CIS Critical Security Controls v8.1 — Implementation Group 3 (IG3)
- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyCIS Controls
- Regulatory ContextTypeControl FrameworkLegal InstrumentFrameworkSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailUnited StatesPublisherCenter for Internet Security (CIS)
- VersioningVersionv8.1, Implementation Group 3 (153 Safeguards)Effective DateJune 24, 2024Issue DateJune 24, 2024
- AdoptionAdoption ModelVoluntaryImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
CIS publishes the CIS Controls v8.1 for download in PDF and Excel on cisecurity.org. The text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- CIS Controls v8.1 Implementation Group 3 is the complete set of 153 Safeguards: IG1's 56, IG2's 74, and 23 more.
- It is written for enterprises with security specialists and sensitive data under regulatory or compliance oversight.
- CIS released v8.1 on June 24, 2024; IG3 is voluntary guidance with no certification of its own.
- Organizations reach IG1 and IG2 first, then add the 23 IG3 Safeguards to counter targeted attacks and reduce zero-day impact.
- SmartSuite tracks all 153 Safeguards across the 18 Controls with specialist owners, test evidence, and mappings to applicable regulatory frameworks.
Overview
CIS Controls v8.1 Implementation Group 3 (IG3) is the complete set of 153 Safeguards in the CIS Critical Security Controls, made up of IG1's 56, IG2's 74 and 23 further Safeguards that the Center for Internet Security says an enterprise needs to abate targeted attacks from a sophisticated adversary. It is written for enterprises that employ security specialists and hold sensitive data under regulatory or compliance oversight.
CIS, a nonprofit organization, publishes IG3 within CIS Controls v8.1, released on June 24, 2024. It is voluntary guidance with no certification of its own. CIS says IG3 assets and data contain sensitive information or functions that are subject to regulatory and compliance oversight, and that a successful attack could seriously harm the public.
Organizations implement IG3 by reaching IG1 and IG2 first, then adding the 23 IG3 Safeguards, assigning them to specialist teams such as risk management, penetration testing and application security, and testing that the Safeguards withstand targeted attack and reduce the impact of zero-day attacks.
Why does it matter?
IG3 is the top tier of the CIS Controls, for organizations whose risk profile is set by regulators, sensitive data and capable adversaries. CIS says its Safeguards must counter targeted attacks from sophisticated adversaries and reduce the impact of zero-day attacks.
Key benefits include:
- Complete coverage
IG3 contains every Control and Safeguard, 153 in total, so an IG3 program covers the whole catalog.
- Built for specialist teams
An IG3 enterprise commonly employs security experts who specialize in facets such as risk management, penetration testing and application security.
- Regulated and sensitive data
IG3 applies where assets and data contain sensitive information or functions that are subject to regulatory and compliance oversight.
- Availability and integrity matter
IG3 protects service availability and the confidentiality and integrity of sensitive data where a successful attack could seriously harm the public.
- Cumulative, no shortcuts
IG3 includes all of IG1 and IG2, so an organization cannot claim IG3 without the lower groups.
How does it work?
IG3 is the third cumulative Implementation Group. IG1 provides 56 Safeguards as essential cyber hygiene, IG2 adds 74 Safeguards, and IG3 adds 23 for a total of 153 across CIS Controls v8 and v8.1. The 23 additions are the Safeguards intended for enterprises that face targeted attacks.
CIS selects IG3 Safeguards for their ability to counter sophisticated adversaries and limit zero-day impact. These sit in the same 18 Controls as the lower groups, so an IG3 program deepens the existing Controls rather than adding a separate catalog.
Because IG3 is the whole catalog, CIS publishes the Safeguards in a spreadsheet with the v8.1 download and offers a Controls Navigator, and the v8.1 update added the Govern security function.
Key Elements
- Enterprise profile
An IG3 enterprise commonly employs specialist security staff, holds sensitive information or functions subject to regulatory and compliance oversight, and must protect service availability and the confidentiality and integrity of sensitive data.
- The 23 additional Safeguards
IG3 adds 23 Safeguards beyond IG2's total of 130. CIS chooses them to counter targeted attacks from sophisticated adversaries and to reduce the impact of zero-day attacks.
