Skip to content
LevelUp101.net

What Are the CIS Controls? The 18 Controls and How to Get Started

Section titled “What Are the CIS Controls? The 18 Controls and How to Get Started”

What are the CIS Controls?

Section titled “What are the CIS Controls?”

The CIS Controls are a prioritized set of cybersecurity practices that help organizations decide what to implement and where to begin. Their full name is the CIS Critical Security Controls. The Center for Internet Security (CIS), a U.S. nonprofit, develops them through an international community of experts and analysis of real-world attacks.

They cover asset inventories, identity and access, software updates, backups, workforce training, service providers, and incident response. Business leaders and IT teams can use them to identify gaps and agree on improvement priorities. CIS overview

This article is an independent summary of v8.1, based on the supplied Japanese translation and CIS publications. It is not a full translation or an implementation manual for every Safeguard. Sources were checked on October 8, 2026.

What problem do they solve?

Section titled “What problem do they solve?”

Organizations face many competing security priorities. The CIS Controls turn common defensive needs into concrete activities that can be planned, assigned, and reviewed.

  • Assess coverage: Identify unmanaged devices, unnecessary accounts, unsupported software, and other gaps.
  • Plan improvements: Select priorities that fit the organization’s risks and available resources.
  • Sustain operations: Assign owners, establish procedures, and check that protections continue to work.
  • Demonstrate progress: Use inventories, configuration records, and exercise results as evidence.

These are practical uses drawn from the supplied guide’s overview and adoption discussion. Effective implementation combines people, processes, and technology; purchasing tools is only part of the work.

Structure: 18 Controls and 153 Safeguards

Section titled “Structure: 18 Controls and 153 Safeguards”

Version 8.1 contains 18 Controls, each covering a security area, and 153 Safeguards, which describe specific actions. For example, Control 5 covers account management, while individual Safeguards address maintaining an account inventory and disabling dormant accounts.

Each chapter explains the Control’s purpose, why it matters, supporting procedures and tools, and its Safeguards. Individual Safeguards also identify relevant asset classes, security functions, and Implementation Groups. The Japanese PDF uses the term 保護手段 for Safeguards. CIS Implementation Groups

What the 18 Controls cover

Section titled “What the 18 Controls cover”

The descriptions below summarize the supplied guide. Examples illustrate each area; they are not all IG1 requirements. Consult individual Safeguards for their scope and IG assignment.

No. Control Focus and practical examples
1 Inventory and Control of Enterprise Assets Identify devices and servers across physical, virtual, remote, and cloud environments; address unauthorized or unmanaged assets.
2 Inventory and Control of Software Assets Track operating systems and applications; address unauthorized software and unsupported products.
3 Data Protection Classify data and manage access, encryption, retention, handling, and disposal.
4 Secure Configuration of Enterprise Assets and Software Maintain secure configuration standards; review defaults and disable unnecessary services.
5 Account Management Manage user, administrator, and service accounts; disable unnecessary accounts and separate administrator accounts.
6 Access Control Management Manage access grants, changes, and revocation; apply multifactor authentication and appropriate privileges.
7 Continuous Vulnerability Management Track vulnerabilities, update systems and applications, and verify remediation.
8 Audit Log Management Collect, retain, and review logs to support detection and investigation.
9 Email and Web Browser Protections Reduce exposure to malicious websites, attachments, and deceptive email.
10 Malware Defenses Prevent or control malicious code installation, execution, and spread; maintain protective tools.
11 Data Recovery Maintain protected, isolated backups and recovery procedures; verify that restoration works.
12 Network Infrastructure Management Keep network devices supported, securely configured, and properly managed.
13 Network Monitoring and Defense Monitor communications and security events; operate detection, prevention, and segmentation measures.
14 Security Awareness and Skills Training Teach safe authentication, phishing awareness, data handling, and incident reporting.
15 Service Provider Management Inventory and assess providers; manage contracts, oversight, and secure offboarding.
16 Application Software Security Manage security throughout software design, development, acquisition, testing, and remediation, including dependencies.
17 Incident Response Management Define response owners, contacts, and procedures; conduct exercises and reviews.
18 Penetration Testing Simulate attacks to evaluate defenses across people, processes, and technology; remediate weaknesses.

Source: supplied PDF, printed pp. 11–61. The official CIS list provides the English Control names and descriptions.

Implementation Groups: choosing the scope

Section titled “Implementation Groups: choosing the scope”

Implementation Groups (IGs) help organizations prioritize Safeguards according to risk and available resources. Headcount alone does not determine the right group. Consider information sensitivity, the consequences of disruption, technical capabilities, and exposure to attacks.

Group Number of Safeguards Purpose and typical context
IG1 56 A foundational starting point for every organization, including those with limited security expertise and budgets. Addresses common attacks.
IG2 130 total: IG1’s 56 plus 74 Extends protection for organizations with designated IT personnel, multiple departments, sensitive information, and more complex operations.
IG3 153 total: IG2’s 130 plus 23 Covers all Safeguards for organizations with specialist capabilities and demanding confidentiality, integrity, or availability needs. Addresses sophisticated targeted attacks and reduces the impact of zero-day attacks.

The groups are cumulative. IG2 includes IG1, and IG3 includes both. CIS recommends that every organization begin with IG1. An IG is implementation guidance, not a certification tier. CIS IG overview, IG2, IG3

Do not treat the Control numbers as a strict implementation sequence. IG1 includes later areas such as recovery, training, provider inventories, and incident reporting. Controls 13, 16, and 18 have no IG1 Safeguards. Use IG assignments and business risk to plan the work so that backups or incident contacts do not wait until every earlier Control is complete. Source: supplied guide, adoption discussion and IG counts for each Control.

What changed in v8.1?

Section titled “What changed in v8.1?”

Version 8.1 refines v8 through revised asset classes, terminology, Safeguard descriptions, and mappings to NIST Cybersecurity Framework (CSF) 2.0, including its Govern function. This is an update to the mappings, not the addition of a nineteenth Control. The 18 Controls, 153 Safeguards, and IG structure remain. CIS v8.1; supplied PDF, printed pp. 2–3.

Relationship to CIS Benchmarks and other frameworks

Section titled “Relationship to CIS Benchmarks and other frameworks”

CIS Controls describe organizational security practices; CIS Benchmarks provide configuration recommendations for specific technologies. A team implementing Control 4 can use the appropriate Benchmark to help define secure settings for an operating system or cloud platform. CIS Benchmarks

Mappings to other frameworks can help connect these practices to an existing security program. They support planning and assessment but do not, by themselves, establish certification or compliance with another standard or regulation.

A practical way to get started

Section titled “A practical way to get started”

The following workflow is this article’s suggested approach, rather than a mandatory CIS sequence or timetable.

  1. Define the scope. Include relevant locations, remote devices, cloud services, SaaS applications, and outsourced operations.
  2. Identify assets and critical activities. Determine what must be protected and the consequences of downtime or data exposure.
  3. Choose a target IG and assess IG1. Record implemented, partially implemented, missing, and not-applicable Safeguards using evidence. Document exclusions.
  4. Assign the improvements. Give each action an owner, a deadline, and a verification method. Clarify responsibilities shared with providers.
  5. Verify and revisit. Check updates, accounts, logging, restoration, and training outcomes. Reassess as systems, business needs, and threats change.

Check whether an inventory reflects today’s devices, not just whether a spreadsheet exists. Likewise, verify that needed data can be restored, not just that a backup job reports success.

Sources and further reading

Section titled “Sources and further reading”

The supplied translation and CIS publications are the primary sources. The Japanese articles below provide additional context; some discuss older versions or use different translations of technical terms.