CIS Controls v8.1: What Changed From v8 (and What Didn’t)

CIS Controls v8.1 is the most recent update to version 8 of the CIS Critical Security Controls, a prioritized set of cybersecurity practices published by the Center for Internet Security (CIS). Released in June 2024, v8.1 remains the latest version as of November 2026.

Structurally, CIS Controls v8.1 has the same 18 Controls and 153 Safeguards as v8. Still, the v8.1 update:

• Added a Govern security function
• Introduced Documentation as a sixth asset class
• Revised some Safeguard descriptions

Teams moving from v8 can keep their assessment structure, but they may need to update the questions, framework mappings and evidence inside it.

This guide explains each change from CIS Controls v8 to v8.1, how the update affects assessments, the unchanged Control and Safeguard counts, and where to download the official files, including the change log.

Turn your CIS Controls v8 work into a starting point for NIST CSF 2.0.

Map each of the 106 CSF 2.0 Subcategories to CIS Controls v8, NIST SP 800-53, 800-171, ISO 27001 and SCF at the individual control level.

Get the NIST CSF 2.0 Multi-Framework Crosswalk →

When Was CIS Controls v8.1 Released?

CIS Controls v8.1 was released on June 24, 2024, three years after v8 in May 2021. Since then, CIS has published two minor revisions of the v8.1 Guide, v8.1.1 in August 2024 and v8.1.2 in March 2025. Both correct text and links without changing the framework, so a CIS file labeled v8.1.2 still covers v8.1.

What Changed in CIS Controls v8.1?

CIS Controls v8.1 made five changes, mostly to Safeguard labels and explanations. The goal of the update was to give security teams clearer context and more consistent language for implementation.

CIS Controls v8.1 is an iterative update to CIS Controls v8 that helps organizations prioritize cybersecurity work. It adds a governance function to the security-function mapping and clarifies language teams use to interpret selected Safeguards.

With v8.1, CIS:

• Realigned security-function mappings to NIST CSF 2.0, including the Govern function.
• Added or expanded glossary definitions for terms such as plan, process and sensitive data, which teams should check when interpreting Safeguards.
• Revised asset classes and their Safeguard mappings, including a new Documentation class.
• Fixed minor typos in Safeguard descriptions without changing their intended meaning.
• Clarified selected Safeguard descriptions to provide more useful implementation guidance.

Some Safeguards have new function and asset-class tags or more explicit wording. Safeguard 5.1, for example, now explicitly names service accounts alongside user and administrator accounts in the inventory’s minimum list. Version 8 already required an inventory of all accounts managed in the enterprise, so this clarification does not mean service accounts were previously outside its scope. Before reusing a v8 assessment, check the v8.1 change log and update the questions and evidence requests for the affected Safeguards.

The table below shows each change from v8 to v8.1 and the assessment materials it affects.

A New Govern Security Function

CIS Controls v8.1 introduced Govern to align its security functions with NIST CSF 2.0. It now sits alongside Identify, Protect, Detect, Respond and Recover, the five security functions used in v8.

As a result, many Safeguards that cover policies, plans and processes now carry the Govern tag instead of their v8 function. For example, Safeguard 4.1, a documented secure configuration process for enterprise assets and software, moved from Protect in v8 to Govern in v8.1.

Teams should check whether function-based assessments, dashboards and reports reflect the revised labels. Use CIS’s official crosswalk to compare CIS Controls v8.1 with NIST CSF 2.0.

Revised Asset Classes

CIS Controls v8.1 uses six asset classes—Devices, Software, Data, Users, Network and Documentation—instead of v8’s five.

Version 8.1 made two changes to the v8 asset classes.

• Software replaces Applications and covers applications and other software, such as firmware. Not every Applications Safeguard moved to Software, so a find-and-replace on the old label misplaces Safeguards like 4.1, which moved to Documentation instead. Check filters and reports against the v8.1 asset mappings.
• Documentation is new and identifies Safeguards focused on written materials such as plans, policies, processes, procedures and diagrams. Collect these documents, along with their review dates and any supporting evidence.

How Many Controls and Safeguards Are in CIS Controls v8.1?

CIS Controls v8.1 contains 18 Controls and 153 Safeguards, the same totals as v8, with no changes to Implementation Group (IG) assignments. Each IG adds Safeguards to the one before it.

• IG1, 56 Safeguards: the essential cyber hygiene baseline and starting point for every organization.
• IG2, 74 more Safeguards: 130 in total, including all of IG1.
• IG3, 23 more Safeguards: all 153, including IG1 and IG2.

An organization scoped to IG2 implements 130 of the 153 Safeguards, whether it follows v8 or v8.1.

The CIS Controls Navigator lets teams explore Safeguards and their Implementation Group assignments. Since it is a live resource and may show later revisions, use the v8-to-v8.1 Change Log to review the original transition.

For a breakdown of each Control and its Safeguards, read our guide to the 18 CIS Controls.

Where to Download CIS Controls v8.1

The official CIS Controls v8.1 files are free to download from CIS’s v8.1 page. Select the download option and follow CIS’s current download instructions.

The full download includes:

• PDF Guide: the full Controls, Safeguards and descriptions.
• Excel workbook: the same content in spreadsheet form, for building or updating assessments.
• Change Log: the changes between v8 and v8.1.
• Implementation Groups: the IG assignment for each Safeguard.

Because later editions of the Guide include recent corrections, download fresh copies instead of relying on saved files.

Additional CIS Controls Resources and Usage Rights

Teams can also use the CIS Controls Navigator to filter Safeguards by IG, view framework mappings and export a spreadsheet. CIS’s 18-Control poster developed with the SANS Institute provides a visual overview of all 18 Controls.

