CIS Critical Security Controls v8.1 — Implementation Group 1 (IG1)

Why does it matter?

IG1 exists so that an organization with no dedicated security team still has a defined, finite list. CIS designed its Safeguards to be implementable with limited expertise and to work with small or home office commercial off-the-shelf hardware and software.

Key benefits include:

• A finite starting point

Fifty-six Safeguards give a small organization a concrete list instead of the full 153.

• Built for limited resources

The Safeguards are meant to be implementable with limited cybersecurity expertise and ordinary commercial products.

• Aimed at common attacks

IG1 defends against the most common attacks, which is the goal of essential cyber hygiene.

• Cumulative path forward

IG2 adds 74 Safeguards and IG3 adds 23 more, so work done for IG1 is not repeated.

• Evidence for customers and insurers

A documented IG1 status gives small suppliers a recognized, nonproprietary baseline to show to customers.

How does it work?

IG1 sits at the base of three cumulative Implementation Groups. Its 56 Safeguards are drawn from across the Controls, starting with enterprise asset inventory. CIS lists the number of Safeguards per Control for each group in a table on its Implementation Groups page.

CIS describes the typical IG1 enterprise as small to medium-sized with limited IT and cybersecurity expertise, with limited tolerance for downtime, and holding data of low sensitivity, mainly employee and financial information. Where an enterprise holds more sensitive data or must keep services available, CIS expects it to go beyond IG1 to IG2 or IG3.

CIS positions IG1 as an emerging minimum standard of information security for all enterprises. Implementation is iterative: environments, threats and business objectives change, so the Safeguards are revisited over time.

Key Elements

• The 56 Safeguards

A foundational set of 56 cyber defense Safeguards drawn from across the CIS Controls. They include the asset and software inventories of Controls 1 and 2, account and access management in Controls 5 and 6, data recovery in Control 11 and incident response in Control 17.

• Enterprise profile

An IG1 enterprise is typically small to medium-sized with limited IT and cybersecurity expertise, little tolerance for downtime, and low-sensitivity data. Safeguards are designed to work with small or home office commercial off-the-shelf products.

• Inventories first

Controls 1 and 2 ask for inventories of enterprise assets and software. They come first because an organization cannot protect, configure or patch what it does not know it has.

• Data and access basics

Control 3 on data protection and Controls 5 and 6 on account and access management set the baseline for protecting employee and financial information with limited tools.

• Recovery and response

Control 11 on data recovery and Control 17 on incident response management give a small organization a way to recover from ransomware or an outage.

• Moving beyond IG1

When data sensitivity, regulatory duties or downtime tolerance change, the organization takes on IG2's 74 additional Safeguards and then IG3's 23.

What does it cover?

IG1 applies to organizations that match the IG1 profile and want a defined minimum. It is meant for small to medium-sized enterprises, but CIS recommends that all enterprises begin with IG1, so larger organizations use it as the first layer of their IG2 or IG3 program.

What are its objectives?

IG1 aims to give every enterprise a minimum standard of cyber hygiene.

Provide a minimal, finite set of Safeguards for organizations with limited expertise.

Defend against the most common attacks with technology that is generally already available.

Start every program from the same foundation before adding IG2 and IG3.

Help organizations show a documented, recognized baseline.

Create a base that later Implementation Groups build on.

Framework in Context

IG1 is the first of the three Implementation Groups in the CIS Controls and does not stand alone: IG2 and IG3 include its Safeguards. For platform settings it works with the CIS Benchmarks, and it maps to frameworks such as NIST CSF 2.0 and ISO/IEC 27001 for organizations that must report against them.

Common Framework Mappings

Organizations map CIS Controls IG1 to complementary frameworks to ensure full coverage, align controls with governance requirements, and simplify audits and risk management across standards and regulatory programs.

Mapped frameworks include:

CIS Controls — IG2

CIS Controls — IG3

ISO/IEC 27001

ISO/IEC 27002

MITRE ATT&CK

NIST Cybersecurity Framework

NIST SP 800-53

SOC 2