CIS Controls: Prioritized Safeguards & IG1-IG3

CIS Critical Security Controls

Security frameworks often describe what good looks like without saying where to start. The CIS Critical Security Controls (CIS Controls), maintained by the Center for Internet Security, take the opposite approach: a prioritized set of specific defensive actions, drawn from what attackers actually exploit, ordered so that the most effective basics come first. Version 8.1 contains 18 controls broken into about 150 safeguards, grouped into three Implementation Groups that tell an organization of any size which safeguards to tackle first.

The controls are concrete enough to measure — "what percentage of our endpoints are inventoried, managed, patched, and running endpoint protection?" — which makes them a practical engine for security roadmaps, and they map to broader frameworks such as the NIST Cybersecurity Framework.

TL;DR

18 controls, from asset inventory and software inventory to incident response and penetration testing, each with specific safeguards.
Implementation Groups: IG1 is essential cyber hygiene for every organization; IG2 and IG3 add safeguards for greater complexity and risk.
Start with inventories: you cannot protect assets, software, or accounts you do not know about.
Measure coverage with data — inventory versus management tools, patch status, MFA enrollment, backup tests.
Assign owners and evidence per safeguard and track progress as a roadmap.
Use CIS Benchmarks for secure configuration and published mappings to NIST CSF, ISO 27001, and SOC 2.

Quick Example

Coverage measured with data rather than opinion — active endpoints missing endpoint protection, by comparing the asset inventory with the EDR console export:

And the percentages that go on the security dashboard:

Each control on the roadmap gets numbers like these, an owner, and a target.

Core Concepts

The Eighteen Controls

Safeguards and Asset Types

Each control contains numbered safeguards — specific actions such as "establish and maintain a detailed enterprise asset inventory" or "use multi-factor authentication for externally exposed applications". Safeguards are tagged with the asset types they apply to (devices, software, data, users, network, documentation) and the security functions they serve, which helps map them to other frameworks.

Implementation Groups

Even large organizations benefit from verifying IG1 everywhere before pursuing IG3 refinements in a few places.

CIS Benchmarks

CIS Benchmarks are separate, consensus-based secure configuration guides for operating systems, cloud platforms, databases, containers, and applications, often with automated assessment tools. They are the practical way to implement Control 4 (secure configuration).

Building a Roadmap

Pick the target Implementation Group for the organization and for critical environments.
Assess current coverage per safeguard with data from inventories, endpoint management, identity, vulnerability scanning, logging, and backups.
Prioritize IG1 gaps first, especially inventories, MFA, patching, secure configuration, and backups.
Assign owners and define measurable targets (for example 98% of endpoints with endpoint protection).
Automate evidence collection so status updates continuously.
Review quarterly and adjust as the environment and threats change.

Typical early wins map directly to controls: complete asset inventory (Control 1), MFA for remote and administrative access (Control 6), timely patching (Control 7 — see Patch Management and Maintenance Windows), centralized logs (Control 8 — see Audit Logging), and tested backups (Control 11).

Mapping to Other Frameworks

CIS publishes mappings between the Controls and frameworks such as the NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001, PCI DSS, and SOC 2 criteria. Many organizations use the Controls as the implementation layer — the concrete safeguards — and report outcomes through CSF, while satisfying audit requirements for SOC 2 or ISO 27001 with the same evidence. See SOC 2 Compliance and Vulnerability Management.

Best Practices

Start With Inventories

Controls 1, 2, and 5 — assets, software, and accounts — underpin nearly every other safeguard. Invest in automated, reconciled inventories.

Measure, Do Not Self-Attest

Base status on data from systems of record and reconcile sources against each other; disagreements reveal unmanaged assets.

Fix the Basics Everywhere

Broad IG1 coverage reduces more risk than advanced controls in a few places.

Tie Controls to Owners and Budgets

Each control needs a responsible team, a target, and resources; otherwise roadmaps become wish lists.

Common Mistakes

Inventories From a Single Source

Jumping to Advanced Safeguards

Percentages Without Denominators

FAQ

What are the CIS Controls?

A prioritized set of 18 security controls with specific safeguards, published by the Center for Internet Security, that describe the most effective actions to defend against common cyberattacks.

What are Implementation Groups?

Three tiers of safeguards — IG1, IG2, and IG3 — that guide prioritization by organizational size, complexity, and risk. IG1 defines essential cyber hygiene for every organization.

How do the CIS Controls relate to NIST CSF?

The NIST Cybersecurity Framework describes high-level outcomes; the CIS Controls describe concrete safeguards that achieve many of those outcomes. CIS publishes mappings so organizations can use both together.

What is the difference between CIS Controls and CIS Benchmarks?

The Controls are a prioritized program of security actions across an organization. The Benchmarks are detailed secure configuration guides for specific technologies, used to implement the secure configuration control.

Where should a small organization start?

With IG1: inventory devices and software, manage accounts and enforce MFA, keep systems patched and securely configured, protect against malware, back up data and test restores, and train staff.