CIS Controls v8 compliance guide
The CIS Critical Security Controls provide 18 prioritized safeguards to protect organizations from cyber threats. Whether you're implementing IG1 essentials or IG3 advanced protections, we help you build effective cybersecurity defenses with clear actions and evidence.
What are CIS Controls?
The CIS Critical Security Controls (CIS Controls) are a prioritized set of actions developed by the Center for Internet Security to protect organizations from known cyber attack vectors. Version 8 includes 18 controls with 153 safeguards organized into three Implementation Groups.
Why this matters: CIS Controls are built from real-world attack patterns and defense strategies. They're vendor-agnostic, actionable and widely recognized by cyber insurance providers and auditors as evidence of security due diligence.
Prioritized
Focus on highest-impact defenses first
Actionable
Specific technical safeguards to implement
Who should implement CIS Controls?
Small to medium businesses
Organizations seeking essential cyber hygiene with IG1
Enterprise organizations
Companies with IT departments implementing IG2 or IG3
Critical infrastructure
Organizations protecting essential services and systems
Regulated industries
Financial services, healthcare meeting compliance requirements
Managed service providers
MSPs implementing CIS Controls for clients
Government agencies
Public sector organizations securing sensitive data
How VerifyWise supports CIS Controls compliance
Concrete capabilities that address implementation across all safeguards
Asset inventory and management
Maintain comprehensive inventories of hardware, software and data assets with automated discovery. The platform tracks all devices, applications and sensitive information across your environment, addressing CIS Controls 1 and 2 requirements.
Addresses: Controls 1, 2: Inventory and control of enterprise assets
Vulnerability and patch management
Identify, track and remediate security vulnerabilities across systems. The platform monitors patch status, prioritizes critical updates and maintains audit trails for vulnerability management aligned with Control 7.
Addresses: Control 7: Continuous vulnerability management
Access control and authentication
Manage user accounts, privileges and authentication policies. The platform enforces least privilege principles, tracks account lifecycle and monitors privileged access in line with Controls 5 and 6.
Addresses: Controls 5, 6: Account and access control management
Security monitoring and logging
Collect, analyze and retain security logs from critical systems. The platform centralizes log management, enables threat detection and maintains evidence for incident investigation per Controls 8 and 13.
Addresses: Controls 8, 13: Audit log management and network monitoring
Incident response and recovery
Manage security incidents with structured workflows and recovery procedures. The platform documents incident handling, tracks remediation and enables post-incident analysis aligned with Control 17.
Addresses: Control 17: Incident response management
Policy and compliance tracking
Maintain security policies, standards and compliance evidence. The platform provides templates for CIS-aligned policies, tracks control implementation and generates reports for audits per Control 1.
Addresses: Control 1: Security program and policy management
All security activities are tracked with timestamps, assigned owners and approval workflows. This audit trail demonstrates systematic control implementation for cyber insurance reviews and compliance audits.
Complete CIS Controls v8 safeguards coverage
VerifyWise provides dedicated tooling for all 153 safeguards across three Implementation Groups
CIS Controls
Safeguards with dedicated tooling
Implementation Groups
Essential cyber hygiene for all organizations
Organizations with IT staff and resources
Organizations with dedicated security teams
Built for CIS Controls from the ground up
Asset inventory tracking
Automated discovery and management for Controls 1-2
Vulnerability management
Continuous scanning and patch tracking for Control 7
Insurance readiness
Evidence packages for cyber insurance applications
Multi-framework mapping
Crosswalk to NIST CSF, ISO 27001 and SOC 2
18 CIS Critical Security Controls
Prioritized safeguards to defend against known cyber attack vectors
Control 1
Inventory and control of enterprise assets
Actively manage all enterprise assets connected to the infrastructure, ensuring only authorized devices can access the network.
- Establish and maintain asset inventory
- Address unauthorized assets
- Utilize asset management tools
- Ensure proper asset addressing
Control 2
Inventory and control of software assets
Actively manage all software on the network so that only authorized software is installed and can execute.
- Establish and maintain software inventory
- Address unauthorized software
- Utilize software inventory tools
- Use whitelisting and blacklisting
Control 3
Data protection
Develop processes and technical controls to identify, classify, securely handle, retain and dispose of data.
