The 18 CIS Controls, Explained (v8.1 List + Safeguards)

The CIS Critical Security Controls organize cyber defense into 18 security areas defined by the Center for Internet Security (CIS). Each Control sets an objective which is broken down into specific actions called Safeguards.

The most current version, CIS Controls v8.1, has 153 Safeguards across three cumulative Implementation Groups (IGs). After selecting an Implementation Group, teams must turn its requirements into assigned responsibilities, working safeguards, and a review schedule. Often, that includes distinguishing recurring reviews from ongoing operational activities and changes that trigger an update.

This guide explains each of the 18 Controls and all 153 Safeguards across every Implementation Group, with security functions and review schedules.

For how to choose an IG and plan implementation, start with our CIS Controls guide.

See where your existing frameworks overlap with CIS Controls v8 requirements.

Map CIS Controls v8 to NIST CSF 2.0, 800-53, 800-171, ISO 27001, and the Secure Controls Framework (SCF), all in one place.

Access the NIST CSF 2.0 Multi-Framework Crosswalk →

What Are the 18 CIS Controls?

The 18 CIS Controls are a prioritized set of cybersecurity goals published by the Center for Internet Security. Also called the CIS 18, they help organizations prevent, detect, and respond to common cyberattacks. The list runs from maintaining asset inventories in Control 1 to penetration testing in Control 18.

CIS Controls v8.1 divides these objectives into 153 Safeguards and organizes them into three Implementation Groups. Organizations use the groups to choose a starting scope based on their risk and resources.

How Controls, Safeguards, and Implementation Groups Fit Together

Controls, Safeguards, and Implementation Groups work together but serve different purposes. More specifically:

• CIS Control: sets the goal an organization needs to achieve and leaves the exact steps to its Safeguards. Version 8.1 has 18 Controls.
• Safeguard: a specific action within a Control. Version 8.1 has 153 Safeguards.
• An Implementation Group (IG) defines a cumulative set of Safeguards according to an organization’s risk and resources. In Version 8.1, IG1, IG2, and IG3 contain 56, 130, and 153 Safeguards, respectively.

The table below shows how many Safeguards each Control has and how many to implement at each tier. Because the groups are cumulative, IG2 includes everything in IG1, and IG3 includes all 153 Safeguards. So, any Safeguard marked IG1 belongs to IG2 and IG3 too.

The table totals are calculated from the Safeguard memberships in the CIS Controls Navigator.

How to Choose an Implementation Group

CIS recommends that every enterprise start with IG1. The 56 Safeguards in this group address common, non-targeted attacks and can be implemented with limited security expertise and off-the-shelf tools.

Data Recovery and Security Awareness and Skills Training are the primary focus at this tier, with four of five and eight of nine Safeguards, respectively. Network Monitoring and Defense, Application Software Security, and Penetration Testing begin at IG2.

However, these assignments define only the baseline scope. Organizations are also encouraged to assess risks outside their selected IG.

When CIS released v8.1 in June 2024, it also realigned its security function mappings to NIST CSF 2.0—Govern, Identify, Protect, Detect, Respond, and Recover. See our NIST Cybersecurity Framework (CSF) 2.0 guide for a closer look at that framework.

CIS Control 1: Inventory and Control of Enterprise Assets

CIS Control 1 requires an inventory of enterprise assets that can store or process data, including regularly connected assets outside the enterprise’s control. Teams use this inventory to scope scanning, patching, configuration, and monitoring.

Our IT asset inventory guide goes deeper on how to keep that record up to date against CIS Controls v8.1.

Total Safeguards: 5 | IG1: 2, Added at IG2: 2, Added at IG3: 1

CIS Control 1: IG1 Safeguards

Safeguard 1.1 asks for an accurate, current inventory of everything that can store or process data, including end-user devices, mobile devices, network devices, non-computing and Internet of Things (IoT) devices, and servers. Each entry should list:

• Network address (if static)
• Hardware address
• Machine name
• Owner
• Department
• Whether the asset is approved to connect

Teams must review the inventory twice a year to make sure it captures physical, virtual, remote, and cloud-hosted assets. It should also include assets that regularly connect to the network, even ones the enterprise doesn’t control.

Safeguard 1.2 requires teams to handle unauthorized assets every week. They can remove unauthorized assets from the network, block remote connections, or quarantine them.

CIS Control 1: IG2 Safeguards

Safeguard 1.3 has teams run an active discovery tool daily to find assets on the network.

Safeguard 1.4 has teams use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address management tools to keep the inventory current. They must review those logs at least weekly.

