What is CIS Controls?

Originally developed by the SANS Institute as the "SANS Top 20," then transferred to CIS for ongoing maintenance. Where NIST CSF provides a governance structure, CIS Controls provide concrete technical actions with measurable safeguards underneath each control. CIS Controls v8 (2021) reorganized the list into 18 controls with 153 individual safeguards, dropping the earlier network-vs-host split in favor of activity-based grouping since modern environments blend on-prem, cloud, and remote assets.

The controls are ordered roughly by expected impact. Controls 1 to 6 form the basic tier: Inventory and Control of Enterprise Assets, Inventory and Control of Software Assets, Data Protection, Secure Configuration of Enterprise Assets and Software, Account Management, and Access Control Management. You cannot secure what you cannot see, so asset and software inventory come first even though they feel unglamorous. Controls 7 through 16 form the foundational tier: Continuous Vulnerability Management, Audit Log Management, Email and Web Browser Protections, Malware Defenses, Data Recovery, Network Infrastructure Management, Network Monitoring and Defense, Security Awareness and Skills Training, Service Provider Management, and Application Software Security. Controls 17 and 18 are organizational: Incident Response Management and Penetration Testing.

Each safeguard is assigned to one or more of three Implementation Groups (IG1, IG2, IG3), letting a small organization with limited staff implement IG1 essentials while a mature enterprise works toward IG3. IG1 alone is designed to stop the most common attacks documented in breach reports, without requiring dedicated security headcount. CIS also publishes mappings from the Controls to NIST CSF, ISO 27001, and other frameworks, so an organization can run one control set and satisfy multiple compliance references simultaneously rather than maintaining parallel programs.