- Cumulative requirement
IG3 includes every IG1 and IG2 Safeguard. A gap in an IG1 Safeguard such as an asset inventory is still a gap in an IG3 assessment.
- Specialist ownership
Safeguards in IG3 usually need people with specialist skills, for example in penetration testing, application security and risk management, and organizations record who owns each.
- Regulatory alignment
Because IG3 is the full catalog, it provides the broadest basis for mapping to regulatory frameworks, and CIS publishes mappings such as NIST CSF 2.0 and NIST SP 800-171.
- Governance in v8.1
Version 8.1 added the Govern function, with 26 Safeguards that CIS identifies as supporting governance of a cybersecurity program, which an IG3 program covers in full.
What does it cover?
IG3 applies to enterprises that match its profile: specialist security staff, sensitive data under regulatory or compliance oversight, and high consequences from a successful attack. It applies the full CIS Controls catalog to enterprise IT environments, including cloud and hybrid environments.
What are its objectives?
IG3 aims to defend high-risk enterprises against targeted and sophisticated attacks.
Apply every CIS Control and Safeguard, 153 in total.
Counter targeted attacks from sophisticated adversaries.
Reduce the impact of zero-day attacks.
Protect service availability and the confidentiality and integrity of sensitive data.
Provide a full catalog that maps to regulatory frameworks.
Framework in Context
IG3 completes the CIS Controls path that starts with IG1 and continues with IG2. It maps to frameworks such as NIST CSF 2.0 and NIST SP 800-171 and works alongside the CIS Benchmarks for platform-level settings, but it remains a prioritized safeguard list, not an assessment scheme with a certificate.
Common Framework Mappings
Organizations map CIS IG3 to complementary frameworks to align controls, support risk management, facilitate audits, and enable consistent implementation across governance, detection, and regulatory compliance programs.
Mapped frameworks include:
ISO/IEC 27001
ISO/IEC 27002
MITRE ATT&CK
NIST Cybersecurity Framework
NIST SP 800-53
PCI DSS
SOC 2
How SmartSuite Supports CIS Controls v8.1 IG3
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Cyber & IT Risk and Compliance Management records to track all 153 Safeguards across the 18 Controls with specialist owners, test evidence and mappings to the regulatory frameworks that apply.
Full Safeguard Catalog
Load all 153 Safeguards with Control, Implementation Group, asset class and security function, and mark the 23 IG3 additions.
Specialist Ownership
Assign each Safeguard to a named owner or specialist team, such as penetration testing or application security.
Control Testing and Evidence
Schedule tests, attach results and record exceptions for each Safeguard, including advanced controls.
Threat and Risk Linkage
Link Safeguards to the risks and threat scenarios they counter, including targeted attack and zero-day cases.
Regulatory Mappings
Map Safeguards to the frameworks the organization reports against so one set of evidence serves several audits.
Executive Reporting
Report coverage by Implementation Group, Control and security function, including Govern, for the board and auditors.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
CIS Controls v8.1 IG1 is the 56-Safeguard essential cyber hygiene baseline for small and medium-sized enterprises with limited security expertise.
CIS Controls v8.1 IG2 is the 130-Safeguard tier of the CIS Controls (IG1's 56 plus 74) for enterprises with several departments and differing risk profiles.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
Frequently Asked Questions For CIS Critical Security Controls v8.1 — Implementation Group 3 (IG3)
Implementation Group 3 is the complete set of 153 Safeguards in the CIS Critical Security Controls. It adds 23 Safeguards to IG2 and is intended for enterprises that face targeted attacks from sophisticated adversaries.
Enterprises that commonly employ security experts who specialize in areas such as risk management, penetration testing and application security, whose assets and data are subject to regulatory and compliance oversight, and where a successful attack could seriously harm the public.
The groups are cumulative. IG1 has 56 Safeguards as essential cyber hygiene, IG2 adds 74 for 130, and IG3 adds 23 for all 153. The IG3 additions must abate targeted attacks from a sophisticated adversary and reduce the impact of zero-day attacks.
No. It is voluntary guidance from the Center for Internet Security, and an organization claims alignment through its own documented implementation and evidence.
Yes. IG3 contains every Safeguard, so it includes the 26 Safeguards that CIS identifies as supporting the Govern security function that v8.1 added from NIST CSF 2.0.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.