CIS Control 1: IG3 Safeguards

Safeguard 1.5 has teams run a passive discovery tool, which spots assets by watching network traffic. They must review its results weekly and update the inventory.

CIS Control 2: Inventory and Control of Software Assets

CIS Control 2 requires organizations to inventory and control the software running across the enterprise, so that only authorized, supported software can install and execute. CIS treats a complete software inventory as a critical foundation for preventing attacks.

Together with Control 1, it defines the complete population of assets and software that the other 16 Controls protect.

Total Safeguards: 7 | IG1: 3, Added at IG2: 3, Added at IG3: 1

CIS Control 2: IG1 Safeguards

Safeguard 2.1 requires the inventory to list the title, publisher, initial install or use date, and business purpose of every licensed software product, plus the URL, app store, version, deployment mechanism, decommission date and license count where appropriate.

Safeguard 2.2 allows only currently supported software to count as authorized. If the organization still needs unsupported software, then they must document an exception that covers mitigating controls and accepted risk. Without one, CIS treats the software as unauthorized. Teams must check the list for support status at least monthly.

Safeguard 2.3 then has teams either remove that unauthorized software or grant it a formal exception, and review it monthly.

CIS Control 2: IG2 Safeguards

Safeguard 2.4 (IG2) requires teams to use automated tools to discover and document installed software, where possible.

Safeguards 2.5 and 2.6 use technical controls to limit execution to authorized software and libraries, with reassessment at least twice a year:

• 2.5 allowlists authorized software.
• 2.6 extends the allowlist to libraries, such as .dll, .ocx, and .so files, blocking unauthorized ones from loading into system processes.

CIS Control 2: IG3 Safeguards

Safeguard 2.7 extends that allowlist to scripts, such as .ps1 and .py files, using controls like digital signatures and version control to block unauthorized ones. Teams reassess the allowlist at least twice a year.

CIS Control 3: Data Protection

CIS Control 3 protects data across its entire lifecycle, from identifying and classifying it to handling, retaining, and securely disposing of it. Because CIS approaches privacy as the appropriate use and management of data, the Control extends well beyond encryption.

Total Safeguards: 14 | IG1: 6, Added at IG2: 6, Added at IG3: 2

CIS Control 3: IG1 Safeguards

Safeguard 3.1 requires a governing document that explains how teams manage data, including how sensitive it is, who owns it, how it’s handled, how long it’s kept, and how it gets disposed of, reviewed annually.

Safeguard 3.2 builds on 3.1 by asking teams to keep an inventory of their data, starting with sensitive data at the very least, and review it at least annually.

Safeguard 3.3 limits users’ access only to the data they need across local and remote file systems, databases, and applications.

Safeguard 3.4 requires teams to set a minimum and a maximum data-retention period, so an open-ended “keep it” isn’t enough.

Safeguard 3.5 asks teams to dispose of data securely, using methods that match how sensitive the data is.

Safeguard 3.6 requires organizations to encrypt sensitive data on end-user devices using tools like BitLocker, FileVault, or dm-crypt.

CIS Control 3: IG2 Safeguards

Safeguard 3.7 asks teams to sort data into categories, using labels like Sensitive, Confidential, and Public.

Safeguard 3.8 maps how data moves through the enterprise, including to and from service providers.

Safeguards 3.9–3.11 extend encryption beyond end-user devices to:

• 3.9: Data on removable media.
• 3.10: Sensitive data in transit, with TLS and OpenSSH as examples.
• 3.11: Sensitive data at rest on servers, applications, and databases. Storage-layer encryption meets the minimum requirement; application-layer encryption is an additional option.

Safeguard 3.12 keeps data separated by sensitivity, so that sensitive data never gets processed or stored on systems intended for less sensitive work.

CIS Control 3: IG3 Safeguards

Safeguard 3.13 adds a data loss prevention (DLP) tool to identify sensitive data wherever it is stored, processed, or transmitted, including by service providers.

Safeguard 3.14 requires teams to log when sensitive data is accessed, changed, or deleted.

CIS Control 4: Secure Configuration of Enterprise Assets and Software

CIS Control 4 requires organizations to replace insecure default settings with hardened configurations across assets and software. According to CIS, most products ship with defaults designed for quick setup and ease of use rather than security. The Safeguards below specify configuration processes and technical thresholds.

Total Safeguards: 12 | IG1: 7, Added at IG2: 4, Added at IG3: 1

CIS Control 4: IG1 Safeguards

Safeguards 4.1 and 4.2 ask teams to document secure configuration processes.

