Home / Knowledge hub / CIS Controls
Knowledge hub
CIS Controls
A prioritised list of safeguards that stop the most common cyber attacks.
What it means
The CIS Controls are a prioritised set of security safeguards published by the Center for Internet Security. Version 8 groups them into 18 controls, such as inventory of assets, secure configuration, access control management, vulnerability management and incident response. Each control breaks down into specific safeguards you can check.
The idea that makes it click: the list is ordered by what works against common attacks, not by what is easiest to buy. It also scales. Three implementation groups let a small company start with a basic set of safeguards, while larger or higher-risk organisations add more.
Why it matters
Many teams do not know where to begin, and a framework with hundreds of clauses is hard to start. The CIS Controls give a short, practical order of work. They also map to other standards, so effort spent here counts toward ISO 27001, the NIST Cybersecurity Framework and similar requirements.
They are used as a yardstick in customer questionnaires and by insurers. Being able to say which implementation group you meet, and show evidence for the safeguards, answers a long list of questions in one go and avoids vague promises in a security questionnaire.
How it shows up
You meet them as a self-assessment spreadsheet or a tool that scores you against the safeguards. Several controls matter directly to application teams: secure configuration, account management, vulnerability management, application software security, audit log management and penetration testing. Work through them in order.
Repeating mistakes: treating the list as a one-off audit, marking a safeguard done because a policy exists and not because it works, and aiming at the highest group before the first one is solid. Start with the first implementation group, gather evidence for each safeguard, and review the score on a schedule.
Questions people ask
CIS Controls, answered
Is CIS Controls a certification?
No. It is a set of recommended safeguards, not a scheme that issues a certificate. You can assess yourself against it or have someone else assess you.
Some customers accept a completed assessment as evidence.
What are the implementation groups?
They are three tiers of safeguards. Group 1 is essential cyber hygiene for any organisation, group 2 adds more for organisations with more complex systems, and group 3 is for those facing sophisticated attacks.
Pick the group that matches your size and risk.
How do CIS Controls differ from CIS Benchmarks?
Controls are high-level safeguards across the whole organisation. Benchmarks are detailed configuration guides for specific products, such as an operating system or a cloud platform.
Benchmarks help you meet the secure configuration control.
Do the CIS Controls cover application security?
Yes, in part. There is a control for application software security, and others for vulnerability management and penetration testing.
They are broad, so they do not replace a test of your own application's logic.
Is the framework free?
Yes, the Controls can be downloaded free from the Center for Internet Security. Some supporting tools and benchmark formats require membership.
Check the current terms on their site. Always use the current version.
Sources
Where this comes from
Related
Terms that sit next to this one
NIST Cybersecurity Framework
A voluntary framework that organises security work into six core functions.
ISO 27001
The international standard for running an information security management system.
Vulnerability management
The loop of finding, prioritising, fixing and checking the fix held.
Security questionnaire
The list of questions a buyer's security team sends before they sign.
Penetration test
A time-boxed engagement where skilled people attack your systems by hand.
Which safeguard needs proof?
For the safeguards about testing and fixing, we give evidence you can show: findings with request and response, and fixes proven by re-running the exact exploit. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.