- Establish data management process
- Classify sensitive data
- Encrypt data at rest and in transit
- Enforce data retention policies
Control 4
Secure configuration of enterprise assets and software
Establish and maintain secure configurations for enterprise assets and software.
- Establish secure configuration process
- Maintain configuration standards
- Deploy system configuration management tools
- Implement automated configuration monitoring
Control 5
Account management
Use processes and tools to assign and manage authorization to credentials for user accounts, including administrator accounts.
- Establish access granting process
- Maintain inventory of accounts
- Disable dormant accounts
- Restrict administrator privileges
Control 6
Access control management
Use processes and tools to create, assign, manage and revoke access credentials and privileges for user, administrator and service accounts.
- Establish access review process
- Centralize access control
- Require multi-factor authentication
- Define and maintain role-based access control
Control 7
Continuous vulnerability management
Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise's infrastructure.
- Establish vulnerability management process
- Perform automated vulnerability scanning
- Remediate detected vulnerabilities
- Manage vulnerability remediation lifecycle
Control 8
Audit log management
Collect, alert, review and retain audit logs of events that could help detect, understand or recover from an attack.
- Establish audit log management process
- Collect audit logs
- Ensure adequate audit log storage
- Standardize time synchronization
Control 9
Email and web browser protections
Improve protections and detections of threats from email and web vectors, as these are opportunities for attackers to manipulate human behavior.
- Ensure use of only supported browsers and email clients
- Use DNS filtering services
- Maintain and enforce email security policies
- Block unnecessary file types
Control 10
Malware defenses
Prevent or control the installation, spread and execution of malicious applications, code or scripts on enterprise assets.
- Deploy anti-malware software
- Configure automatic anti-malware updates
- Enable anti-exploitation features
- Disable autorun and autoplay
Control 11
Data recovery
Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.
- Establish data recovery process
- Perform automated backups
- Protect recovery data
- Test data recovery regularly
Control 12
Network infrastructure management
Establish, implement and actively manage the security configuration of network infrastructure, including network security controls.
- Ensure network infrastructure is up-to-date
- Establish and maintain secure network architecture
- Securely manage network infrastructure
- Deploy network-based IDS
Control 13
Network monitoring and defense
Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats.
- Centralize security event alerting
- Deploy a host-based IDS
- Perform traffic filtering between network segments
- Manage access control for remote assets
Control 14
Security awareness and skills training
Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious.
- Establish security awareness program
- Train workforce on secure authentication
- Train workforce on data handling
- Train workforce members on identifying social engineering attacks
Control 15
Service provider management
Develop a process to evaluate service providers who hold sensitive data or are responsible for an enterprise's critical IT platforms.
- Establish service provider management process
- Maintain inventory of service providers
- Classify service providers
- Review and update service provider contracts
Control 16
Application software security
Manage the security life cycle of in-house developed, hosted or acquired software to prevent, detect and remediate security weaknesses.
- Establish application software security program
- Establish secure coding practices
- Perform root cause analysis
- Separate production and non-production systems
Control 17
Incident response management
Establish a program to develop and maintain an incident response capability to discover, contain and recover from attacks.
- Designate personnel to manage incidents
- Establish incident response process
- Conduct routine incident response exercises
- Establish and maintain contact information for reporting incidents
Control 18
Penetration testing
Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls.
