CIS Controls v8.1: The 18 Controls and Implementation Groups Explained

The CIS Controls answer the question most small security teams actually have: what should we do first? Published by the Center for Internet Security, the Critical Security Controls are a prioritised list of 18 controls and 153 specific safeguards that defend against the attacks seen most often in practice. Unlike outcome-based frameworks, each safeguard is a concrete action, such as "establish and maintain a software inventory" or "use multi-factor authentication for externally exposed applications".

Version 8.1, released in June 2024, aligned the Controls with the NIST Cybersecurity Framework 2.0, including its new Govern function. This guide explains the 18 controls, the three Implementation Groups, how to roll out IG1 in an IT or SaaS company, the documents you will need, and how the Controls map to the frameworks your customers ask about.

What are the CIS Controls?

The CIS Critical Security Controls are a set of cyber defence best practices developed by a community of practitioners and maintained by the Center for Internet Security, a US non-profit. Each of the 18 Controls contains a number of Safeguards (153 in total in v8.1). Each Safeguard has:

• A short, actionable description.
• An asset type it applies to (devices, software, data, users, network, and in v8.1 documentation).
• A security function aligned with the NIST CSF (govern, identify, protect, detect, respond, recover).
• The Implementation Groups it belongs to.

The Controls are free to download and use. CIS also publishes the CIS Benchmarks, detailed secure configuration guides for operating systems, cloud platforms and applications, which support Control 4.

History and why they were created

The Controls began in 2008 as the "Consensus Audit Guidelines" and later the "SANS Top 20", created by US government agencies and private sector experts who wanted a short list of defences based on how real attacks worked, rather than long catalogues. CIS took over stewardship in 2015. Version 7 (2018) introduced Implementation Groups. Version 8 (2021) reorganised the controls by activity rather than by who manages devices, reflecting cloud and remote work, and reduced them from 20 to 18. Version 8.1 (June 2024) refined safeguard descriptions, added a governance focus and the documentation asset type, and aligned with NIST CSF 2.0.

The idea throughout has been prioritisation: a small set of actions that stop the majority of common attacks, so that organisations with limited resources can make real progress.

Who uses the CIS Controls?

• Small and mid-sized businesses and IT services firms building a first security programme.
• Managed service providers standardising security across clients.
• SaaS companies that need concrete technical safeguards behind their ISO/IEC 27001 or SOC 2 programme.
• Public sector bodies; several US states and local governments use them as a baseline.
• Cyber insurers and auditors, which often ask questions closely matching IG1 safeguards.

The Controls are voluntary and global. Some US state laws and regulators have referred to them as an example of reasonable security, and they are often used to show that an organisation took recognised measures.

The 18 CIS Controls

No.	Control	What it is about
1	Inventory and Control of Enterprise Assets	Know every device, physical, virtual or cloud, that connects to your environment
2	Inventory and Control of Software Assets	Know and authorise all software; remove what is unauthorised
3	Data Protection	Identify, classify, handle, retain and dispose of data securely; encrypt sensitive data
4	Secure Configuration of Enterprise Assets and Software	Hardened configurations, default accounts managed, automatic screen locks, firewalls
5	Account Management	Inventory of accounts, unique passwords, disabling dormant accounts, restricting admin rights
6	Access Control Management	Granting and revoking access, MFA, role-based access
7	Continuous Vulnerability Management	Vulnerability scanning and remediation, automated patching
8	Audit Log Management	Collecting, storing, reviewing and retaining logs
9	Email and Web Browser Protections	Supported browsers and email clients, DNS filtering, email security
10	Malware Defenses	Anti-malware, automatic updates, disabling autorun
11	Data Recovery	Backups, protection of recovery data, recovery testing
12	Network Infrastructure Management	Secure network devices, architecture and administration
13	Network Monitoring and Defense	Detection and prevention of network attacks
14	Security Awareness and Skills Training	Training on phishing, data handling, recognising incidents
15	Service Provider Management	Inventory, classification and assessment of service providers
16	Application Software Security	Secure development life cycle for software you build or acquire
17	Incident Response Management	Roles, contacts, process and exercises for incidents
18	Penetration Testing	Testing defences through simulated attacks

Implementation Groups

Implementation Groups (IGs) prioritise safeguards by the resources and risk profile of an organisation. They are cumulative.

• IG1: "essential cyber hygiene". 56 safeguards that every organisation should implement, suited to small organisations with limited IT and security expertise, protecting against common, non-targeted attacks.
• IG2: IG1 plus additional safeguards for organisations with dedicated IT staff, multiple departments and more sensitive data.
• IG3: all 153 safeguards, for organisations with security experts that handle sensitive data and face sophisticated attackers.

For most small and mid-sized IT companies, IG1 is the right first target, with selected IG2 safeguards where customer data or regulatory duties require them (for example, central log collection and application security safeguards in Control 16).