• 4.1 applies to enterprise assets and software.
• 4.2 applies to network infrastructure.

Teams review both at least annually and when significant enterprise changes could affect the relevant Safeguard.

Safeguard 4.3 caps automatic session locking at 15 minutes of inactivity on general-purpose operating systems and 2 minutes on mobile end-user devices.

Safeguard 4.4 requires firewalls on servers where supported. Examples include virtual, operating-system, and third-party agent firewalls.

Safeguard 4.5 asks for a host-based firewall or port-filtering tool on end-user devices with a default-deny rule for traffic that has not been explicitly allowed.

Safeguard 4.6 requires secure asset and software management. Examples include version-controlled Infrastructure-as-Code and administrative access through Secure Shell (SSH) or Hypertext Transfer Protocol Secure (HTTPS). Insecure protocols such as Telnet and plain Hypertext Transfer Protocol (HTTP) are prohibited unless operationally essential.

Safeguard 4.7 requires management of default accounts, such as root, administrator, and vendor accounts. Disabling them or making them unusable are example implementations.

CIS Control 4: IG2 Safeguards

Safeguard 4.8 has teams uninstall or disable unnecessary services, such as unused file-sharing services or web application modules.

Safeguard 4.9 points assets at trusted Domain Name System (DNS) servers.

Safeguard 4.10 requires automatic device lockout where supported, limiting local failed-authentication attempts to 20 on laptops and 10 on tablets and smartphones, with Microsoft Intune Device Lock and Apple Configuration Profile maxFailedAttempts quoted as examples.

Safeguard 4.11 calls for remote wiping of enterprise data from enterprise-owned portable devices when appropriate, including after loss, theft, or an employee’s departure.

CIS Control 4: IG3 Safeguards

Safeguard 4.12 separates enterprise and personal workspaces on mobile devices, using tools such as Apple Configuration Profiles or Android Work Profiles.

For a faster path to implementing Control 4, the CIS Benchmarks guide explains how to apply CIS’s configuration standards to each platform. CIS also publishes platform-specific security recommendations for operating systems, cloud services, applications, and network devices.

CIS Control 5: Account Management

CIS Control 5 requires organizations to manage account credentials for users, administrators, and services. Its Safeguards address account inventories, unique passwords, inactivity, and separation of administrative access.

Total Safeguards: 6 | IG1: 4, Added at IG2: 2, Added at IG3: 0

CIS Control 5: IG1 Safeguards

Safeguard 5.1 asks teams to keep an inventory of all user, administrator, and service accounts. Each entry should list the person’s name, username, start and stop dates, and department. Teams must check at least quarterly that every active account is still authorized.

Safeguard 5.2 requires unique passwords for enterprise assets. According to CIS, best-practice minimum lengths are 8 characters with multi-factor authentication (MFA) and 14 characters without MFA.

Safeguard 5.3 has teams delete or disable accounts that have gone unused for 45 days, where the system supports it.

Safeguard 5.4 separates duties by account rather than by person, keeping administrator privileges on dedicated admin accounts. Everyday work like browsing, email, and documents can happen from a regular, non-privileged account.

CIS Control 5: IG2 Safeguards

Safeguard 5.5 builds on 5.1 with a separate inventory just for service accounts. Each one gets a department owner, a review date, and a stated purpose, and teams review the list at least quarterly.

Safeguard 5.6 centralizes account management through a directory or identity service.

Control 5 doesn’t add any Safeguards at IG3.

While Control 5 governs accounts, Control 6 picks up from there and covers the systems and data those accounts can access.

CIS Control 6: Access Control Management

CIS Control 6 requires processes and tools to grant, manage, and revoke access privileges for user, administrator, and service accounts.

Total Safeguards: 8 | IG1: 5, Added at IG2: 2, Added at IG3: 1

CIS Control 6: IG1 Safeguards

Safeguards 6.1 and 6.2 ask teams to set up processes, ideally automated, for granting and removing access as people join, leave, or change roles. 6.2 requires immediate account disabling upon termination, rights revocation, or role change. According to CIS, disabling an account instead of deleting it can help preserve the audit trail.

CIS divides MFA across three baseline Safeguards:

Safeguard 6.3 requires MFA for externally exposed enterprise and third-party applications where supported. Enforcing MFA through a directory service or single sign-on (SSO) provider counts.

Safeguard 6.4 covers remote network access.

Safeguard 6.5 requires MFA for administrative access where supported, including accounts managed through a service provider.

