CIS Controls v8.1: The 18 Security Controls Explained for IT Teams

The CIS Critical Security Controls (CIS Controls) are a short, prioritised list of the security actions that stop most cyber attacks. They are published free by the Center for Internet Security (CIS), a US non-profit, and maintained by a global community of practitioners. The current version, v8.1, has 18 controls broken down into 153 safeguards.

What are the CIS Controls?

Each of the 18 controls describes an area of defence. Each control contains safeguards: specific, measurable actions, such as “Use a software inventory tool” or “Require MFA for remote network access”.

Safeguards are assigned to Implementation Groups (IGs) so organisations can start with what matters most:

Every safeguard is also labelled with an asset type (devices, software, data, users, network, documentation) and a security function (Govern, Identify, Protect, Detect, Respond, Recover), aligned with the NIST CSF 2.0 functions.

History and why it was introduced

The controls were introduced because organisations were overwhelmed by long control lists and needed to know which actions actually stop the attacks they face.

Main objectives:

1. Prioritise the safeguards that defend against common attacks.
2. Make security measurable with specific safeguards.
3. Scale from small businesses to large enterprises.
4. Map cleanly to other frameworks and regulations.

Who uses the CIS Controls?

Are the CIS Controls mandatory?

No. They are voluntary. They become required when:

• a contract or cyber insurance policy asks for alignment;
• a regulator or law refers to them: for example, several US state data security laws offer a defence to businesses that follow recognised frameworks, and the CIS Controls are listed among them in states such as Ohio.

Key requirements: the 18 controls

Examples of IG1 safeguards

• Establish and maintain a detailed enterprise asset inventory (1.1).
• Address unauthorised assets (1.2).
• Establish and maintain a software inventory (2.1).
• Establish and maintain a data management process (3.1).
• Establish and maintain a secure configuration process (4.1).
• Use unique passwords (5.2) and disable dormant accounts (5.3).
• Require MFA for externally exposed applications (6.3) and for remote network access (6.4).
• Perform automated operating system and application patch management (7.3, 7.4).
• Collect audit logs (8.2).
• Perform automated backups (11.2) and protect recovery data (11.3).
• Train the workforce to recognise social engineering attacks (14.2).

How to implement the CIS Controls

1. Decide your Implementation Group. Most small IT companies start with IG1, even if they will aim for IG2 later.
2. Assess your current state. CIS offers a free self-assessment tool (CIS CSAT) for registered users.
3. Start with inventory. Controls 1 and 2 underpin everything else: you can’t secure what you don’t know about.
4. Quick wins: MFA everywhere, automatic patching, disk encryption, backups with an offline or immutable copy, and email filtering with DMARC.
5. Use CIS Benchmarks for secure configuration of operating systems, cloud accounts and applications (Control 4).
6. Build routines: monthly vulnerability reviews, quarterly access reviews, yearly incident response exercises.
7. Measure progress against the safeguards and report it.
8. Move to IG2 when your environment, data or customers require it.

Documentation and policies

• Asset and software inventories
• Data management process and data inventory
• Secure configuration standards (often based on CIS Benchmarks)
• Account and access management process
• Vulnerability management process
• Audit log management process
• Backup and recovery process and test records
• Security awareness programme
• Service provider inventory and policy
• Secure development process
• Incident response plan and exercise records
• Penetration testing programme and reports

Audits and assessments

There is no official CIS Controls certification. Organisations demonstrate alignment through:

• Self-assessment with CIS CSAT or a spreadsheet.
• Third-party assessments against the controls.
• Mapping to certifications such as ISO 27001 or SOC 2.

CIS separately runs CIS SecureSuite membership and certifies that products correctly assess CIS Benchmarks, which is different from certifying an organisation.

Cost

Benefits

• Clear priorities: what to do first.
• Defends against common attacks such as ransomware, phishing and credential theft.
• Free and practical, written by practitioners.
• Maps to NIST CSF, ISO 27001, SOC 2, PCI DSS and many laws.
• Easy to explain to non-specialists.

Risks of ignoring basic hygiene

• Most successful attacks exploit missing basics: unpatched systems, no MFA, weak backups.
• Higher cyber insurance premiums or declined cover.
• Failed customer security reviews.

Common mistakes

• Starting with advanced tools before inventories and MFA.
• Trying to implement IG3 immediately.
• Untested backups. Safeguard 11.5 requires testing recovery.
• Forgetting cloud and SaaS assets in inventories.
• One-time projects instead of routines.

Challenges for IT companies

• Developer laptops with many tools and admin rights.
• Shadow IT and unmanaged SaaS accounts.
• Fast-changing cloud infrastructure that makes inventories go stale.
• Open-source dependencies, which fall under software inventory and application security.

Best practices

• Automate inventories from your MDM, cloud APIs and identity provider.
• Apply CIS Benchmarks through infrastructure as code.
• Use the CIS Controls as the technical layer under ISO 27001 or NIST CSF.
• Track safeguards with owners and due dates.
• Review the CIS mappings to reuse evidence across frameworks.

Tools that help

How the CIS Controls relate to other frameworks

Real-world examples

• US state law. Ohio’s Data Protection Act lists the CIS Controls among the frameworks that can support an affirmative defence in data breach litigation.
• MSPs commonly use CIS IG1 as a standard security baseline for small business clients.
• Illustrative scenario, not a real company: a 25-person development agency adopts IG1 after a client asks about security. In three months it builds asset and software inventories from its MDM, enforces MFA and disk encryption, automates patching and tests backups, and later uses the same evidence for ISO 27001.

Frequently asked questions

How many CIS Controls are there? 18 controls with 153 safeguards in version 8.1.

What is IG1? Implementation Group 1: 56 safeguards that CIS defines as essential cyber hygiene for every organisation.

Are the CIS Controls free? Yes. You register with CIS to download them.

Can a company be CIS certified? No. There is no organisational certification for the CIS Controls.

What is the difference between CIS Controls and CIS Benchmarks? The Controls are a prioritised list of security actions. The Benchmarks are detailed secure configuration guides for specific technologies.

What changed in v8.1? It added the Govern security function, updated safeguard wording and definitions, and aligned with NIST CSF 2.0.

Next steps

• Download the CIS Controls and pick your Implementation Group.
• Build your asset and software inventories.
• Close the IG1 quick wins: MFA, patching, encryption, backups, email filtering.
• Schedule a recovery test and an incident response exercise.