CIS Controls v8.1: The 18 CIS Critical Security Controls

What Are the CIS Controls?

The CIS Critical Security Controls (CIS Controls) are a prioritized set of cybersecurity best practices published by the Center for Internet Security. The current version, CIS Controls v8.1, organizes 153 Safeguards under 18 Controls and sorts them into three Implementation Groups so organizations can adopt defenses in order of impact and available resources.

CIS is an independent 501(c)(3) nonprofit, and a volunteer practitioner community develops the Controls. They are free and prescriptive: each Safeguard is a specific, measurable action, such as requiring MFA for remote network access.

Framework Metadata

• Governing Body: Center for Internet Security, Inc. (CIS)
• Current Version: CIS Controls v8.1 (18 Controls, 153 Safeguards)
• First Release Year: 2008, as a community-developed priority list; maintained by CIS since 2015
• Last Major Update: v8.1 in June 2024 (iterative); v8 in May 2021 consolidated 20 Controls into 18

Why the CIS Controls Matter to Security & Compliance Leaders

A defensible definition of "reasonable security." Ohio (2018), Utah (2021), and Connecticut (2021) name the CIS Controls among the recognized frameworks that can support a defense against certain data breach claims. Eligibility depends on each statute and on how closely the program conforms, so counsel should evaluate applicability.

Procurement and vendor risk reviews. Security questionnaires and cyber insurance applications ask about MFA, endpoint protection, backups, and logging, which map closely to IG1 Safeguards.

Audit readiness across programs. Official CIS mappings let teams use the Safeguards as the operational layer beneath frameworks that state outcomes but not actions.

Risks & Business Impact

• Audit failure risk: CIS does not certify organizations, but SOC 2, ISO 27001, and PCI DSS auditors test the same practices. Weak asset inventory or log retention surfaces as findings in those audits.
• Contractual exposure: Contracts increasingly require "industry-standard controls." Claiming CIS alignment in a questionnaire without evidence creates misrepresentation risk.
• Regulatory penalties: After a breach, regulators assess whether security was reasonable. Missing baseline hygiene weakens that case.
• Operational burden: 153 Safeguards drift quickly in spreadsheets.
• Security exposure: The Controls are prioritized from attack data. Skipping IG1 leaves the techniques behind most ransomware and credential-theft incidents unaddressed.

Requirements & Control Expectations

The 18 Controls (v8.1): (1) Inventory and Control of Enterprise Assets; (2) Inventory and Control of Software Assets; (3) Data Protection; (4) Secure Configuration of Enterprise Assets and Software; (5) Account Management; (6) Access Control Management; (7) Continuous Vulnerability Management; (8) Audit Log Management; (9) Email and Web Browser Protections; (10) Malware Defenses; (11) Data Recovery; (12) Network Infrastructure Management; (13) Network Monitoring and Defense; (14) Security Awareness and Skills Training; (15) Service Provider Management; (16) Application Software Security; (17) Incident Response Management; (18) Penetration Testing.

• Implementation Groups: IG1 contains 56 Safeguards and defines essential cyber hygiene. IG2 adds 74 (130 total). IG3 adds 23 (all 153). For IG-by-IG guidance, see Apptega's complete guide to CIS compliance.
• Safeguard attributes: Each Safeguard is tagged to an asset class (Devices, Software, Data, Users, Network, and Documentation, added in v8.1) and a security function (Govern, added in v8.1, plus Identify, Protect, Detect, Respond, Recover).
• Documentation: Several Safeguards require written, maintained processes, such as a data management process (3.1) and a vulnerability management process (7.1).
• Evidence expectations: Inventories, configuration baselines, MFA reports, scan results, and backup test records.
• Monitoring cadences: Automated internal and external vulnerability scans quarterly or more often (7.5, 7.6), audit log retention of at least 90 days (8.10), and quarterly data recovery testing (11.5).
• Audit involvement: Self-assessment or third-party review; results often support other audits.

