What are the CIS Critical Security Controls?

The CIS Critical Security Controls are a framework comprised of actionable safeguards that organizations can utilize to strengthen their cybersecurity footprint. They are developed and maintained by the Center for Internet Security (CIS), a community-driven nonprofit, and the current version is 8.1.

Aligning with other industry standards such as NIST, GDPR, ISO 27001, and more, each of the 18 controls consist of safeguards that require you to do one thing.

The CIS Controls are broken into the following components:

Controls

The 18 Controls are the top-level areas of defense. Each one describes a security outcome an organization should achieve. On this site, Controls are tagged as "CIS #", for example CIS 5 for Account Management.

The 18 controls are listed below:

• CIS 1: Inventory and Control of Enterprise Assets - Actively manage every device connected to your infrastructure, physically, virtually, or remotely, so you know what needs to be monitored and protected.
• CIS 2: Inventory and Control of Software Assets - Track all software on the network so only authorized, supported software is installed and can run.
• CIS 3: Data Protection - Identify, classify, securely handle, retain, and dispose of data.
• CIS 4: Secure Configuration of Enterprise Assets and Software - Establish and maintain hardened configurations for devices and software.
• CIS 5: Account Management - Manage the credentials and lifecycle of user, administrator, and service accounts.
• CIS 6: Access Control Management - Create, assign, manage, and revoke access and privileges, including multi-factor authentication.
• CIS 7: Continuous Vulnerability Management - Continuously find, assess, and fix vulnerabilities to shrink the window of opportunity for attackers.
• CIS 8: Audit Log Management - Collect, review, and retain logs that help detect, understand, and recover from an attack.
• CIS 9: Email and Web Browser Protections - Reduce the attack surface of email and web browsers, two of the most common ways attackers get in.
• CIS 10: Malware Defenses - Prevent or control the installation, spread, and execution of malicious code.
• CIS 11: Data Recovery - Maintain data recovery practices that can restore assets to a trusted, pre-incident state.
• CIS 12: Network Infrastructure Management - Track, manage, and fix network devices to keep attackers from exploiting weak network services and access points.
• CIS 13: Network Monitoring and Defense - Monitor and defend the network infrastructure and user base against security threats.
• CIS 14: Security Awareness and Skills Training - Build a security-aware workforce with the skills to reduce cybersecurity risk.
• CIS 15: Service Provider Management - Evaluate service providers that hold sensitive data or run critical IT platforms to make sure they protect them appropriately.
• CIS 16: Application Software Security - Manage the security lifecycle of in-house, hosted, or acquired software to prevent, detect, and fix weaknesses.
• CIS 17: Incident Response Management - Build an incident response program to prepare for, detect, and quickly respond to attacks.
• CIS 18: Penetration Testing - Test how well your defenses hold up by simulating the objectives and actions of a real attacker.

Safeguards

Each Control is broken down into Safeguards (formerly called Sub-Controls), 153 in total. Each Safeguard is a single, specific action numbered under its parent Control. For example, CIS 5.2 (Use Unique Passwords) falls under Control 5, Account Management.

On this site, Safeguard tags appear right after their parent Control, so you can search broadly by Control or narrowly by Safeguard.

Implementation Groups

CIS also sorts the Safeguards into three Implementation Groups (IGs) to help organizations prioritize based on their size, resources, and risk:

• IG1 (Essential Cyber Hygiene) - 56 foundational Safeguards that every organization should implement, regardless of size.
• IG2 - Adds 74 Safeguards for organizations managing IT across multiple departments with differing risk profiles.
• IG3 - Adds the final 23 Safeguards for organizations with security experts protecting sensitive data against sophisticated attacks.

Content on this site is tagged by Control and Safeguard rather than by Implementation Group.