CIS Control 6: IG2 Safeguards

Safeguard 6.6 inventories on-site and provider-hosted authentication and authorization systems the enterprise uses, with an annual review.

Safeguard 6.7 centralizes access control through a directory service or single sign-on provider.

CIS Control 6: IG3 Safeguards

Safeguard 6.8 adds role-based access control and requires annual privilege reviews.

CIS Control 7: Continuous Vulnerability Management

CIS Control 7 requires organizations to identify vulnerabilities, prioritize remediation, and track fixes across enterprise assets. The Safeguards combine documented processes with recurring updates and scans.

Total Safeguards: 7 | IG1: 4, Added at IG2: 3, Added at IG3: 0

CIS Control 7: IG1 Safeguards

Safeguards 7.1 and 7.2 ask teams to document how they manage and fix vulnerabilities. 7.1 covers the overall vulnerability management process, reviewed at least annually and when significant enterprise changes could affect it. 7.2 calls for a documented risk-based remediation strategy, reviewed monthly or more often.

Safeguards 7.3 and 7.4 ask teams to patch operating systems and applications automatically at least once a month.

CIS Control 7: IG2 Safeguards

Safeguards 7.5 and 7.6 require automated vulnerability scans. 7.5 covers internal assets at least quarterly, using both authenticated and unauthenticated scans; 7.6 covers externally exposed assets at least monthly.

Safeguard 7.7 builds on 7.2. Teams must fix detected vulnerabilities at least monthly, following the remediation process they’ve already documented.

Control 7 doesn’t add any Safeguards at IG3.

CIS Control 8: Audit Log Management

CIS Control 8 asks enterprises to collect, review, alert on, and retain audit logs.

The Control combines collection with review and alerting so teams can investigate activity across systems. Its Safeguards also specify storage, time synchronization, and retention.

Total Safeguards: 12 | IG1: 3, Added at IG2: 8, Added at IG3: 1

CIS Control 8: IG1 Safeguards

Safeguard 8.1 asks teams to document how they collect, review, and retain logs, and update it at least once a year.

Safeguards 8.2 and 8.3 turn on logging across enterprise assets and make sure there’s enough storage to hold the logs.

CIS Control 8: IG2 Safeguards

Safeguard 8.4 syncs time across assets using at least two synchronized time sources, where supported, so events line up across systems.

Safeguards 8.5 through 8.8 expand what gets logged. 8.5 specifies what a detailed entry holds for assets containing sensitive data — event source, date, username, timestamp, source and destination addresses, plus anything else useful in a forensic investigation.

Safeguard 8.6 adds DNS query logs where appropriate and supported.

Safeguard 8.7 adds Uniform Resource Locator (URL) request logs where appropriate and supported.

Safeguard 8.8 adds command-line activity from tools like PowerShell and Bash.

Safeguards 8.9 and 8.10: Centralize audit log collection and retention where possible; a security information and event management (SIEM) system is one example. Retain audit logs for at least 90 days.

Safeguard 8.11 has teams review logs at least weekly to spot anything unusual.

CIS Control 8: IG3 Safeguards

Safeguard 8.12 adds service provider logs where supported, such as authentication, data creation or disposal, and user management events.

When assessing these Safeguards, check log availability and retention, and keep records of the reviews.

CIS Control 9: Email and Web Browser Protections

CIS Control 9 protects against threats delivered through email and web browsers. Its Safeguards address supported clients, malicious destinations, unnecessary extensions, email authentication, and malware.

Total Safeguards: 7 | IG1: 2, Added at IG2: 4, Added at IG3: 1

CIS Control 9: IG1 Safeguards

Safeguard 9.1 only allows fully supported browsers and email clients to run in the enterprise, and only on the latest vendor versions.

Safeguard 9.2 puts DNS filtering on all end-user devices, both remote and on-premises, to block known malicious domains.

CIS Control 9: IG2 Safeguards

Safeguard 9.3 builds on 9.2. Teams enforce network-based URL filters on every enterprise asset to block malicious or unapproved websites by category, reputation, or block list.

Safeguard 9.4 has teams remove or disable unauthorized or unnecessary browser and email client plugins, extensions, and add-ons.

Safeguards 9.5 and 9.6 tighten email security. 9.5 requires Domain-based Message Authentication, Reporting, and Conformance (DMARC), starting with Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM), to cut down on spoofed or altered emails from valid domains. 9.6 blocks unnecessary file types at the email gateway.

CIS Control 9: IG3 Safeguards

Safeguard 9.7 adds anti-malware protections on email servers, such as attachment scanning or sandboxing.

