CIS Critical Security Controls v8.1 — Implementation Group 2 (IG2)
- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyCIS Controls
- Regulatory ContextTypeControl FrameworkLegal InstrumentFrameworkSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailUnited StatesPublisherCenter for Internet Security (CIS)
- VersioningVersionCIS Controls v8.1 (June 24, 2024); IG2 = 130 of 153 SafeguardsEffective DateJune 24, 2024Issue DateJune 24, 2024
- AdoptionAdoption ModelSecurity BaselineImplementation ComplexityModerate
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
CIS publishes the CIS Controls for download from its website, and its terms of use for non-member products place the Controls under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 license, so the text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- CIS Controls v8.1 Implementation Group 2 is IG1's 56 Safeguards plus 74 more, 130 of the 153 Safeguards.
- An IG2 enterprise has staff managing IT infrastructure, several departments with differing risk profiles, and often sensitive information.
- Enterprises complete IG1 first, then add Safeguards such as data classification, automated vulnerability scans, centralized audit logs, and penetration testing.
- Some IG2 Safeguards need enterprise-grade technology and specialized expertise to install and configure.
- SmartSuite holds the 130 IG2 Safeguards with owners, evidence, and test results by Control.
Overview
CIS Controls v8.1 Implementation Group 2 (IG2) is the second prioritization tier of the CIS Critical Security Controls: the 56 Safeguards of IG1 plus 74 more, 130 of the 153 Safeguards in the 18 Controls. The Center for Internet Security (CIS) published version 8.1 on June 24, 2024 as an iterative update to version 8 and left the Implementation Groups unchanged.
CIS describes an IG2 enterprise as one with staff responsible for managing and protecting IT infrastructure, several departments with differing risk profiles, and often sensitive client or enterprise information. CIS, a nonprofit, publishes the Implementation Groups as recommended guidance for prioritizing implementation, not as a law, and tells every enterprise to start with IG1 as essential cyber hygiene.
Enterprises implement IG2 by completing IG1 and then working through the 74 added Safeguards, among them active asset discovery (1.3), data classification (3.7), automated vulnerability scans (7.5 and 7.6), centralized audit logs (8.9), DMARC (9.5), incident response exercises (17.7) and a penetration testing program (18.1). CIS offers the CIS Controls Navigator, which filters by Implementation Group, and CIS CSAT to assess and measure implementation.
Why does it matter?
IG2 is where the CIS Controls move from basic hygiene to managing complexity. It adds 74 Safeguards for enterprises with dedicated IT staff, several departments and sensitive data, and CIS notes that some of them need enterprise-grade technology and specialized expertise to install and configure. The result is a fixed, countable target of 130 Safeguards that can be assigned, tested and reported.
Key benefits include:
- A countable target
IG2 is 130 of the 153 Safeguards (56 from IG1 plus 74 added), so progress can be reported as a share of a fixed list.
- Prioritized by risk and resources
CIS sets the Implementation Groups by risk profile and available resources, so an enterprise adopts the tier it can sustain before moving to the 23 further Safeguards of IG3.
- Coverage beyond hygiene
IG2 adds detection and response practices such as centralized security event alerting (13.1), incident response exercises (17.7) and post-incident reviews (17.8).
- Vendors and applications included
IG2 adds service provider policy, classification and contract Safeguards (15.2 to 15.4) and eleven application security Safeguards (16.1 to 16.11).
- Mapped to other frameworks
CIS realigned its NIST CSF mappings to CSF 2.0 in version 8.1, and the Controls Navigator shows how the Safeguards map to other standards.
How does it work?
CIS Controls v8.1 has 18 Controls, from Inventory and Control of Enterprise Assets (Control 1) to Penetration Testing (Control 18), divided into 153 Safeguards. Each Safeguard is assigned to one or more Implementation Groups and each group includes the one below it: IG1 has 56 Safeguards, IG2 adds 74 to reach 130, and IG3 adds 23 to reach all 153. Version 8.1 added a Governance security function from NIST CSF 2.0 and revised the asset classes.
An enterprise confirms that IG1 is in place, then assigns the 74 IG2 Safeguards to owners, assets and evidence. Because CIS notes that some IG2 Safeguards need enterprise-grade technology and specialized expertise, teams sequence them, for example collecting detailed audit logs (8.5) before reviewing them (8.11). Progress is checked with the Controls Navigator, which filters by Implementation Group, and with CIS CSAT, the CIS tool for assessing and measuring Controls implementation.
In SmartSuite, teams hold each IG2 Safeguard as a record with its Control number, owner, status and evidence, connect it to the assets, accounts and vendors it covers, and report coverage by Control and Implementation Group.
Key Elements
- 18 Controls and 153 Safeguards
The Controls run from enterprise and software asset inventories (1 and 2) through account and access management (5 and 6), vulnerability and audit log management (7 and 8), incident response (17) and penetration testing (18).
- Implementation Groups
IG1 is essential cyber hygiene with 56 Safeguards. IG2 adds 74 for multi-department enterprises, and IG3 adds 23 for enterprises that must defend against sophisticated attacks.
- IG2 data protection
IG2 adds a data classification scheme (3.7), data flow documentation (3.8), encryption on removable media, in transit and at rest (3.9 to 3.11) and segmentation by sensitivity (3.12).
- IG2 vulnerability and log management
IG2 adds automated internal and external vulnerability scans and remediation (7.5 to 7.7), plus time synchronization, detailed, DNS, URL and command-line logs, centralization, retention and review (8.4 to 8.11).
