The CIS Controls are a prioritized, prescriptive set of cybersecurity best practices published by the Center for Internet Security, organized in version 8 and 8.1 into 18 Controls containing 153 Safeguards. They describe concrete technical and organizational actions, such as keeping an asset inventory or enforcing multi-factor authentication, that block or mitigate the most common attacks observed in real incidents.
Among security standards, the CIS Controls occupy a practical middle ground. They are not a certifiable management system like ISO 27001 and not a broad risk framework like NIST CSF; instead they provide a ranked to-do list of defenses that maps well to those frameworks and helps organizations decide what to implement first.
How the CIS Controls are structured
The framework has three layers: Controls, Safeguards and Implementation Groups. Each Control is a broad defensive area, each Safeguard is a specific, measurable action, and each Safeguard is assigned to one or more Implementation Groups that reflect organizational maturity and risk.
The Controls originated in 2008 as a community list later known as the SANS Top 20. Version 7 still had 20 Controls; version 8, released in 2021, consolidated them to 18 Controls organized by activity rather than by who manages the device, reflecting cloud services, remote work and mobile devices. Version 8.1 in 2024 refined wording and added a Governance security function to align with NIST CSF 2.0.
The table below groups the 18 Controls by the kind of protection they provide.
| Group | Controls | Focus |
|---|---|---|
| Know the environment | 1 Enterprise assets, 2 Software assets | Inventory and control of what exists |
| Protect data and systems | 3 Data protection, 4 Secure configuration, 12 Network infrastructure | Hardening and data handling |
| Control identities | 5 Account management, 6 Access control management | Accounts, privileges, MFA |
| Find and fix weaknesses | 7 Vulnerability management, 16 Application software security | Patching and secure development |
| Detect and defend | 8 Audit logs, 9 Email and browser, 10 Malware, 13 Network monitoring | Visibility and threat blocking |
| Prepare and recover | 11 Data recovery, 17 Incident response management | Backups and response capability |
| People and partners | 14 Awareness training, 15 Service provider management | Human and supply chain risk |
| Validate | 18 Penetration testing | Testing defenses as an attacker would |
Implementation Groups and prioritization
Implementation Groups (IGs) are the main prioritization mechanism. They let an organization start with a minimum baseline and expand as resources and risk grow, instead of trying to apply all 153 Safeguards at once.
| Group | Safeguards | Typical organization | Goal |
|---|---|---|---|
| IG1 | 56 | Small firm, limited IT staff | Essential cyber hygiene against common attacks |
| IG2 | 130 (IG1 plus 74) | Several departments, sensitive data | Manage operational complexity and compliance |
| IG3 | 153 (IG2 plus 23) | Dedicated security experts, high-value data | Resist targeted and sophisticated attackers |
IG1 is often described as essential cyber hygiene: it covers asset inventory, secure configuration, account hygiene, backups and basic malware defense. Every organization, regardless of size, should treat IG1 as the non-negotiable starting point. The order of Controls also matters: knowing which hardware and software exist (Controls 1 and 2) comes first, because nothing else can be protected reliably without that knowledge.
CIS Controls compared with other security standards
The CIS Controls are frequently used together with other frameworks rather than instead of them. CIS publishes mappings to NIST CSF, NIST SP 800-53, ISO/IEC 27001 and other references, so a single Safeguard can serve as evidence for several obligations.
| Standard | Nature | Certification | Relationship to CIS Controls |
|---|---|---|---|
| CIS Controls | Prioritized technical safeguards | No formal certification | Reference point |
| ISO 27001 | Information security management system | Accredited certification | CIS Safeguards can implement Annex A controls |
| NIST CSF | Outcome-based risk framework | None | CIS supplies concrete actions for CSF outcomes |
| NIST SP 800-53 | Comprehensive control catalog | Via FedRAMP or agency authorization | Far larger; CIS is a prioritized subset in spirit |
| Cyber Essentials | UK baseline scheme | Certification available | Overlaps strongly with IG1 |
A useful way to think about the relationship is that ISO 27001 tells an organization how to manage security, NIST CSF describes what outcomes to achieve, and the CIS Controls specify which defensive actions to take first. CIS also publishes the separate CIS Benchmarks, which are detailed configuration guides for specific products and support Control 4.
Adopting the CIS Controls in practice
Adoption usually starts with a gap assessment against the relevant Implementation Group. Each Safeguard is scored for policy, implementation, automation and reporting, which produces a maturity baseline and a remediation roadmap.
- Determine the Implementation Group from data sensitivity, staff capacity and threat exposure.
- Assess each Safeguard and record evidence, not opinions.
- Prioritize gaps by attack relevance and cost, starting with Controls 1 to 6.
- Assign owners and deadlines for each remediation item.
- Measure progress quarterly and reassess after major changes.
Free tools such as the CIS Controls Self Assessment Tool and published community defense models help explain which attack techniques each Safeguard mitigates, which supports budget discussions with management.
Limitations and common misunderstandings
The CIS Controls are guidance, not a guarantee. Implementing every IG1 Safeguard does not make an organization immune; it removes the most frequently exploited weaknesses and raises the cost of attacks.
- No official certification exists, so claims of being CIS certified usually refer to third-party assessments.
- Paper compliance is a risk: a documented policy without technical enforcement scores poorly in a real attack.
- Version confusion occurs because older material still refers to 20 Controls from version 7.
- Governance is thin compared with ISO 27001, so risk management and leadership duties need another framework.
Explained without jargon
The CIS Controls are like a home safety checklist ordered by importance. First you make sure you know every door and window in the house. Then you lock them. After that you install smoke detectors and keep spare keys in a safe place. Cameras and professional alarm monitoring come later.
For businesses, the list shows which security steps to take first. A small company with little time does not get lost in hundreds of rules. A large company can keep building on the same foundation.
A typical use case
A logistics company with 120 employees and a two-person IT team wants to reduce ransomware risk after a competitor is attacked. It chooses Implementation Group 1 and performs a gap assessment over four weeks.
The assessment finds that the asset inventory misses about 30 laptops, administrator accounts lack multi-factor authentication and backups are stored on the same network as production servers. Over six months the team builds an automated inventory, enforces MFA on all remote and privileged access, moves backups to an isolated, immutable store and standardizes laptop configuration with a CIS Benchmark. A follow-up assessment shows IG1 coverage rising from roughly 40 percent to over 90 percent, and the same evidence later supports the company’s cyber insurance renewal.