CIS Control 10: Malware Defenses

CIS Control 10 requires defenses against malicious software on enterprise assets. Its Safeguards combine anti-malware deployment, automatic updates and scanning, anti-exploitation features, and behavior-based detection.

Total Safeguards: 7 | IG1: 3, Added at IG2: 4, Added at IG3: 0

CIS Control 10: IG1 Safeguards

Safeguard 10.1 puts anti-malware software on every enterprise asset.

Safeguard 10.2 has that software update its signature files automatically.

Safeguard 10.3 calls for disabling autorun and autoplay functionality for removable media.

CIS Control 10: IG2 Safeguards

Safeguard 10.4 automates scanning of removable media rather than relying on the autorun block alone.

Safeguard 10.5 enables platform anti-exploitation features, naming Microsoft Data Execution Prevention, Windows Defender Exploit Guard, and Apple System Integrity Protection and Gatekeeper.

Safeguard 10.6 brings the whole estate under central management.

Safeguard 10.7 moves from signatures to behavior-based detection, which watches what the code does rather than what it looks like.

Control 10 doesn’t add any Safeguards at IG3.

Control 14 complements these technical measures with workforce training on social engineering, authentication, and incident reporting.

CIS Control 11: Data Recovery

CIS Control 11 requires a data recovery process, protected backups, and recovery testing. Teams use these measures to restore in-scope systems and data after a loss.

Total Safeguards: 5 | IG1: 4, Added at IG2: 1, Added at IG3: 0

Four of the five Safeguards fall under IG1, one of the highest baseline shares in the framework.

CIS Control 11: IG1 Safeguards

Safeguard 11.1 documents the data recovery process, covering what gets recovered, in what order, and how backup data stays secure. Teams review it at least once a year.

Safeguard 11.2 has teams run automated backups weekly or more frequently based on data sensitivity.

Safeguards 11.3 and 11.4 keep backups safe. 11.3 protects recovery data with controls equivalent to those protecting the original data. 11.4 requires an isolated recovery copy; examples include version-controlled backup destinations using offline, cloud, or off-site systems or services.

CIS Control 11: IG2 Safeguards

Safeguard 11.5 requires quarterly or more frequent restore testing for a sampling of in-scope assets. A successful backup job only shows the backup ran, while a restore test shows the data can actually come back.

Control 11 doesn’t add any Safeguards at IG3.

CIS Control 12: Network Infrastructure Management

CIS Control 12 requires organizations to manage network infrastructure securely, including its software, architecture, administrative access, and protocols.

Total Safeguards: 8 | IG1: 1, Added at IG2: 6, Added at IG3: 1

One of the eight Safeguards is in IG1; the other seven begin at IG2 or IG3.

CIS Control 12: IG1 Safeguards

Safeguard 12.1 requires network infrastructure to stay up to date. Running the latest stable software release and using supported network-as-a-service offerings are examples. Review software versions at least monthly to verify continued support.

CIS Control 12: IG2 Safeguards

Safeguards 12.2 and 12.4 cover network architecture. 12.2 has teams build and maintain a secure architecture that addresses segmentation, least privilege, and availability at minimum. It is the relevant requirement when a questionnaire asks how the framework addresses segmentation. 12.4 keeps architecture diagrams up to date, reviewed at least once a year.

Safeguards 12.3 and 12.6 cover how the network gets managed. 12.3 requires secure infrastructure management, with version-controlled Infrastructure-as-Code and secure protocols as examples. 12.6 calls for secure protocols such as 802.1X for network management and WPA2 Enterprise or better for communications.

Safeguards 12.5 and 12.7 cover network access. 12.5 centralizes authentication, authorization, and auditing (AAA). 12.7 builds on it by requiring remote devices to connect through an enterprise-managed virtual private network (VPN) and authenticate through that AAA setup before reaching enterprise resources.

CIS Control 12: IG3 Safeguards

Safeguard 12.8 sets up strict dedicated computing resources for all administrative work. They stay physically or logically separate, segmented from the main network, and are not allowed internet access.

CIS Control 13: Network Monitoring and Defense

CIS Control 13 helps enterprises spot and defend against threats moving across their network.

Total Safeguards: 11 | IG1: 0, Added at IG2: 6, Added at IG3: 5

Control 13 is one of three Controls with no Safeguards in IG1.

CIS Control 13: IG2 Safeguards

Safeguard 13.1 centralizes security event alerting across enterprise assets. CIS points to a security information and event management (SIEM) system as best practice, though a log analytics platform with security-focused correlation alerts also works.

