CIS Controls
Also known as: CIS Critical Security Controls, SANS Top 20, CIS Top 18, CIS CSC
The CIS Controls (formerly CIS Critical Security Controls) are a set of 18 prioritized cybersecurity best practices published by the Center for Internet Security (CIS).
They are organized into three Implementation Groups (IGs) based on organizational size and risk profile: IG1 covers the minimum essential cybersecurity hygiene for all organizations; IG2 adds controls for organizations with moderate resources; IG3 covers advanced controls for organizations facing sophisticated threats. CIS Controls v8 (2021) is the current version.
CIS Controls, explained at three levels
At home
The CIS Controls are a prioritized to-do list for cybersecurity. Instead of an exhaustive list of everything you could do to be more secure, it tells you what to do first -- the 18 controls that defend against the attacks organizations face most often. Control 1 says know what devices are on your network; Control 2 says know what software is running. You cannot protect what you do not know you have. The list is designed to be practical for organizations of any size, starting with the basics.
At work
The CIS Controls give your security team a practical, prioritized roadmap for reducing the most common attack vectors. They are organized into three Implementation Groups: IG1 (basic cyber hygiene -- essential for all organizations), IG2 (adds controls for organizations with dedicated security staff), and IG3 (adds advanced controls for large organizations facing sophisticated threats). An organization starts with all 56 IG1 safeguards before moving to IG2's additional controls.
At home
The 18 CIS Controls are: 1. Inventory of Enterprise Assets, 2. Inventory of Software Assets, 3. Data Protection, 4. Secure Configuration, 5. Account Management, 6. Access Control Management, 7. Continuous Vulnerability Management, 8. Audit Log Management, 9. Email and Web Browser Protections, 10. Malware Defenses, 11. Data Recovery, 12. Network Infrastructure Management, 13. Network Monitoring, 14. Security Awareness Training, 15. Service Provider Management, 16. Application Software Security, 17. Incident Response Management, 18. Penetration Testing.
At work
CIS Controls v8 introduced significant restructuring from v7.1. The controls were reorganized to reflect modern hybrid and cloud environments (cloud and mobile are addressed within each control rather than as separate controls), implementation guidance is now expressed as 153 individual safeguards (formerly sub-controls), and Implementation Groups provide clearer guidance for smaller organizations. CIS also publishes Cloud Companion Guides for AWS, Microsoft Azure, and Google Cloud that map CIS Controls to each cloud provider's native security features.
At home
CIS Controls map to multiple compliance frameworks, reducing duplication of effort for organizations subject to multiple requirements. CIS publishes mapping documents showing how CIS Controls align to NIST CSF, ISO 27001 Annex A, HIPAA Security Rule, and PCI DSS. Organizations using CIS Controls as their primary framework can use these mappings to demonstrate compliance evidence for multiple frameworks simultaneously.
At work
From a practitioner standpoint, the CIS Controls' Implementation Group structure makes them more operationally useful than many frameworks for resource-constrained organizations. An SME with no dedicated security staff can identify IG1 safeguards as their baseline and track completion against a specific, finite list -- far more actionable than 'implement reasonable security'. CIS also publishes implementation toolkits, including the CIS CSAT (Controls Self-Assessment Tool) for tracking safeguard completion. The biggest implementation risk is treating safeguard completion as binary rather than continuous -- CIS Controls require ongoing monitoring and reassessment, not a one-time implementation.
Real-world examples
At home
Carlos runs IT for a 50-person manufacturing company and was unsure where to start with improving their cybersecurity. He downloaded the CIS Controls IG1 safeguards -- 56 specific security actions designed for small organizations without a dedicated security team. Starting with asset inventory and secure configuration, he worked through the list over six months and reduced the company's attack surface significantly.
At work
The security team at Harrington Financial Services used the CIS Controls as their primary cybersecurity framework after determining that their SOC 2 audit requirements, NIST CSF assessment, and internal security program all overlapped significantly. By mapping CIS Controls to each framework's requirements, they reduced their control evidence collection effort by 40% and completed their annual security review in half the time.
How it compares
| Feature | CIS Controls | NIST Cybersecurity Framework | ISO 27001 |
|---|---|---|---|
| Format | 18 controls with 153 specific safeguards | 6 functions with categories and subcategories | Clauses 4-10 with 93 Annex A controls |
| Prioritization | Implementation Groups 1-3 by organization size/risk | Tiers 1-4 by maturity | Risk-based; all applicable controls required |
| Certification | No certification (CIS CSAT for self-assessment) | No certification | ISO 27001 certificate from accredited body |
| Primary strength | Practical, actionable, threat-informed | Strategic framework, integrates with other standards | Globally recognized, auditable management system |
| Best for | Implementation roadmap, especially for SMEs | Framework integration and gap analysis | Vendor assurance and regulatory recognition |
CIS Controls are the most actionable and threat-informed framework -- ideal for organizations that want a prioritized implementation roadmap. NIST CSF is a strategic integration framework. ISO 27001 is the globally recognized certification standard. Most mature organizations use all three in complementary ways.
For analysts
In BA artefacts, CIS Controls provide a useful reference for security NFRs, particularly for systems that handle sensitive data or are internet-facing. When documenting requirements, reference the specific CIS Control safeguard that a technical requirement addresses -- for example, 'access control for this system must satisfy CIS Control 6 (Account Management) safeguard 6.1 (Establish an Access Granting Process).' This gives development and security teams a clear, external reference for why the requirement exists and how to validate it.
History & origin
The CIS Controls originated as the SANS Top 20 Critical Security Controls, developed in 2008 by a consortium of US government, military, and intelligence agencies responding to a wave of nation-state attacks on defense contractors. The controls were originally driven by NSA and US Cyber Command threat intelligence about the attack techniques actually being used against US government systems -- making them unusually threat-relevant compared to compliance-driven frameworks. SANS transferred stewardship to the Council on Cyber Security in 2013, which merged with CIS. CIS Controls v8 (2021) reduced the original 20 controls to 18 and reorganized them around activities rather than individual technologies, reflecting the shift to cloud and mobile environments.