CIS Critical Security Controls v8

What it is

The CIS Critical Security Controls are a prioritised list of defensive actions, drawn from what attackers actually do, that give an organisation a practical security baseline. They exist to answer the question of what to do first, and are written so that small and large organisations can both apply them.

Who it applies to

• Organisations of any size that want a concrete, prioritised security baseline
• Small and medium organisations, which can start with Implementation Group 1 as basic cyber hygiene
• Security teams mapping their programme to NIST CSF, ISO 27001 or sector rules, as CIS publishes mappings
• Some insurers, customers and US state laws refer to the CIS Controls as an example of reasonable security

Key points

• Order matters: the first controls cover inventory of hardware and software, because you cannot protect what you do not know about
• Implementation Group 1 is the recommended starting point for every organisation, with IG2 and IG3 adding safeguards for more complex environments
• Data protection, secure configuration, account and access control management and continuous vulnerability management are core early controls
• Audit log management, malware defences, data recovery and security awareness training are all part of the baseline
• Service provider management and application software security address supply chain and in-house development risk
• CIS also publishes Benchmarks (hardening guides) and mappings to other frameworks that help turn the controls into configuration

Where to start

1. 1Download the current version and the Implementation Group 1 list from CIS
2. 2Assess yourself against IG1 safeguards and record the gaps, for example with the free CIS assessment tool
3. 3Fix asset and software inventory first, then secure configuration and patching
4. 4Use the CIS mappings to reuse the work as evidence for ISO 27001, NIS2 or customer audits