Safeguards 13.2 and 13.3 add intrusion detection. 13.2 covers hosts where appropriate or supported; 13.3 covers networks where appropriate, including equivalent cloud-provider services.

Safeguard 13.4 builds on 12.2 by filtering traffic between network segments.

Safeguard 13.5 permits remote access based on three conditions: current anti-malware, compliance with the secure configuration process, and current operating systems and applications.

Safeguard 13.6 collects network traffic flow logs so teams can review them and set up alerts.

CIS Control 13: IG3 Safeguards

Safeguards 13.7 and 13.8 add intrusion prevention. 13.7 covers hosts where appropriate or supported, with an endpoint detection and response (EDR) client as one example; 13.8 covers networks where appropriate.

Safeguard 13.9 deploys port-level access control using 802.1X or similar protocols.

Safeguard 13.10 adds application-layer filtering through tools like a filtering proxy or application-layer firewall.

Safeguard 13.11 requires monthly alert-threshold tuning to keep alerts useful for operators.

CIS Control 14: Security Awareness and Skills Training

CIS Control 14 requires a security awareness and skills training program to help the workforce handle enterprise assets and data securely.

Total Safeguards: 9 | IG1: 8, Added at IG2: 1, Added at IG3: 0

Eight of the nine Safeguards fall under IG1, the heaviest baseline share in the framework.

CIS Control 14: IG1 Safeguards

Safeguard 14.1 requires employees to be trained when they’re hired and at least once a year after that. Teams review the training content every year.

Safeguards 14.2 through 14.8 set the topics the training has to cover.

• 14.2 covers social engineering, including phishing, business email compromise, pretexting, and tailgating.
• 14.3 covers authentication, including MFA, password composition, and credential management.
• 14.4 covers storing, transferring, archiving and destroying sensitive data, and explicitly includes clear screen and desk practice — locking screens, erasing whiteboards after meetings, storing assets securely.
• 14.5 covers the causes of accidental exposure: mis-delivery, losing a portable device, publishing to unintended audiences.
• 14.6 covers recognizing and reporting security incidents.
• 14.7 teaches workforce members to spot and report failed patches and broken automation.
• 14.8 covers the risks of insecure networks. Enterprises with remote workers must include home-network security in the training.

CIS Control 14: IG2 Safeguards

Safeguard 14.9 adds role-specific training at IG2, with examples including secure administration courses for information technology (IT) staff, Open Worldwide Application Security Project (OWASP) Top 10 training for web developers, and advanced social engineering training for high-profile roles.

CIS Control 15: Service Provider Management

CIS Control 15 requires a process to evaluate service providers that hold sensitive data or support critical enterprise platforms and processes.

Total Safeguards: 7 | IG1: 1, Added at IG2: 3, Added at IG3: 3

Five of the seven Safeguards map to the Govern function, more than any other Control.

CIS Control 15: IG1 Safeguards

Safeguard 15.1 calls for an inventory of known service providers, with each provider’s classification and a named enterprise contact. Review the inventory at least annually.

CIS Control 15: IG2 Safeguards

Safeguard 15.2 requires a provider management policy that covers classification, inventory, assessment, monitoring, and decommissioning. Teams review it every year.

Safeguard 15.3 calls for classifying service providers. Considerations may include one or more factors such as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk and mitigated risk. Review and update classifications annually, or when significant enterprise changes could affect this Safeguard.

Safeguard 15.4 requires contracts to include security requirements consistent with the enterprise’s service provider management policy. Examples include minimum program requirements, breach notification and response, encryption, and data disposal. Review contracts annually to check for missing security requirements.

CIS Control 15: IG3 Safeguards

Safeguard 15.5 asks teams to assess providers based on their classification. Teams can use Service Organization Control 2 (SOC 2) reports, Payment Card Industry (PCI) Attestations of Compliance, custom questionnaires, or other rigorous methods as evidence. Providers get reassessed at least once a year and whenever a contract is new or renewed.

Safeguard 15.6 requires monitoring consistent with the service provider management policy. Examples include reassessment, release-note tracking, and dark web monitoring.

Safeguard 15.7 calls for securely decommissioning service providers. Example considerations include deactivating user and service accounts, ending data flows, and securely disposing of enterprise data in the provider’s systems.

CIS Control 16: Application Software Security

CIS Control 16 sets out to secure the software an enterprise builds, hosts, or buys. Control 16 and Control 3 (Data Protection) tie as the largest Controls in the framework, with 14 Safeguards each.

