The CIS Controls (CIS Critical Security Controls) are a set of 18 security practices, ranked by priority, published by the Center for Internet Security (CIS), a US nonprofit organization. The current version, 8.1, breaks those 18 controls down into 153 concrete safeguards and groups them into three implementation levels based on each company's size and resources. They are free and work as a practical list of what to protect first to defend against the most common attacks.
Their value lies in the order. Other frameworks describe what a security program should achieve; the CIS Controls say what to do and in what sequence, starting with whatever stops the most attacks for the least effort.
What the CIS Controls are
Pilots do not inspect the plane part by part before takeoff: they follow a short, ordered checklist, proven over thousands of flights, that covers what prevents the most accidents. They repeat it on every flight, and no item depends on anyone's memory. The CIS Controls are that checklist for a company's security.
They were built from real attacks: experts from government, industry and academia review how attackers get in and which measures would have stopped them. That is why the first controls are not sophisticated. They are basics many companies skip, such as knowing which devices are connected to their network.
They should not be confused with the CIS Benchmarks, published by the same organization. The controls say what to do; the Benchmarks explain how to securely configure each specific technology, from Windows to Microsoft 365. They are the tool for control 4 and the foundation of system hardening.
The 18 CIS Controls
This is the full list for version 8.1, with what each control asks for in business terms:
| Control | What it asks for |
|---|---|
| 1. Inventory of enterprise assets | Know which computers, servers and devices are connected to your network. |
| 2. Inventory of software | Know which programs are installed and allow only authorized ones. |
| 3. Data protection | Classify information and protect it according to its sensitivity. |
| 4. Secure configuration | Remove factory default settings and maintain a documented secure configuration. |
| 5. Account management | Control who has an account and disable the ones no longer in use. |
| 6. Access control management | Give each account only the permissions it needs, with multifactor authentication. |
| 7. Vulnerability management | Find and fix flaws on an ongoing basis. |
| 8. Audit log management | Keep and review system activity records. |
| 9. Email and web browser protections | Protect the two channels most attacks come through. |
| 10. Malware defenses | Stop malicious programs on computers and servers. |
| 11. Data recovery | Back up information and verify that it can be restored. |
| 12. Network infrastructure management | Keep network equipment updated and properly configured. |
| 13. Network monitoring and defense | Watch traffic and respond to anything unusual. |
| 14. Security awareness training | Teach employees to recognize and report attacks. |
| 15. Service provider management | Assess and oversee the third parties that handle your data or systems. |
| 16. Application software security | Build and buy software with security included. |
| 17. Incident response management | Have a plan, owners and practice for when something happens. |
| 18. Penetration testing | Simulate real attacks to verify that the controls work. |
Controls 5 and 6 prevent the most incidents for the smallest investment, and we cover them in depth in our guide to access controls.
Control 18, on the other hand, usually comes last: a penetration test pays off more once the basics are in place, and if you plan to hire one, see how to choose a pentesting provider.
Implementation groups: where to start
The pilot of a small private plane and the pilot of a commercial airliner follow different checklists, even though both start the same way. The CIS Controls do the same with their three implementation groups (IGs):
| Group | Who it is for | Safeguards |
|---|---|---|
| IG1 | Companies with a small IT team and no security specialists. This is the basic hygiene every company should have. | 56 |
| IG2 | Companies with several departments, sensitive customer data or compliance obligations. | The 56 from IG1 plus 74, for 130 in total |
| IG3 | Organizations with security specialists, highly sensitive data or strict regulation. | All 153 |
Most midsize companies should start with IG1 even if their goal is IG2. A distributor with 80 employees and two people in IT, for example, often discovers at the very first control that it has more connected devices than it thought: laptops belonging to former employees, a printer with internet access, a forgotten test server. None of them were on the list, so none of them were getting updates. That finding, which costs nothing, changes the order of everything else.
CIS Controls, NIST and ISO 27001
The CIS Controls do not compete with other frameworks; they complement them. The difference is in the level of detail:
| Framework | What it is | Certifiable? |
|---|---|---|
| CIS Controls | A prioritized list of concrete technical actions. | No. Progress is assessed safeguard by safeguard. |
| NIST CSF 2.0 | An outcomes framework organized into six functions: govern, identify, protect, detect, respond and recover. | No. It is used as a reference. |
| ISO 27001 | An information security management system, with processes, owners and continual improvement. | Yes, through a certification body. |
CIS publishes mappings between its safeguards and both frameworks, so the work is not duplicated: implementing IG1 advances a good share of the technical controls ISO 27001 asks for. What CIS does not cover is deciding which risks to address first in your business, and that is the job of cybersecurity risk management.
How to implement them in your company
As in the cockpit, what matters is the discipline of running the checklist every time. This order works well for getting started:
- Measure where you stand. Check how many IG1 safeguards you already meet. A cybersecurity assessment gives you that starting point if you have never measured it.
- Start with the inventories. Controls 1 and 2 are the foundation: you cannot protect what you do not know you have.
- Cover the rest of IG1 in blocks: accounts and access, secure configuration, backups, email and device protection, and training.
- Assign an owner to each control, with evidence that it is met: a report, a screenshot, a log.
- Review every quarter and decide whether to move on to IG2 once IG1 is complete.
Completing IG1 does not have to be a year-long project. With a small team and outside help on the technical side, many companies cover it in a few months, since many of its safeguards are configuration changes and team habits.
Frequently asked questions about the CIS Controls
In cybersecurity, CIS is the Center for Internet Security, the nonprofit organization that publishes the CIS Controls and the CIS Benchmarks. That is why "CIS Controls" and "CIS Critical Security Controls" refer to the same thing: the 18 critical security controls.
No general law requires them, but they are a recognized reference: auditors, insurers and corporate customers accept them as evidence of good practice, and cyber insurance questionnaires often ask about practices that match IG1, such as multifactor authentication and backups.
Version 8.1, released in 2024, keeps the 18 controls from v8 and adjusts the wording of several safeguards, adds a governance function to align with NIST CSF 2.0 and updates asset definitions. If you were already working with v8, your progress carries over.
The controls and the Benchmarks are free. The cost lies in your team's time and in any tools you are missing, such as endpoint protection or backups. Many companies already have some of those tools and only need to configure them properly.
Hardening is the process of configuring systems to reduce their attack surface, and it corresponds to control 4 (secure configuration).
Yes, especially the technical side: inventories, configuration, device and email protection, access and vulnerability scanning. Your company keeps the decisions and the evidence. That is how our managed cybersecurity services work.
Zoilijee is Founder and KAM of TecnetOne, she specializes in business development for Cloud, Hybrid and Enterprise Cyber Resilience environments, her main vision is to empower and protect organizations on new emerging threats in IT.