- Establish penetration testing program
- Perform periodic external penetration tests
- Remediate penetration test findings
- Validate security controls
Implementation Groups explained
Choose the right safeguards for your organization's resources and risk profile
Implementation Group 1 (IG1)
56 safeguards
Essential cyber hygiene for all organizations
Target audience
Small to medium organizations with limited cybersecurity expertise and resources
Characteristics
- Limited IT and security resources
- Baseline security controls
- Essential protection measures
- Foundation for security maturity
Includes
Controls 1-11, 14, 17
Implementation Group 2 (IG2)
131 safeguards
Organizations with IT staff and resources
Target audience
Organizations managing multiple departments, systems or locations with dedicated IT resources
Characteristics
- Dedicated IT staff
- Moderate security complexity
- Enhanced monitoring capabilities
- Risk-based approach
Includes
All IG1 controls + Controls 12, 13, 15, 16
Implementation Group 3 (IG3)
153 safeguards
Organizations with dedicated security teams
Target audience
Organizations with significant cybersecurity expertise, protecting sensitive data or critical infrastructure
Characteristics
- Dedicated security team
- Advanced threat protection
- Comprehensive security program
- Regulatory compliance focus
Includes
All IG1 + IG2 controls + Control 18
CIS Controls v8 vs v7.1
Key improvements and changes in the latest version
| Aspect | v7.1 | v8 | Change |
|---|---|---|---|
Total controls | 20 Controls | 18 Controls (consolidated) | Streamlined |
Safeguards | 171 Sub-Controls | 153 Safeguards | Refined and prioritized |
Implementation Groups | 3 IGs (IG1, IG2, IG3) | 3 IGs maintained | Clarified guidance |
Asset types | Focus on traditional IT | Includes cloud, mobile, IoT | Modernized coverage |
Data protection | Control 13 | Control 3 (elevated priority) | Higher emphasis |
Supply chain | Limited guidance | Control 15 (enhanced) | Expanded scope |
Threat focus | General threats | Ransomware and modern attacks | Updated priorities |
Metrics | Basic measurement | Enhanced measurement guidance | Improved tracking |
Migration tip: Organizations on v7.1 should prioritize updated controls like Control 3 (Data Protection), Control 15 (Service Provider Management) and modernized asset inventory for cloud and mobile environments.
View full v8 migration guide36-week implementation roadmap
A practical path to CIS Controls adoption with clear milestones
Foundation
- Determine appropriate Implementation Group (IG1, IG2, or IG3)
- Establish asset inventory for hardware and software
- Define secure configurations and standards
- Implement basic access control policies
Core controls
- Deploy vulnerability scanning and patch management
- Implement audit logging and monitoring
- Establish data protection and encryption
- Configure email and web browser protections
Advanced protection
- Deploy network segmentation and monitoring
- Implement incident response procedures
- Establish security awareness training program
- Configure malware defenses and backup systems
Maturity & optimization
- Conduct penetration testing (IG3)
- Review and optimize service provider management
- Enhance application security practices
- Establish continuous improvement cycle
CIS Benchmarks integration
Complement CIS Controls with specific configuration guidance for your technology stack
While CIS Controls define what to protect (18 security controls), CIS Benchmarks provide detailed configuration guides for how to secure specific systems. Together, they deliver comprehensive cybersecurity coverage from strategy to implementation.
CIS Controls
High-level security best practices and safeguards
CIS Benchmarks
Detailed configuration settings for specific technologies
Operating Systems
Secure configuration benchmarks for Windows, Linux, macOS and Unix systems
Examples
- • Windows Server
- • Ubuntu Linux
- • macOS
- • Red Hat Enterprise Linux
Cloud Platforms
Security configuration guidelines for major cloud service providers
Examples
- • AWS Foundations
- • Microsoft Azure
- • Google Cloud Platform
- • Oracle Cloud
Network Devices
Hardening standards for network infrastructure components
Examples
- • Cisco IOS
- • Palo Alto Networks
- • Fortinet FortiGate
- • Juniper Networks
Databases
Security benchmarks for database management systems
Examples
- • Microsoft SQL Server
- • Oracle Database
- • MySQL
- • PostgreSQL
Applications
Configuration standards for enterprise applications
Examples
- • Microsoft 365
- • Google Workspace
- • Docker
- • Kubernetes
Mobile Devices
Security baselines for mobile operating systems
Examples
- • Apple iOS
- • Google Android
- • Mobile Device Management
Complete security policy repository
Access ready-to-use security policy templates aligned with CIS Controls, NIST CSF and ISO 27001 requirements
Asset management
- • Asset Inventory Policy
- • Hardware Asset Management
- • Software Asset Management
- • Data Classification Policy
- • Secure Configuration Standards
- • Change Management Policy
- + 4 more policies
Access & protection
- • Account Management Policy
- • Access Control Policy
- • Multi-Factor Authentication
- • Data Protection Policy
- • Encryption Standards
- • Vulnerability Management
- + 5 more policies
Monitoring & response
- • Audit Log Management
- • Security Monitoring Policy
- • Incident Response Plan
- • Malware Defense Policy
- • Data Backup & Recovery
- • Security Awareness Training
- + 3 more policies
Frequently asked questions
Common questions about CIS Controls implementation
Ready to implement CIS Controls?
Start your cybersecurity journey with our guided assessment and implementation tools.