What is CIS Critical Security Controls?
Last updated: April 10, 2026
Definition
CIS Critical Security Controls (CIS Controls) are a prescriptive, prioritized set of 18 cybersecurity best practices developed by the Center for Internet Security that organizations implement to defend against the most prevalent cyberattacks. Security teams, IT managers, and compliance officers use the Controls to establish measurable security baselines through discrete Safeguards organized into three Implementation Groups (IG1, IG2, IG3) that scale from foundational cyber hygiene to advanced security programs.
Key Facts
- Also known as: CIS Controls, CIS Critical Security Controls, formerly SANS Top 20
- Category: Compliance & Risk
- Current version: v8.1 (released June 2024)
- Maintained by: Center for Internet Security (CIS), a nonprofit founded in 2000
- Originally developed: 2008 by SANS Institute (transferred to CIS in 2015)
- Related frameworks: Maps to NIST Cybersecurity Framework 2.0, ISO/IEC 27001, PCI DSS, HIPAA, GDPR, SOC 2, MITRE ATT&CK, CMMC
- Implementation structure: 18 Controls, 153 Safeguards, 3 Implementation Groups (IG1: 56 Safeguards, IG2: 130 Safeguards, IG3: all 153 Safeguards)
How CIS Controls Work
CIS Controls organize cybersecurity into 18 prioritized Controls that span the full security lifecycle. Each Control contains individual Safeguards that define discrete, measurable actions organizations must take. Control 1 requires maintaining an inventory of all enterprise assets. Control 2 catalogs all software. Control 7 addresses continuous vulnerability management through automated patching. Control 17 defines incident response procedures including role assignment and communication protocols.
The framework uses three Implementation Groups to match security measures to organizational resources. IG1 contains 56 essential Safeguards that establish basic cyber hygiene for all organizations. IG2 builds on IG1 with 74 additional Safeguards for moderate complexity. IG3 encompasses all 153 Safeguards for organizations handling sensitive data or facing advanced threats. Organizations progress through IGs based on maturity rather than implementing all Controls simultaneously.
Version 8.1 introduced task-based organization instead of role-based groupings, acknowledging that security responsibilities shift across hybrid and cloud environments. The framework maps each Safeguard to specific attack techniques in the MITRE ATT&CK framework, allowing security teams to trace defensive measures directly to real-world threat patterns.
Why CIS Controls Matter
Organizations implementing all CIS Safeguards achieve defense against 86% of attack techniques documented in the MITRE ATT&CK framework, according to the CIS Community Defense Model v2.0. Even foundational IG1 alone defends against 74% of documented techniques, providing substantial protection through essential measures that require minimal resources.
For security teams working without dedicated staff, CIS Controls provide concrete starting points instead of abstract guidance. The framework translates high-level compliance requirements into specific tasks with clear success criteria. Multiple U.S. states cite CIS Controls implementation as evidence of legally defensible reasonable cybersecurity in safe harbor statutes. Organizations use CIS Controls as the tactical implementation layer beneath strategic frameworks like NIST CSF, satisfying multiple compliance framework implementation requirements through a single control set and collecting audit evidence once to address HIPAA, PCI DSS, SOC 2, and ISO 27001 simultaneously.
CIS Critical Security Controls vs. NIST Cybersecurity Framework
| Aspect | CIS Controls | NIST CSF |
| Primary function | Prescriptive Safeguards with specific tasks | Strategic governance framework |
| Scope | 18 Controls, 153 discrete actions | Five core functions, flexible categories |
| Used by | Security teams implementing tactical measures | Executives managing security programs |
| Key difference | Tactical "how" with measurable steps | Strategic "what" and "why" |
| When to use | Operational implementation | Program governance and risk communication |
CIS Controls provide tactical implementation beneath NIST CSF's strategic framework. Organizations use NIST CSF for program structure and CIS Controls for specific technical safeguards.
Common Misconceptions
CIS Controls are not only for large enterprises with mature security programs. Implementation Group 1 was designed specifically for small and mid-size organizations with limited resources, providing 56 foundational Safeguards that establish basic cyber hygiene regardless of organization size or security maturity level.
CIS Controls do not replace managed security services or other compliance frameworks. The Controls map to and complement frameworks like NIST CSF, ISO 27001, PCI DSS, and HIPAA, serving as the tactical execution layer that satisfies requirements across multiple regulatory standards simultaneously rather than competing with them.
Frequently Asked Questions
The 18 Controls address asset inventory, software tracking, secure configuration, access control, vulnerability management, audit logging, email defenses, malware protection, data recovery, network monitoring, security training, service provider management, application security, incident response, and penetration testing. Each Control contains Safeguards targeting documented attack vectors that security operations center monitoring teams use to detect and respond to threats.
IG1 contains 56 essential Safeguards for basic cyber hygiene. IG2 adds 74 Safeguards for moderate complexity. IG3 encompasses all 153 Safeguards for advanced programs. Organizations progress through groups based on resources and risk profile.
CIS Controls serve as tactical implementation beneath strategic frameworks. Each Safeguard maps to NIST CSF, ISO 27001, PCI DSS, and SOC 2. Organizations implement CIS Controls once and satisfy multiple compliance audits simultaneously.