Key IG1 safeguards in practice

• Asset and software inventories (1.1, 2.1), pulled from device management, cloud accounts and procurement.
• Data inventory and handling (3.1 to 3.4): know where sensitive data lives, who can access it and how long it is kept.
• Secure configuration (4.1 onwards): documented baselines, automatic session locking, host firewalls, managed default accounts.
• Accounts (5.1 to 5.4): inventory of accounts, unique passwords, disabling dormant accounts, restricting administrator privileges to dedicated admin accounts.
• Access (6.1 to 6.5): processes for granting and revoking access, MFA for externally exposed applications, remote network access and administrative access.
• Vulnerabilities (7.1 to 7.4): a vulnerability management process, remediation, automated operating system and application patching.
• Logs (8.1 to 8.3): a log management process, collecting audit logs and ensuring adequate storage.
• Email and browsers (9.1, 9.2): supported versions only, DNS filtering.
• Malware (10.1 to 10.3): anti-malware with automatic updates, autorun disabled for removable media.
• Recovery (11.1 to 11.4): a recovery process, automated backups, protected and isolated recovery data.
• Network (12.1): keep network infrastructure up to date.
• Training (14.1 onwards): awareness programme covering phishing, authentication, data handling and incident reporting.
• Service providers (15.1): an inventory of service providers.
• Incident response (17.1 to 17.3): designated personnel, contact information and a reporting process.

Control 16 for software companies

If your business is building software, Control 16, Application Software Security, deserves more attention than its position in the list suggests. Its safeguards are mostly in IG2 and IG3, but for a software company they protect the product customers pay for. In plain terms, they ask you to:

• Establish a secure application development process covering secure design, coding standards, developer training, vulnerability management, security of third-party code and application security testing.
• Accept and address software vulnerabilities through a process that lets outsiders report them (a security contact or vulnerability disclosure policy), with a tracking system, severity ratings and remediation timelines.
• Perform root cause analysis on vulnerabilities, so that classes of bugs are fixed rather than individual instances.
• Maintain an inventory of third-party components, use up-to-date and trusted components, and assess their vulnerabilities, which today usually means a software bill of materials and automated dependency scanning.
• Use a severity rating system and prioritise fixes accordingly.
• Use standard hardening templates for application infrastructure, such as servers, databases and containers.
• Separate production and non-production systems, and keep production data out of development and test where possible.
• Train developers in application security concepts and secure coding.
• Apply secure design principles, such as least privilege, input validation and mediation of every access, and use vetted modules or services for security components like identity management and encryption.
• Implement code-level security checks, such as static and dynamic analysis, and conduct application penetration testing and threat modelling at the higher groups.

These line up closely with the NIST Secure Software Development Framework and OWASP SAMM, so a software company can satisfy several expectations with one secure development programme.

IG2 safeguards worth adding early

A pure IG1 programme leaves some gaps that matter to most companies handling customer data. These IG2 safeguards are often worth adding at the same time as IG1:

• Centralised audit log collection and review (Control 8), because investigations, customer audits and laws such as India's CERT-In Directions depend on logs being available.
• Encryption of sensitive data at rest and in transit (Control 3), expected by most customers and privacy laws.
• Centralised account and access management through SSO (Controls 5 and 6), which makes offboarding reliable.
• Service provider assessment (Control 15), since cloud and SaaS providers hold much of your data.
• A secure development process (Control 16) for any company that writes code.

How to implement the CIS Controls step by step

1. Decide your Implementation Group based on size, data and threats; most small IT firms start with IG1.
2. Assess your current state against each safeguard. CIS offers a free self-assessment tool (CIS CSAT) for this.
3. Build inventories first: devices, software, accounts, data and service providers. Later safeguards depend on them.
4. Fix identity and access: SSO, MFA, separate admin accounts, dormant account clean-up.
5. Harden and patch: secure baselines from the CIS Benchmarks, automated patching, vulnerability scanning.
6. Set up backups and test restores.
7. Collect logs centrally and keep them long enough for investigations and legal requirements.
8. Train staff and write an incident contact list and process.
9. Move to IG2 safeguards where your risk calls for them, including application security in Control 16 if you build software.
10. Re-assess regularly and report progress by control.

Documentation you will need

The Controls are action-oriented, but several safeguards require documented processes, and assessors will ask for evidence:

• Enterprise asset and software inventories.
• Data management process and data inventory.
• Secure configuration process and baselines.
• Account and access management processes.
• Vulnerability management and remediation process.
• Audit log management process.
• Data recovery process and restore test records.
• Security awareness programme and training records.
• Service provider inventory and, at IG2, management policy.
• Incident response process, personnel and contacts.
• For Control 16: secure application development process.

Assessment and certification

There is no official CIS Controls certification. Organisations self-assess, use internal audit, or ask a third party to assess them. Because the Controls map to ISO/IEC 27001, SOC 2 and the NIST CSF, the evidence you collect can be reused when customers need a certificate or an attestation report.

Timeline and cost considerations

IG1 is designed to be achievable with modest resources. Many safeguards use features already in your identity provider, device management, cloud platform and operating systems. The main costs are staff time to build inventories and processes, tools for device management, scanning, backup and logging if you do not have them, and training. IG2 and IG3 add more tooling and specialist staff.