The CIS Controls Guide identifies its license as Creative Commons Attribution-NonCommercial-NoDerivatives 4.0. Its license notice permits noncommercial redistribution with attribution and a license link, and prohibits distributing modified materials. Consult the applicable CIS terms of use before reusing the content.

Using the CIS Controls in tools or services for customers, however, requires a CIS SecureSuite Product Vendor or Consulting Membership, or authorized Supporter status, according to the CIS Controls FAQs.

CIS SecureSuite members’ use of products offered through their membership is governed by their agreement with CIS, rather than these non-member terms.

Should Organizations Move From CIS Controls v8 to v8.1?

Yes. CIS identifies v8.1 as the current version and describes it as backward compatible with previous versions on its Controls page. Teams can use their v8 assessment materials as a starting point, then review the changed mappings and wording.

The following five steps are practical recommendations for that review:

1. Download the current Guide. Record which edition the next assessment uses so results compare cleanly across cycles.
2. Remap security functions. Check reports and questionnaires against the NIST CSF 2.0 mappings, including Govern.
3. Reassign asset classes. Match the assets and records in each assessment to the revised classes, including Documentation.
4. Update Safeguard wording. Compare Safeguard text and glossary definitions in policies and questionnaires against the v8.1 Guide. For example, check that account-inventory questions explicitly include service accounts, as clarified in Safeguard 5.1.
5. Recheck evidence. Use the CIS Controls Assessment Specification to confirm existing evidence still meets how each Safeguard is measured.

When to move depends on each team’s reporting needs. Teams whose reports or crosswalks must reflect NIST CSF 2.0 should switch before the next assessment cycle starts. If a cycle is already underway, finish it on v8, record the version used, and apply v8.1 at the next refresh so results stay comparable.

How to Simplify CIS Controls Version Changes

Simplifying a CIS Controls version change means carrying existing assessment records forward without losing the responses, evidence and findings already collected. Moving to v8.1 involves retagging Safeguards under Govern and the revised asset classes, rechecking responses against revised wording, and recording which CIS Controls version each assessment uses.

Isora GRC is the GRC Assessment Platform™ that connects assessment responses and supporting evidence with findings and risk records. Teams review the framework changes and decide which questions and evidence need updating.

See the GRC Assessment Platform™ in action →

Assessment Management

Keep your CIS Controls assessment on track as you review the v8.1 changes. In Isora, organize assessments by framework, assign work and monitor completion from one dashboard.

Learn more about Assessment Management with Isora GRC →

Questionnaires & Surveys

Update assessment questions and gather evidence where v8.1 changes affect your existing v8 assessment. In Isora, use a prebuilt CIS questionnaire or build your own, invite multiple contributors and attach evidence to the questions it supports.

Learn more about Questionnaires & Surveys with Isora GRC →

Reports & Scorecards

Share assessment results without compiling them by hand. In Isora, scorecards pull from assessment data and let you open the underlying responses and evidence or export results for stakeholders.

Learn more about Reports & Scorecards with Isora GRC →

Risk Management

Follow up on gaps your team identifies during the v8.1 review. In Isora, triage findings, assign risk owners and document remediation plans and milestones through closure.

Learn more about Risk Management with Isora GRC →

Key Takeaways

CIS published CIS Controls v8.1 on June 24, 2024, keeping v8’s 18 Controls, 153 Safeguards and three Implementation Groups. The update adds Govern as a security function to match NIST CSF 2.0, uses six asset classes including Documentation, and revises selected glossary terms and Safeguard descriptions. It is the current version, with v8.1.1 and v8.1.2 adding minor corrections.

Moving to v8.1 requires teams to recheck function tags, asset filters, quoted wording and the evidence behind each response, across up to 153 Safeguards and multiple owners.

A GRC Assessment Platform™ like Isora GRC keeps assessment responses, supporting evidence and risk records connected in one workspace. Reviewers can use those records to inform the next assessment while checking whether the questions and evidence still fit the current framework.

See how Isora GRC supports CIS Controls assessments →

CIS Controls v8.1 FAQs

Is CIS Controls v8.1 the current version?

Yes. CIS Controls v8.1 is the current version of the CIS Controls. It updates v8 with revised asset classes and Safeguard descriptions and aligns its security functions with NIST CSF 2.0. ⁠

When was CIS Controls v8.1 released?

CIS published CIS Controls v8.1 on June 24, 2024, about three years after v8. CIS later released two minor revisions of the v8.1 Guide: v8.1.1 in August 2024 and v8.1.2 in March 2025. These revisions corrected text and links without introducing a new framework version. ⁠

Did CIS Controls v8.1 add new Safeguards?

No. CIS Controls v8.1 has the same 153 Safeguards as v8, with the same identifiers and Implementation Group tags. CIS did revise some Safeguard descriptions to fix typos and clarify thin wording, which in some cases adds detail. Check the latest CIS Controls v8.1 Guide for the current wording.

How many Controls and Safeguards does CIS Controls v8.1 have?

CIS Controls v8.1 has 18 Controls and 153 Safeguards. CIS organizes the Safeguards into three Implementation Groups: IG1, IG2 and IG3.

What is the difference between CIS Controls v8 and v8.1?

CIS Controls v8.1 changes how Safeguards are labeled and described, not how many there are. It adds Govern as a security function to match NIST CSF 2.0, uses six asset classes including the new Documentation class, expands glossary definitions and clarifies selected Safeguard descriptions. Both versions have 18 Controls and 153 Safeguards.

Where can I download CIS Controls v8.1?

The Guide and related resources are available from the CIS v8.1 download page. The CIS Controls Navigator also lets readers filter Safeguards by Implementation Group and export a spreadsheet.

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.