Process Overview (Implementation Lifecycle)

1. Readiness Assessment: Define scope and select a target IG based on data sensitivity and risk profile.
2. Gap Analysis: Score each in-scope Safeguard as implemented, partially implemented, or not implemented.
3. Remediation: Close IG1 gaps first, starting with asset and software inventories, since later Safeguards depend on them.
4. Control Testing: Validate each Safeguard with operating evidence, not policy statements alone.
5. Independent Assessment: Optionally have a third party validate scoring.
6. Ongoing Monitoring: Track recurring Safeguards, reassess at least annually, and remap when CIS releases a new version.

Common Misconceptions

• "We can get CIS certified." CIS does not certify organizations. Third parties can assess alignment, but no official certificate exists.
• "CIS Controls and CIS Benchmarks are the same." Benchmarks are product-specific configuration guides. Control 4 references them as a way to meet secure configuration Safeguards.
• "IG1 is only for small businesses." CIS positions IG1 as the minimum for every enterprise, regardless of size.
• "Implement the Controls in numerical order." Prioritization runs by Implementation Group, not by Control number.
• "CIS alignment equals regulatory compliance." Mappings support alignment with HIPAA or PCI DSS but do not satisfy those requirements on their own.

Framework Relationships & Crosswalks

• NIST CSF 2.0: v8.1 realigned its security functions to CSF 2.0, including Govern. CSF defines outcomes; CIS prescribes actions. For a deeper comparison, see how NIST CSF and CIS v8 compare.
• NIST SP 800-53 Rev. 5 and SP 800-171: CIS maps to the 800-53 low and moderate baselines and to 800-171, but does not replace the 800-171 requirements assessed under CMMC.
• ISO/IEC 27001:2022: Safeguards support many Annex A controls. ISO's ISMS requirements in Clauses 4 through 10 fall outside CIS scope.
• PCI DSS v4.0: An official mapping exists, but PCI-specific requirements such as ASV scanning still apply to the cardholder data environment.
• HIPAA: CIS publishes a HIPAA mapping. Safeguards can support risk management under 45 CFR 164.308(a)(1) but do not replace the required risk analysis.
• CMMC and GDPR: CIS maps v8.1 to CMMC 2.0. For GDPR, the Safeguards can support Article 32 security measures.

How Compliance Automation Platforms Support This

• Control mapping: One Safeguard links to every framework requirement it supports, a practice covered in our control mapping entry.
• Evidence collection: Integrations pull asset and vulnerability data.
• Cross-framework alignment: Apptega's framework crosswalking lets teams run CIS v8.1 alongside NIST, ISO, or CMMC from one control set.
• Continuous monitoring: Stale evidence triggers tasks and alerts.
• Reporting: IG-level scoring shows progress.

In Apptega's 2025 State of Continuous Compliance Report, 66% of surveyed security providers primarily use a GRC or compliance automation platform, while 16% still rely mainly on spreadsheets.

Real-World Use Cases

• MSSPs: Providers standardize an IG1 assessment as an entry offering, then expand into IG2 remediation and monitoring.
• SaaS providers: Teams use IG2 Safeguards as the operational playbook for SOC 2 readiness.
• Healthcare: Covered entities use Safeguards as implementation detail in HIPAA Security Rule risk management.
• Financial services: Banks and lenders use CIS's mapping to 23 NYCRR 500 to show how technical controls support NYDFS obligations.
• Government contractors: Defense suppliers use the CMMC 2.0 and 800-171 mappings to prioritize hygiene work before a formal assessment.
• Multi-framework enterprises: Kalahari Resorts manages 16 frameworks as one program in Apptega. Its CISO, Tim Everson, put it plainly: "Being able to cross-map between different frameworks is huge. I don't want to have to gather the same data 16 different times."

Summary

The CIS Controls give security and compliance leaders a prioritized, measurable baseline that maps to the frameworks auditors already expect. Starting with IG1 and crosswalking Safeguards to NIST, ISO, PCI DSS, and HIPAA makes the CIS Controls a durable foundation for multi-framework programs.

‍