, patching and backups first.
4. Add logging, monitoring and incident response.
5. Reassess every quarter.

How we keep this guide up to date

We review this guide every six months and whenever CIS releases a new version of the Controls, Implementation Group changes or new mappings.