Frameworks and Standards

CIS Controls

A prioritized set of 18 Controls and associated Safeguards that helps you sequence practical defenses against common attacks.

Where you will see it: Used in governance, risk, and compliance work: control selection, audits, reporting, and security roadmaps.

What it is

A prescriptive, prioritized set of security practices that turns broad security goals into an ordered, implementable backlog.

Key points
  • 18 Controls with 153 Safeguards in version 8.1, designed as a practical defensive baseline.
  • Implementation Groups IG1 to IG3 help sequence work based on risk, resources, and operational complexity.
  • Strong focus on asset inventory, secure configuration, vulnerability management, identity, logging, and recovery.
  • Mapped to other frameworks, making it easier to translate between strategy and technical work.

How it works in broad strokes

  1. Inventory what you have: devices, software, identities, cloud resources, and data flows.
  2. Pick an Implementation Group based on your environment and resources, usually starting with IG1.
  3. Implement Safeguards in priority order, aiming for consistent coverage rather than perfect depth.
  4. Automate measurement where possible, such as configuration compliance, patch status, and log coverage.
  5. Expand from IG1 to IG2 and IG3 as your foundations become stable and operationally maintained.

Concrete example

A small organization starts with IG1: asset inventory, secure configuration standards, MFA for admin access, patching cadence, central logging, and tested backups. Once stable, it expands to deeper monitoring and hardening in IG2.

Why it matters

Security teams often waste effort on low impact work. CIS Controls helps you start with the defenses that most reliably reduce common attack paths.

Security angle

  • Use CIS as a technical execution layer under a higher level framework such as NIST CSF or ISO 27001.
  • Attach each Control to an owner and a measurable outcome, not just a policy statement.
  • Treat logging and backups as first class safeguards, because they determine detection and recovery success.

Common pitfalls

  • Trying to implement IG3 first, which usually collapses under operational load.
  • Doing inventory once and then letting it drift, which breaks many downstream safeguards.
  • Focusing on tools instead of coverage, such as buying EDR but not ensuring all endpoints are enrolled.
  • Implementing controls without measurement, so you cannot prove they keep working over time.

DEEP DIVE

▾

Controls and Safeguards: what you are actually implementing

CIS Controls are a prioritized set of Safeguards aimed at reducing the most common attack paths. The model is intentionally practical: you implement specific Safeguards, measure them, and then expand as your capability grows.

The key idea is focus. Many programs fail because they spread effort across too many initiatives. CIS Controls try to keep you on a narrow set of actions that reliably reduce risk, especially early on.

In mature teams, CIS Controls often become the baseline that hardening standards, configuration management, and security operations are measured against.

Implementation Groups: prioritization that matches reality

Implementation Groups are what turn CIS Controls from a large library into an adoption path. IG1 is positioned as essential cyber hygiene, a minimum baseline that most organizations should achieve before investing in more advanced work.

IG2 and IG3 add depth for organizations with greater complexity, higher sensitivity data, or more targeted threats. This helps teams avoid the common mistake of skipping fundamentals while chasing sophisticated detections.

The practical benefit is planning. You can scope a year of work around an IG level, communicate expectations, and measure progress without arguing over every individual Safeguard.

How CIS Controls show up inside real programs

Most organizations implement CIS Controls through a gap assessment tied to evidence. For each Safeguard, teams define what acceptable implementation looks like, where it is configured, and how it is verified over time.

Controls become operational when they are embedded into normal workflows. Asset inventory links to onboarding and offboarding, configuration hardening links to build pipelines, and logging and monitoring link to incident response playbooks.

A strong program also treats exceptions as first class risk decisions. If a Safeguard cannot be implemented for a system, the reason, compensating controls, and review date should be explicit.

Misunderstandings that create checkbox security

One misunderstanding is treating CIS Controls as a compliance stamp. The value is in consistency and verification. A Safeguard that exists only on paper is not a control, it is a story.

Another trap is implementing tools without operational ownership. Buying a platform does not implement a Safeguard unless people know how to run it, maintain it, and respond to what it produces.

Teams also underestimate dependencies. Many Safeguards assume a functioning asset inventory, identity management, and change control process. If those foundations are weak, progress will feel chaotic.

How to start: build momentum with IG1

Start by selecting an IG level, usually IG1, and make it a baseline for the next cycle. Establish a small set of verification signals, such as coverage dashboards, configuration checks, and audit friendly evidence.

Deliver early wins that reduce common attacks, for example tightening identity, patching, and backup reliability. Use those wins to build trust and funding for the next wave of Safeguards.

Then expand toward IG2 only after the basics are stable. The goal is not to complete a list, but to reach a reliable operating state that stays true month after month.