What are CIS Controls?
The Center for Internet Security Controls are a prioritized set of cybersecurity safeguards developed and maintained by a global practitioner community. Currently at version 8.1, the framework organizes 18 controls into three Implementation Groups (IGs) that scale by organizational complexity and risk profile: IG1 for smaller or resource-constrained organizations, IG2 for mid-sized operations, and IG3 for high-risk enterprises. The controls map directly to NIST CSF, ISO 27001, HIPAA, and PCI DSS, which matters when a regulatory body asks what framework you used to demonstrate reasonable security.
That cross-framework mapping is the most underappreciated feature of the CIS Controls. It’s not just interoperability. It’s litigation and audit posture.
As mentioned, CIS Controls are organized into three IGs, and no, those are not Instagram posts. These implementation groups allow organizations to adopt them based on their resources and risk profile. For example:
- IG1 – Basic Cyber Hygiene (for small/less complex organizations)
- IG2 – Foundational Cybersecurity (for medium-sized businesses)
- IG3 – Advanced Security Measures (for large or high-risk enterprises)
You can look at the breakdown of the 18 CIS Controls (currently version 8.1, as of this post) below:
| Control Name | Purpose |
| Inventory and Control of Enterprise Assets | Maintain visibility into hardware devices connected to the organization. |
| Inventory and Control of Software Assets | Track and control the installation of authorized software to reduce vulnerabilities. |
| Data Protection | Safeguard sensitive data through encryption, access controls, and secure disposal. |
| Secure Configuration of Enterprise Assets and Software | Harden systems by removing default settings and reducing attack surfaces. |
| Account Management | Enforce least privilege and remove inactive or orphaned accounts. |
| Access Controls Management | Define and enforce who can access what resources and when. |
| Continuous Vulnerability Management | Regularly scan and remediate vulnerabilities. |
| Audit Log Management | Collect, review, and retain logs for detection and investigation. |
| Email and Web Browser Protections | Secure these commonly exploited interfaces. |
| Malware Defenses | Deploy anti-malware tools and regularly update them. |
| Data Recovery | Ensure reliable and secure backups exist and are tested regularly. |
| Network Infrastructure Management | Secure routers, switches, and other network devices. |
| Securing Awareness and Skills Training | Train users to recognize and avoid common threats. |
| Securing Operations Center (SOC) Procedures | Implement and document response processes and alert handling. |
| Service Provider Management | Assess and manage risks from third-party providers. |
| Application Software Security | Integrate security into the software development lifecycle (SDLC). |
| Incident Response Management | Plan for and practice incident detection, reporting, and recovery. |
| Penetration Testing | Validate security controls through regular testing and red teaming. |
Some tips for implementing these controls:
- Start with IG1: Focus on the most critical controls like asset inventory, account management, and secure configuration.
- Use the CIS Controls Self-Assessment Tool (CSAT): Available for free to help organizations evaluate and track their implementation maturity.
- Involve Leadership and IT: Successful adoption requires buy-in from both technical and executive leadership.
- Document Everything: Good records support compliance, audits, and continuous improvement.
Not all 18 controls carry equal regulatory weight. Four carry disproportionate legal risk when absent.
Control 1: Inventory and Control of Enterprise Assets. You can’t protect what you can’t enumerate. More critically, you can’t perform a breach notification analysis for data you didn’t know existed on a device you didn’t know was connected to your network. Absence of asset inventory is a direct liability in any post-breach forensics engagement, it creates ambiguity about scope that typically expands notification obligations rather than constraining them. Under the FTC’s LabMD precedent and subsequent enforcement actions, failure to inventory systems handling consumer data has been treated as per-se unreasonable security.
Control 2: Inventory and Control of Software Assets. Unauthorized or unmanaged software is the primary vector for supply chain compromise and insider threat. Regulatorily, unknown software on a network that subsequently becomes a breach vector demonstrates a failure to exercise oversight over the environment. In breach litigation, plaintiff attorneys specifically look for evidence that attackers used unauthorized tools or pathways that an asset management program would have detected.
Control 6: Access Control Management. Privilege creep and orphaned accounts are endemic in every organization that doesn’t actively manage them. From a legal exposure standpoint, Control 6 failures show up in two recurring scenarios: former employee access resulting in data exfiltration (which creates both breach notification obligations and potential civil liability), and excessive privilege enabling lateral movement post-initial compromise (which expands breach scope and notification cost). HIPAA’s minimum necessary standard and PCI DSS Requirement 7 both operationalize Control 6 principles, non-compliance with those frameworks starts with Control 6 gaps.
Control 17: Incident Response Management. The SEC’s cybersecurity disclosure rules, effective December 2023, require public companies to disclose material cybersecurity incidents within four business days of determining materiality. That determination requires a functioning incident response process. For organizations subject to state breach notification statutes, the clock starts at discovery — not when the incident response plan gets drafted. An organization without a documented, exercised IR program can’t consistently meet those timelines. In breach litigation, the absence of an IR plan is evidence of unreasonable security practices regardless of what other controls were in place.
The Securities and Exchange Commission Dimension:
The SEC’s 2023 cybersecurity disclosure rules apply to public companies, but their ripple effect reaches private companies that operate in supply chains with publicly traded entities. Material cybersecurity incidents must be disclosed promptly. Cybersecurity risk management, strategy, and governance must be disclosed annually. The SEC has specifically indicated that board-level oversight of cybersecurity risks is expected.
CIS Controls 17 (Incident Response) and 18 (Penetration Testing) are directly implicated in SEC compliance. A company that can demonstrate annual penetration testing (Control 18) and a practiced IR program (Control 17) has substantially stronger disclosure footing when characterizing their risk management program in 10-K filings or responding to an 8-K triggering event. A company that can’t demonstrate either has a gap that SEC examiners will notice.
Implementation Priority for Organizations Without Mature Programs
IG1 is the floor, not a long-term destination. The 56 safeguards in IG1 address the most exploited attack vectors and cover the legal minimum implied by most “reasonable security” standards. Organizations should complete IG1 before touching IG2 content. Within IG1, sequence matters: Controls 1, 2, and 4 (asset inventory and secure configuration) before Controls 5 and 6 (account and access management) before Control 8 (audit log management) before Control 17 (incident response).
The CIS Controls Self-Assessment Tool (CSAT) is freely available and produces documentation of implementation maturity, which is directly useful in audit and litigation contexts. Running an annual CSAT and retaining the output is basic defensibility housekeeping.
One structural requirement: document everything. Control implementation that isn’t documented doesn’t exist from a legal standpoint. Policies, configurations, change records, training completions, test results, each of these becomes evidence of a functioning security program when a regulator or plaintiff’s attorney asks for it.
Some of these controls are simple to use and follow, yet I have seen organizations that do not follow simple steps as removing default settings from systems or testing backups to make sure they work. By following these controls, you can avoid those simple mistakes.
You can download the CIS Controls here.
I hope you found this post helpful and informative. Thanks for stopping by!
Leave a Reply