The CIS Controls are a free, prioritized list of security measures published by the Center for Internet Security, a US nonprofit. Version 8 has 18 controls, each broken into specific steps called safeguards. The safeguards are sorted into three Implementation Groups, so an organization can start with what fits its size.
IG1, IG2 and IG3
- IG1 is what CIS calls essential cyber hygiene: the minimum every organization should have. It is written for small businesses with limited IT help. In versions 8 and 8.1 it has 56 safeguards.
- IG2 adds safeguards for organizations with IT staff and more sensitive data to protect.
- IG3 adds safeguards for large or high-risk organizations with dedicated security specialists.
Each group includes everything in the one before it. If you run a small business, IG1 is your list.
IG1 draws on 15 of the 18 controls. The other three, network monitoring, application software security and penetration testing, start at IG2. Below is each IG1 control in plain English, with a quick way to check where you stand. For the exact wording of each safeguard, see the official CIS Controls.
The IG1 controls
Control 1. Inventory and Control of Enterprise Assets
2 of its 5 safeguards are in IG1.
What it means: Know every computer, phone, tablet and server that touches company data, including personal devices used for work.
How to check: Keep one list with each device, who uses it and where it is. Anything not on the list should not be on your network.
Control 2. Inventory and Control of Software Assets
3 of its 7 safeguards are in IG1.
What it means: Know what software and online services the business uses, and allow only what is supported and needed.
How to check: List the apps and subscriptions in use. Remove anything nobody needs or that no longer gets updates.
Control 3. Data Protection
6 of its 14 safeguards are in IG1.
What it means: Know where sensitive data lives, who can reach it, how long you keep it, and encrypt it on laptops and phones.
How to check: Write down where customer and employee data is stored. Check that laptop disk encryption is turned on.
Control 4. Secure Configuration of Enterprise Assets and Software
7 of its 12 safeguards are in IG1.
What it means: Set devices and software up safely instead of leaving factory defaults: screen locks, firewalls, no default passwords.
How to check: Check that every device locks itself when idle, that firewalls are on, and that the router’s admin password was changed.
Control 5. Account Management
4 of its 6 safeguards are in IG1.
What it means: Keep a list of every account, give each person their own, and remove accounts as soon as someone leaves.
How to check: Compare your user lists in email and key apps against current staff. Shared logins and old accounts are findings.
Control 6. Access Control Management
5 of its 8 safeguards are in IG1.
What it means: Give people only the access their job needs, and require two-factor sign-in for email, remote access and admin accounts.
How to check: Count your administrators. Check that two-factor sign-in is on for every account that can reach company email or files.
Control 7. Continuous Vulnerability Management
4 of its 7 safeguards are in IG1.
What it means: Keep operating systems, apps and websites updated, with a regular routine rather than when someone remembers.
How to check: Check that automatic updates are on for computers and phones, and that your website and its plugins are being updated.
Control 8. Audit Log Management
3 of its 12 safeguards are in IG1.
What it means: Keep the logs that show who signed in and what changed, so you can work out what happened after a problem.
How to check: Check that sign-in logging is on in your email and main apps, and how long the logs are kept.
Control 9. Email and Web Browser Protections
2 of its 7 safeguards are in IG1.
What it means: Use supported browsers and email clients, filter dangerous email, and protect your domain from being impersonated.
How to check: Check that browsers update themselves and that your domain has SPF, DKIM and DMARC records.
Control 10. Malware Defenses
3 of its 7 safeguards are in IG1.
What it means: Run anti-malware protection on every device and keep it updated automatically.
How to check: Confirm protection is installed and current on every work computer, including personal ones used for work.
Control 11. Data Recovery
4 of its 5 safeguards are in IG1.
What it means: Back up important data automatically, keep a copy separate from your normal accounts, and test that you can restore it.
How to check: Restore one real file from backup and write down the date. Check who could delete the backups.
Control 12. Network Infrastructure Management
1 of its 8 safeguards are in IG1.
What it means: Keep routers, firewalls and Wi-Fi equipment updated and set up securely.
How to check: Check the router’s firmware is current and still supported, and that guest Wi-Fi is separate from the work network.
Control 14. Security Awareness and Skills Training
8 of its 9 safeguards are in IG1.
What it means: Teach staff to spot phishing and fake payment requests, handle data carefully, and report mistakes quickly.
How to check: Keep a record of who was trained and when. Repeat it at least once a year and for every new hire.
Control 15. Service Provider Management
1 of its 7 safeguards are in IG1.
What it means: Know which outside companies handle your data or can reach your systems, and what they are responsible for.
How to check: List your vendors with access: IT provider, web developer, software companies. Remove the ones you no longer use.
Control 17. Incident Response Management
3 of its 9 safeguards are in IG1.
What it means: Decide in advance who does what when something goes wrong, and who needs to be contacted.
How to check: Write a one-page plan with names and phone numbers, and keep a printed copy.
Where to start
If you only do three things this month, make them two-factor sign-in on every email account (Control 6), backups you have actually restored from (Control 11), and a current list of devices and accounts with former staff removed (Controls 1 and 5). They are quick, and they show up again in cyber insurance applications.
Want it checked?
- Our security and IT assessment is organized against CIS Controls v8 IG1. You get a written report showing where you stand on each control and what to fix first. Fixed quote.
- Take the free AI risk check for the AI side of the same habits.