Total Safeguards: 14 | IG1: 0, Added at IG2: 11, Added at IG3: 3

Control 16 doesn’t have any Safeguards in IG1.

CIS Control 16: IG2 Safeguards

Safeguard 16.1 requires a secure application development process covering secure design standards, secure coding practices, developer training, vulnerability management, third-party code security, and testing procedures.

Safeguard 16.2 requires a process to accept and address vulnerability reports, including reports from outside parties. Name the responsible staff and track each report’s severity and timing.

Safeguard 16.3 calls for root cause analysis of security vulnerabilities.

Safeguard 16.6 builds on 16.2 with a severity rating system that sets a minimum level of security acceptability for releasing code.

Safeguards 16.4 and 16.5 track and vet the third-party components applications are built from, such as libraries, frameworks, and open-source packages. 16.4 asks teams to keep an inventory of them, which CIS calls a bill of materials, along with the risk each one poses. Teams review this at least monthly. 16.5 requires those components to be up to date and either come from trusted sources or get evaluated before use.

Safeguard 16.7 applies industry-recommended hardening templates to servers, databases, web servers, containers, platform-as-a-service (PaaS) components, and software-as-a-service (SaaS) components. It also states that in-house software must not weaken configuration hardening.

Safeguard 16.8 keeps production and non-production systems separate.

Safeguard 16.9 trains developers in secure coding suited to their environment at least once a year.

Safeguard 16.10 applies secure design principles, including least privilege and mediation of every user operation. It also calls for explicit, documented checks of input size, data type, and acceptable ranges.

Safeguard 16.11 calls for vetted modules for identity, encryption, auditing, and logging. Encryption algorithms must be standardized, currently accepted, and extensively reviewed.

CIS Control 16: IG3 Safeguards

Safeguard 16.12 adds static and dynamic code analysis to the development lifecycle.

Safeguard 16.13 conducts application penetration testing. For critical applications, CIS identifies authenticated penetration testing as better suited to finding business logic vulnerabilities than code scanning and automated testing.

Safeguard 16.14 has teams run threat modeling before any code gets written.

CIS Control 17: Incident Response Management

CIS Control 17 requires an incident response program with designated personnel, reporting procedures, response processes, and exercises.

Total Safeguards: 9 | IG1: 3, Added at IG2: 5, Added at IG3: 1

CIS Control 17: IG1 Safeguards

Safeguard 17.1 asks for one key person and at least one backup to manage incident handling. If a service provider handles the work, at least one internal person must oversee them.

Safeguards 17.2 and 17.3 set up how incidents get reported. 17.2 requires annually verified contact information for parties that need notification, which may include staff, providers, law enforcement, insurers, government agencies, and information sharing and analysis center (ISAC) partners. 17.3 requires a reporting process shared with the whole workforce, stating the timeframe, who to report to, how to report, and the minimum information needed.

CIS Control 17: IG2 Safeguards

Safeguard 17.4 documents the response process covering roles, compliance requirements and a communication plan.

Safeguard 17.5 builds on 17.4 by assigning roles across legal, IT, information security, facilities, public relations, human resources, responders, analysts, and third parties.

Safeguard 17.6 has teams set primary and secondary ways to communicate during an incident, since channels like email may be affected by the incident itself.

Safeguards 17.7 and 17.8 help teams learn and improve. 17.7 runs exercises testing communication channels, decision making and workflows, at least annually. 17.8 has teams review each incident afterward to capture lessons learned and follow-up actions.

CIS Control 17: IG3 Safeguards

Safeguard 17.9 sets incident thresholds that, at minimum, differentiate an incident from an event.

CIS Control 18: Penetration Testing

CIS Control 18 tests the effectiveness of defenses through simulated attacks.

Total Safeguards: 5 | IG1: 0, Added at IG2: 3, Added at IG3: 2

Control 18 doesn’t add any Safeguards at IG1.

CIS Control 18: IG2 Safeguards

Safeguard 18.1 requires a penetration testing program suited to the enterprise’s size, complexity, industry, and maturity, defining what gets tested, such as networks, web applications, application programming interfaces (APIs), hosted services, and physical premises. It also sets testing frequency, limits, contacts, how findings get routed internally, and retrospective requirements.

Safeguard 18.2 requires external penetration tests at least once a year, run by a qualified party. Tests include reconnaissance to find exploitable information and can be clear box (testers get internal details) or opaque box (they don’t).

Safeguard 18.3 builds on 7.2 by having teams fix test findings through the documented remediation process, with timelines and effort set by impact.

