CIS Controls

The CIS Controls began in 2008 as the Consensus Audit Guidelines, later the SANS Top 20, compiled by US government and private-sector practitioners around a single question: which defensive actions stop the attacks actually observed? Stewardship moved to the Center for Internet Security, and the list went through versions 5, 6 and 7. Version 7 grouped controls into basic, foundational and organisational; version 7.1 (2019) introduced Implementation Groups. Version 8 (2021) reorganised the content by activity rather than by who manages a device, merged and dropped controls to reach 18 controls and 153 safeguards, and updated the language for cloud, mobile and remote work. Version 8.1 (2024) kept the structure but revised safeguard wording, added a Govern security function to align with NIST CSF 2.0, and introduced documentation as an asset type.

Each safeguard is a single, testable action with two attributes: an asset type (devices, software, data, users, network, and in 8.1 documentation) and a security function (Identify, Protect, Detect, Respond, Recover, and in 8.1 Govern). Implementation Groups are cumulative: IG1 has 56 safeguards, IG2 adds 74 and IG3 adds 23. Several safeguards embed concrete frequencies that auditors can check, for example authenticated and unauthenticated vulnerability scans of internal assets at least quarterly (7.5), external scans at least monthly (7.6) and restore tests at least quarterly (11.5).

CIS justifies the prioritisation with the Community Defense Model, which maps safeguards against MITRE ATT&CK techniques used in common attack patterns such as ransomware, web-application hacking and insider misuse, and reports how much of each pattern IG1 alone mitigates. That evidence base is the main methodological difference from ISO/IEC 27002, whose 93 controls are selected through a risk assessment and justified in a Statement of Applicability rather than applied in a fixed order.

Two neighbouring CIS products are often confused with the Controls. The CIS Benchmarks are consensus hardening guides for specific platforms (Windows Server, RHEL, Kubernetes, AWS and many more), with Level 1 and Level 2 profiles; they are how Control 4 (secure configuration) is implemented in practice, and CIS-CAT scans systems against them. The CIS Controls Self Assessment Tool (CSAT) is used to track safeguard implementation. CIS publishes mappings to NIST CSF 2.0, ISO/IEC 27001:2022, PCI DSS and other frameworks, which makes the Controls a practical technical layer under a management-system standard or under NIS2 Art. 21, but not a substitute for the governance, risk-assessment and reporting obligations those impose.