CIS Controls.
Prioritise cyber defence, justify the appropriate Implementation Group and assess implementation in your own operations with a clear audit trail.
- CIS Critical Security Controls v8.1
- By Jonathan Bezdek
- As of: 10/22/2026
- Reading time: 7 min.
Short answer.
CIS Controls are prioritised cyber defence recommendations from the Center for Internet Security. Version 8.1 organises 153 safeguards into 18 subject areas. Implementation Groups help organisations start according to risks and available resources. The groups build on one another; documented implementation is neither automatically certification nor evidence of all statutory duties.
CIS Controls v8.1 as practical guidance.
CIS Controls structure selection of safeguards for systems and networks. A Control is a subject area; its Safeguards describe more specific fields of action. The publisher's v8.1 page describes this version as an iterative revision of v8, including clarified terminology, adjusted asset classes and alignment with NIST CSF 2.0.
The recommendations are not a generally applicable statutory obligation. An organisation can agree to use them as a working basis; customers or contracts may require particular evidence. The CIS FAQ explicitly clarifies that Controls do not replace other regulatory or formal validation procedures. Selection should therefore fit your own services and additional obligations.
CIS Controls and CIS Benchmarks have different tasks. Controls concern general security practices; Benchmarks concern secure configuration of specific products and technologies. A configuration finding can support implementation assessment but does not answer every organisational question. The publisher describes this distinction in its Controls FAQ.
Choose Implementation Groups by risk and resources.
Implementation Groups help organisations of different sizes prioritise. According to the CIS group overview, risk profile and available resources matter. IG1 includes 56 foundational safeguards; CIS recommends this starting point for every organisation. Limited security resources explain its orientation but create no blanket exception for wider risks or contractual requirements.
IG2 adds 74 safeguards to IG1 for greater operational complexity. The publisher's page describes dedicated IT staff, different departments and more sensitive information, among other things. IG2 therefore does not mean addressing only the additional items and omitting the foundations. The entire agreed scope is decisive.
IG3 adds another 23 safeguards and therefore includes all 153. CIS describes specialised security expertise and dealing with targeted attacks, among other factors. These groups are not a general maturity scale: a chosen group alone says neither whether its safeguards work nor which residual risks the organisation has accepted.
The main cyber defence work areas.
The following six areas group CIS Controls work editorially; they are not a new official catalogue structure. The published version, agreed Implementation Group and operations considered remain decisive for specific selection.
Understand assets and data.
Protection decisions need a traceable overview of the systems, software and information actually used. As practical preparation, owners should clarify which service is considered and which dependencies support it. An asset list loses value if operational changes no longer reach it or nobody can judge its completeness.
Connect secure configuration and vulnerability work.
Configuration, supported software and handling known vulnerabilities interact. For implementation, define responsibility and the change route alongside the technical requirement. Product-specific Benchmarks can help assess a configuration; they do not replace deciding which systems and operating conditions belong in the assessment.
Manage identities and access.
Permissions must fit tasks and protection needs. A practical assessment should consider settings alongside joiner, mover and leaver procedures. A correctly configured account type does not demonstrate that outdated access is reliably identified and revoked; suitable operational records help establish this.
Coordinate observation and response.
Security information must reach people able to assess and address it. For implementation, clarify who reviews alerts, how incidents are handed over and which deputy steps in. A tool's mere availability does not explain these responsibilities. A practised response task can show whether the agreed process actually works.
Consider recovery and service providers.
The service concerned often depends on backups, external services and agreed support channels. Check in practice who can restore which service during a disruption and what information they need. Evidence should show your own use scope; a provider report does not automatically answer every customer responsibility.
Include people and review.
Security practice needs understandable tasks and implementation assessment. As a working aid, teams can record who operates a measure, which observation shows its state and when reassessment is due. Adjustments make sense when services, threats or responsibilities change. A questionnaire completed once does not reflect such changes automatically.
Apply CIS Controls step by step.
Define the service concerned.
As a practical starting point, describe the service, its systems, information and external dependencies so that subsequent assessment has a recognisable boundary.
Justify the group and additional requirements.
Choose an Implementation Group based on risks and resources, and record which further statutory or contractual requirements require separate consideration.
Agree implementation and responsibility.
Translate the chosen working basis into specific tasks and name a person with suitable responsibility and authority for each task.
Collect operational records.
Link implementation with appropriate configurations, examination records or process evidence, and label their scope and the period considered.
Connect assessment and improvement.
Assess the strength of the evidence, address identified deviations and define how a correction's effect should be recognised.
Make new decisions after changes.
Review selection, responsibilities and evidence when the service, risk profile or available resources change materially.
What a CIS Controls assessment says.
An assessment is meaningful only within its described scope. Record which version and selection were assessed, which systems are covered and what evidence supports the result. A self-assessment can structure work; a group label or single aggregate score alone does not explain actual implementation.
The CIS Controls Assessment Specification provides a basis for a shared understanding of safeguard assessment. Public documentation lists a version for v8.1. The specific procedure and sampling needed for your purpose must be agreed before an assessment; this overview does not reproduce individual assessment instructions.
CIS Controls Accreditation concerns qualified providers of implementation, audit or assessment services. The public programme page describes confirmation of their competence and selection of a suitable provider. This is distinct from assessment of the customer organisation. It creates neither a general certificate for every Controls user nor a fixed validity period for their own implementation records.
Consider other frameworks as complements.
NIST CSF structures desired security outcomes, while CIS Controls helps prioritise practical security work. ISO 27001 addresses the management system and its independent certification. NIST SP 800-53 provides a broader security and privacy control catalogue. PCI DSS sets separate payment card data protection requirements; selecting Controls does not replace the respective evidence.
In Secani.
Secani provides its own editorial business catalogue based on CIS Controls v8.1. Profile fields record the agreed Implementation Group, cloud, OT and in-house software development, among other things. Groups are treated as cumulative prioritisation, rather than certification or maturity assessment; the catalogue is not an official CIS translation and its independent professional approval is pending.
Start with a reasoned working basis.
Choose a service whose security practices should be improved traceably. Agree scope, underlying version and suitable Implementation Group with the owners. Record who makes decisions about additional measures or accepted risks.
Then check what operational evidence already exists for that scope and what statements it supports. Plan missing work with owners and deadlines. This creates a verifiable task before extending a broad programme of measures across the organisation.
Frequently asked questions.
No. Implementation Groups prioritise a cumulative selection according to risks and resources; they are neither a certification scale nor a general maturity scale.
Yes. IG2 adds 74 safeguards to IG1's 56; IG3 then adds 23 and therefore includes all 153.
No. Controls describe general security practices; Benchmarks describe hardening of specific products and technologies. A configuration assessment therefore does not automatically evaluate all Controls implementation.
No. A chosen Controls working basis and independent assessment of an ISMS make different statements; additional statutory or contractual evidence requirements must still be examined separately.
Prioritise security work with a clear audit trail.
Discuss how you can manage your chosen scope, responsibilities and evidence in Secani.
This page explains CIS Controls in our own words and replaces neither publisher documents nor professional assessment. The agreed version, scope considered and applicable requirements take precedence.