CIS Critical Security Controls v8.1

Why does it matter?

CIS Controls v8.1 turns the long list of possible security work into an ordered one. Each Safeguard belongs to a Control and to the Implementation Group that says who should do it first, so a small company and a large regulated enterprise can both follow the same document at different depths.

Key benefits include:

• A short, ordered list

Eighteen Controls start with asset inventories and run to incident response and penetration testing, so the first steps are about knowing what is in the environment.

• Implementation Groups set priority

IG1 is essential cyber hygiene with 56 Safeguards, IG2 adds 74 for 130 in total, and IG3 adds 23 for all 153.

• Governance is explicit in v8.1

The new Govern function from NIST CSF 2.0 identifies Safeguards that support governing a cybersecurity program, and CIS counts 26 of them.

• Works with cloud and supply chain

The v8.1 page highlights hybrid and fully cloud environments and supply chain security.

• Mapped to other frameworks

CIS publishes mappings to NIST CSF 2.0, NIST SP 800-171 and other frameworks.

How does it work?

The 18 Controls are: Inventory and Control of Enterprise Assets; Inventory and Control of Software Assets; Data Protection; Secure Configuration of Enterprise Assets and Software; Account Management; Access Control Management; Continuous Vulnerability Management; Audit Log Management; Email and Web Browser Protections; Malware Defenses; Data Recovery; Network Infrastructure Management; Network Monitoring and Defense; Security Awareness and Skills Training; Service Provider Management; Application Software Security; Incident Response Management; and Penetration Testing.

Each Control contains Safeguards, 153 in total across v8 and v8.1. The Safeguards are assigned to Implementation Groups based on an enterprise's size and complexity, data types, resources and technology, threat types, and risk. Groups are cumulative: IG2 includes IG1, and IG3 includes both.

v8.1 made targeted changes: it added the Govern security function, realigned security function mappings to NIST CSF 2.0, revised asset classes with new mappings to Safeguards, expanded glossary definitions for reserved terms such as plan, process and sensitive data, and fixed typos and clarified some Safeguard text. CIS states that existing users should see little to no change.

Key Elements

• Eighteen Controls

Controls 1 and 2 cover the inventory of enterprise assets and software, and Control 3 covers data protection. Controls 4 to 8 cover secure configuration, accounts, access, vulnerability management and audit logs. Controls 9 to 13 cover email and browsers, malware, recovery, network infrastructure and network monitoring. Controls 14 to 18 cover training, service providers, application security, incident response and penetration testing.

• Safeguards

A Safeguard is a specific action within a Control. Each has a number such as 4.1, Establish and Maintain a Secure Configuration Process, an Implementation Group, an asset class and a security function. CIS provides a spreadsheet, a change log and an Implementation Groups document with the v8.1 download.

• Implementation Groups

IG1 is a foundational set of 56 Safeguards called essential cyber hygiene. IG2 is 74 additional Safeguards, and IG3 is 23 more for enterprises that face sophisticated adversaries and regulatory oversight. The groups are based on an enterprise's risk profile and available resources.

• Security functions and Govern

Safeguards are tagged to security functions aligned to NIST CSF. Version 8.1 adds Govern, with 26 Safeguards that CIS identifies as supporting governance of a cybersecurity program.

• Asset classes

Each Safeguard applies to a class of asset. Version 8.1 restructured the asset classes and their definitions for consistency and added new asset classes to match the parts of the infrastructure each Safeguard applies to.

• Mappings and tools

CIS publishes mappings of v8.1 to NIST CSF 2.0, NIST SP 800-171 and other frameworks, and the CIS Controls Navigator lets users filter Safeguards by Implementation Group, asset class and function.

What does it cover?

The CIS Controls apply to any enterprise. They are written for enterprise IT environments, including cloud and hybrid, and an organization picks the Implementation Group that fits its risk profile and resources. Individual IG pages describe the baselines for smaller and larger enterprises.

What are its objectives?

The CIS Controls give organizations a prioritized path to defend against the most common attacks.

Prioritize security actions so that the most effective ones come first.

Give small and large enterprises a path through Implementation Groups.

Cover assets, data, configuration, access, monitoring, response and testing in 18 Controls.

Make governance of the security program explicit through the Govern function.

Map to other frameworks so evidence can be reused.

Framework in Context

The CIS Controls are a prescriptive companion to broader frameworks. NIST CSF 2.0 and ISO/IEC 27001 describe outcomes and management systems, while the CIS Controls list the specific Safeguards to implement first, and the CIS Benchmarks give platform-specific settings for Control 4.

Common Framework Mappings

Organizations map the CIS Controls to established standards to ensure full coverage, simplify audits, align technical controls with governance and privacy requirements, and enable consistent risk management, incident response, and vendor assurance across programs and regulatory reporting, and to measure control maturity over time.

Mapped frameworks include:

ISO/IEC 27001

ISO/IEC 27002

ISO/IEC 27701

MITRE ATT&CK

NIST Cybersecurity Framework

NIST Special Publication 800-53

PCI DSS

SOC 2