- IG2 access and network Safeguards
IG2 adds service account inventory and centralized account and access control (5.5, 5.6, 6.6, 6.7), secure network architecture and AAA (12.2 to 12.7) and event alerting, intrusion detection and traffic filtering (13.1 to 13.6).
- IG2 service provider and application Safeguards
IG2 adds a service provider management policy, classification and contract security requirements (15.2 to 15.4) and secure application development, vulnerability handling and third-party component inventories (16.1 to 16.11).
- IG2 response and testing
IG2 adds testing of data recovery (11.5), an incident response process with roles, communications, exercises and post-incident reviews (17.4 to 17.8) and a penetration testing program with external tests (18.1 to 18.3).
What does it cover?
IG2 is aimed at enterprises that manage IT infrastructure across multiple departments with differing risk profiles, in CIS's description, and that can tolerate short service interruptions. It spans all 18 Controls and includes every IG1 Safeguard. Enterprises that hold more sensitive and confidential data or face sophisticated attacks move on to IG3, which adds the remaining 23 Safeguards, such as application layer filtering (13.10) and threat modeling (16.14).
What are its objectives?
IG2 helps enterprises cope with increased operational complexity by building on IG1.
Keep all 56 IG1 Safeguards in place and add the 74 IG2 Safeguards.
Centralize account, access, audit log and security alerting management (5.6, 6.7, 8.9, 13.1).
Scan, test and review: automated vulnerability scans (7.5, 7.6), data recovery tests (11.5) and penetration tests (18.1 to 18.3).
Bring service providers and application development under written policy and process (15.2 to 15.4, 16.1).
Prepare and rehearse incident response with defined roles and exercises (17.4 to 17.8).
Leave the 23 IG3-only Safeguards for enterprises with higher data sensitivity and attack exposure.
Framework in Context
IG2 sits between IG1 (essential cyber hygiene) and IG3 (all 153 Safeguards) inside CIS Controls v8.1, and CIS states that no Implementation Group was modified in the 8.1 update. CIS realigned the NIST Cybersecurity Framework mappings to CSF 2.0 in 8.1. Common mapping targets are listed below, and the Navigator shows the mappings CIS publishes.
Common Framework Mappings
Organizations map CIS Controls to complementary industry frameworks to align controls, demonstrate regulatory compliance, prioritize risk-based defenses, and simplify audit and governance across hybrid environments.
Mapped frameworks include:
FedRAMP Rev. 5
ISO 27001:2022
MITRE ATT&CK
NIST CSF 2.0
NIST 800-53 Rev.5
PCI DSS 4.0.1
SOC 2
How SmartSuite Supports CIS Controls v8.1 IG2
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management, Cyber & IT Risk and Third Party Risk Management records to hold the 130 IG2 Safeguards with owners, evidence and test results by Control.
IG2 Safeguard Library
Record each of the 130 IG2 Safeguards with its Control number, Implementation Group, owner, status and review date.
Asset, Software and Account Inventories
Hold the enterprise asset, software, account and service account inventories that evidence Controls 1, 2 and 5 and link them to the Safeguards.
Vulnerability Scan and Log Review Cadence
Schedule automated scans and audit log reviews, and attach reports, findings and remediation tasks (7.5 to 7.7, 8.11).
Service Provider Management
Keep the service provider inventory, classification and contract security requirements for each provider (15.1 to 15.4).
Incident Response and Testing Records
Track data recovery tests, response exercises, post-incident reviews and penetration test findings with owners (11.5, 17.7, 17.8, 18.1 to 18.3).
IG2 Coverage Reporting
Build dashboards that show Safeguards implemented by Control and Implementation Group for security leadership.
Related frameworks
CIS Controls v8.1 IG1 is the 56-Safeguard essential cyber hygiene baseline for small and medium-sized enterprises with limited security expertise.
CIS Controls v8.1 IG3 is the complete 153-Safeguard set for enterprises with security specialists, regulated data and targeted-attack risk.
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For CIS Critical Security Controls v8.1 (Implementation Group 2)
IG2 is the second of three Implementation Groups in the CIS Critical Security Controls v8.1, published by the Center for Internet Security on June 24, 2024. It contains the 56 Safeguards of IG1 plus 74 additional Safeguards, 130 in total, for enterprises that manage IT infrastructure across several departments with differing risk profiles.
IG2 adds 74 Safeguards across the 18 Controls, for example active discovery of assets (1.3), a data classification scheme (3.7), automated internal and external vulnerability scans (7.5 and 7.6), centralized audit logs (8.9), DMARC (9.5), testing of data recovery (11.5), incident response exercises (17.7) and a penetration testing program (18.1). IG3 adds the last 23 Safeguards, such as application layer filtering (13.10).
CIS bases the groups on risk profile and available resources and says every enterprise should start with IG1. IG2 suits enterprises with staff responsible for managing and protecting IT infrastructure, several departments with different risk profiles and sensitive client or enterprise information. IG3 suits enterprises with IT security experts that must defend sensitive and confidential data against sophisticated attacks.
CIS describes the Implementation Groups as recommended guidance to prioritize implementation, and IG2 is not a law or regulation. CIS's terms of use for non-member products place the CIS Controls under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 license, so commercial use or derivative works need CIS's permission.
CIS states that no Implementation Group was modified in version 8.1, so the IG2 count of 130 Safeguards carries over from version 8. Version 8.1 added a Governance security function aligned to NIST CSF 2.0, revised the asset classes and Safeguard descriptions, added glossary definitions and realigned the CSF mappings. CIS has not released a version 9 as of October 2026.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.