Start with Cyber Hygiene. Build Toward Your Risk Profile.
The CIS Critical Security Controls provide prioritized actions for improving cyber defense. Version 8.1 updates guidance and alignment with NIST CSF 2.0, including its Govern function, while retaining the framework of 18 Controls and 153 Safeguards.
Use the Implementation Groups to select a practical starting point based on your resources, data, and risk exposure. The groups build on one another, allowing a security program to expand without abandoning its foundational safeguards.
- IG1: 56 Safeguards for essential cyber hygiene.
- IG2: 130 Safeguards in total, including IG1.
- IG3: all 153 Safeguards, including IG1 and IG2.
Official guidance: CIS Controls v8.1 overview · CIS Implementation Groups.
Measure Safeguards Against Real Operations
Assess the applicable Safeguards individually. Record the owner, implementation status, supporting evidence, and remediation work so progress reflects operational changes rather than a policy document alone.
For asset management, practical evidence might include an inventory export and records showing how unknown devices are investigated. For recovery, a backup configuration is more useful when paired with a documented restoration test.
The CIS Controls describe security activities across a program. CIS Benchmarks provide technology-specific configuration recommendations. The two resources complement each other, but a configuration scan alone does not assess the full set of Controls.
Official guidance: CIS assessment guidance · Controls and Benchmarks.
The 18 CIS Control Areas
These summaries describe the focus of each Control. Use the official v8.1 Safeguards to define the detailed activities and assess implementation.
Enterprise Asset Inventory
Know which devices, systems, and cloud assets belong in your environment.
Software Inventory
Track authorized software and address unmanaged or unsupported applications.
Data Handling and Protection
Classify information and manage how it is stored, used, retained, and removed.
Configuration Baselines
Maintain secure settings for devices, operating systems, and applications.
Account Lifecycle
Manage user, administrator, and service accounts from creation to retirement.
Access and Privileges
Grant, review, and revoke permissions according to business need.
Vulnerability Reduction
Identify weaknesses and organize remediation to reduce exposure.
Security Log Operations
Collect and review records that support detection and investigation.
Email and Browser Safety
Reduce exposure to attacks delivered through messaging and browsing.
Malicious Software Defense
Prevent and detect harmful code across enterprise assets.
Recovery Readiness
Maintain and test the ability to restore trusted systems and data.
Network Device Security
Manage the configuration and operation of network infrastructure.
Network Detection and Defense
Monitor network activity and respond to suspicious behavior.
Workforce Security Skills
Equip people to recognize threats and perform their roles securely.
Third-Party Security
Assess and manage providers that handle sensitive data or critical services.
Software Lifecycle Security
Address security weaknesses in developed, acquired, and hosted applications.
Incident Preparedness
Establish the people, processes, and exercises needed to handle security incidents.
Adversarial Testing
Use penetration testing to evaluate weaknesses and verify defensive improvements.
Official guidance: Official CIS Controls list.
Make Cyber Defense a Measurable Practice
Use the Controls to prioritize security work, assign responsibility, and track improvements. Alignment with CIS Controls can support a broader compliance program; it does not replace a PCI DSS validation or SOC 2 examination.
For IT Teams
Start with reliable inventories, secure configurations, account management, and recovery practices.
For Security Teams
Translate Safeguards into owned activities, assess evidence, and track remediation against your risk priorities.
For Leadership
Select an appropriate Implementation Group and review progress, resourcing, and unresolved exposure.