Benefits and the risk of not having a baseline

The Controls give a clear, prioritised plan, translate directly into technical tasks, and are written by practitioners based on real attacks. They make it easier to answer insurer and customer questionnaires, and the mappings let one programme serve several frameworks.

There is no penalty for not using them. Without a baseline like IG1, small organisations often miss basics such as MFA on remote access, unpatched systems and untested backups, which are behind many ransomware incidents.

Common mistakes and challenges for IT companies

• Skipping inventories. You cannot patch, monitor or protect what you do not know about.
• MFA only for some systems. IG1 expects MFA on externally exposed applications, remote access and admin access.
• Daily work with admin accounts. Use separate privileged accounts.
• Backups on the same network or account as production, so ransomware encrypts both.
• Ignoring SaaS and cloud assets in inventories and logging.
• Forgetting Control 16 when your business is building software.

Best practices, tools and technologies

• Use CIS CSAT or a spreadsheet of safeguards with owners and status.
• Apply CIS Benchmarks or hardened images for servers, containers and cloud accounts.
• Automate patching and dependency updates; track exceptions.
• Keep immutable or offline backups and test restores on a schedule.
• Centralise logs from identity, cloud, endpoints and applications.
• Pair Control 16 with the OWASP Top 10 and ASVS for application security.

Patching, backups, hardening and monitoring for client websites and applications are part of our maintenance and support plans.

How the CIS Controls relate to other frameworks

Framework	Relationship
NIST CSF 2.0	CIS publishes a mapping; each safeguard is tagged with a CSF function.
ISO/IEC 27001	The Controls provide concrete technical safeguards behind many Annex A controls.
NIST SP 800-53	Mapped by CIS; SP 800-53 is far larger and more detailed.
Essential Eight	Australia's prioritised mitigation strategies; overlapping focus on patching, MFA, admin privileges and backups.
Cyber Essentials	UK certification scheme covering a similar basic set: firewalls, secure configuration, access, malware, updates.

Real-world implementation examples

CIS publishes case studies and community resources showing how organisations from local governments to small businesses implemented IG1. Many MSPs offer IG1-based service tiers so that clients get a known baseline.

An illustrative case for a 30-person software agency: an insurer's questionnaire asks about MFA, backups and patching. The agency adopts IG1, discovers several unmanaged laptops and an old staging server with default credentials, enables MFA across email, code hosting and cloud consoles, moves backups to a separate account with immutability, and turns on automatic patching. The insurer questionnaire, a client's security review and the agency's later ISO/IEC 27001 project all reuse the same evidence.

Next steps

1. Download v8.1 and pick your Implementation Group.
2. Self-assess against the safeguards.
3. Build inventories and fix identity, patching and backups first.
4. Add logging, training and incident response.
5. Map your progress to the framework your customers ask for.

Frequently asked questions

What is the latest version of the CIS Controls?

Version 8.1, released in June 2024. It has 18 Controls and 153 Safeguards.

What is CIS IG1?

Implementation Group 1, the set of 56 safeguards CIS calls essential cyber hygiene, intended as the minimum for every organisation.

Are the CIS Controls mandatory?

No. They are voluntary, though some regulators, insurers and customers reference them as evidence of reasonable security.

Can we get CIS certified?

There is no official CIS Controls certification. You can self-assess or obtain a third-party assessment, and use the evidence for ISO/IEC 27001 or SOC 2.

What is the difference between CIS Controls and CIS Benchmarks?

The Controls are a prioritised set of security actions. The Benchmarks are detailed configuration guides for specific technologies that help implement Control 4.

How do the CIS Controls relate to NIST CSF?

The CSF describes outcomes; the CIS Controls give concrete safeguards to achieve them. CIS publishes a mapping to CSF 2.0.

Why did the CIS Controls go from 20 to 18?

Version 8 reorganised controls by activity and consolidated some, reflecting cloud and remote work rather than who manages devices.

Are the CIS Controls suitable for cloud-only companies?

Yes. Version 8 and later were written with cloud, mobile and remote work in mind, and CIS publishes cloud companion guides.

How long does IG1 take to implement?

It depends on size and starting point. Many safeguards use features you already have; inventories and processes take the most time.

Which CIS Control covers software development?

Control 16, Application Software Security, covering a secure development process, vulnerability handling, third-party components, secure design and testing.

How should we report CIS Controls progress to management?

Track each safeguard in your Implementation Group with an owner and a status (not started, partial, implemented, measured), then report the percentage implemented per control. Highlight the safeguards that address your biggest risks, such as MFA, patching and backups, rather than only the total score.

Do the CIS Controls help with cyber insurance?

Often, yes. Insurer questionnaires commonly ask about MFA, privileged access, patching, backups, endpoint protection and incident response, which are all covered by IG1 safeguards. Being able to show evidence for them usually makes the application process easier.

Do the CIS Controls include governance?

Version 8.1 added governance emphasis and tags safeguards with the NIST CSF 2.0 functions, including Govern, along with a documentation asset type.