CIS Control 18: IG3 Safeguards

Safeguard 18.4 validates security measures after each test, modifying rulesets and detection capability where the test exposed gaps.

Safeguard 18.5 extends 18.2 by adding internal penetration tests at least once a year.

How to Simplify CIS Controls Implementation

To manage CIS Controls implementation, assign responsibility for selected Safeguards, collect supporting evidence, and review progress against the selected Implementation Group. When responses and follow-up records are spread across departments and vendors, reviewers need a way to see what is complete and which gaps still need action. A governance, risk, and compliance (GRC) platform brings those assessment records together.

Isora GRC, the GRC Assessment Platform™, connects questionnaires, assessments, risk records, and reporting to help teams manage that work.

See the GRC Assessment Platform™ in action →

Assessment Management

Organize CIS assessments into series, assign respondents and deadlines, and track completion from one dashboard. In Isora, assessment series group reviews by compliance goal, with progress and scoring available across assessment targets.

Learn more about Assessment Management with Isora GRC →

Questionnaires & Surveys

Send framework-aligned questions to system owners and department leads, let several contributors complete one questionnaire, and collect evidence with each answer, all in one place. Isora includes CIS questionnaires in its prebuilt library, and teams can customize the questions and scoring for their environment.

Learn more about Questionnaires & Surveys with Isora GRC →

Risk Management

Review assessment findings, decide which need risk records, and assign owners and remediation plans. In Isora, the risk register keeps the originating questionnaire and control context with milestones and status updates through closure.

Learn more about Risk Management with Isora GRC →

Reports & Scorecards

Generate reports and scorecards from assessment responses, compare results across departments or vendors, and open individual answers to review evidence. In Isora, live assessment data supports reporting, with PDF and CSV exports for sharing results.

Learn more about Reports & Scorecards with Isora GRC →

Key Takeaways

The 18 CIS Controls contain 153 Safeguards, with 56 in IG1, 130 in IG2, and all 153 in IG3. The groups are cumulative, and Safeguard counts alone do not determine implementation priority.

Start with the IG1 baseline CIS recommends for every enterprise, then assess which additional Safeguards the organization’s risks and resources warrant. Record owners, implementation evidence, review dates, and significant changes that require updates.

Isora GRC connects assessment responses, supporting evidence, and risk records so teams can coordinate reviews and track corrective action.

See how Isora GRC simplifies CIS Controls compliance →

18 CIS Controls FAQs

What are the 18 CIS Controls?

The 18 CIS Controls are, in order: Inventory and Control of Enterprise Assets; Inventory and Control of Software Assets; Data Protection; Secure Configuration of Enterprise Assets and Software; Account Management; Access Control Management; Continuous Vulnerability Management; Audit Log Management; Email and Web Browser Protections; Malware Defenses; Data Recovery; Network Infrastructure Management; Network Monitoring and Defense; Security Awareness and Skills Training; Service Provider Management; Application Software Security; Incident Response Management; and Penetration Testing. Together they contain 153 individual Safeguards.

Is it the CIS 18 or the CIS Top 20?

The CIS 18 and the CIS Top 20 are the same framework, just named at different points in its history. The Top 20 name goes back to when the framework listed 20 Controls, until CIS Controls v8 reduced the count to 18 by organizing them around activity rather than device ownership. The framework was formerly known as the SANS Top 20, and CIS officially took ownership in 2015.

How many Safeguards are in the CIS Controls?

CIS Controls v8 and v8.1 both contain 153 Safeguards; v8.1 is the current version, released in June 2024. Individual Controls range from five Safeguards in Controls 1, 11, and 18 to 14 in Controls 3 and 16.

What is CIS Control 8?

CIS Control 8 is Audit Log Management, with 12 Safeguards covering collection, alerting, review, and retention. Its requirements include documented logging processes, detailed records, at least 90 days of retention at IG2, and log reviews at least weekly at IG2.

Which CIS Controls should a small team implement first?

Start with Implementation Group 1, the 56 Safeguards CIS designates as essential cyber hygiene. The Community Defense Model v3.0 uses threat intelligence, breach data, and MITRE ATT&CK mappings to help prioritize safeguards against common attack types. Asset and software inventories help define the systems that subsequent safeguards must address.

Is there such a thing as CIS Controls certification?

CIS offers organization-level Controls Accreditation for qualified service providers that deliver implementation, auditing, or assessment services. That accreditation concerns the provider’s services; assess your own implementation against the applicable Safeguards. CIS’s Controls FAQ also explains that using the Controls does not replace existing regulatory, compliance, or authorization requirements.

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.