CIS Critical Security Controls: Where to Start (IG1 Explained)
What the 18 CIS Controls are, how the 3 implementation groups work and which IG1 safeguards a small team should tackle first.
The CIS Critical Security Controls are 18 prioritized groups of security practices, broken into 153 specific safeguards. Most small teams should start with Implementation Group 1 (IG1), 56 essential safeguards covering asset and software inventories, secure configuration, account and access control, patching, malware defense, backups, awareness training and incident response basics.
Photo: Unsplash
On this page
Most security frameworks hand you a long list and leave you to figure out where to begin. If you run IT for a 30-person company, or you’re the one person who “handles security” alongside everything else, that’s not much help.
The CIS Critical Security Controls take a different approach. They’re prioritized, and they’re split into implementation groups so a small team knows exactly which safeguards matter first. That’s why insurers, auditors and larger customers increasingly reference them.
This guide explains what the CIS Controls are, how the implementation groups work and the first safeguards a small team should put in place.
What the CIS Controls are
The CIS Critical Security Controls (often just “CIS Controls”) are a set of security best practices published by the Center for Internet Security, a nonprofit. They started as a community effort to identify the defensive actions that stop the most common attacks, and they’ve been updated over time as threats changed.
The current release is version 8.1, an update to version 8. It realigned the Controls’ mappings to the NIST Cybersecurity Framework 2.0, added a “Govern” security function, revised asset classes and clarified several safeguard descriptions.
The Controls are organized into 2 layers:
- 18 Controls, which are broad areas such as “Account Management” or “Data Recovery.”
- 153 Safeguards, which are the specific actions inside each Control, such as “Require MFA for externally-exposed applications.”
The 18 CIS Controls
| # | Control | What it covers in plain terms |
|---|---|---|
| 1 | Inventory and Control of Enterprise Assets | Know every device on your network |
| 2 | Inventory and Control of Software Assets | Know what software runs, and remove what shouldn’t |
| 3 | Data Protection | Know where sensitive data lives and protect it |
| 4 | Secure Configuration of Enterprise Assets and Software | Harden default settings |
| 5 | Account Management | Track and manage user and admin accounts |
| 6 | Access Control Management | Grant, revoke and protect access, including MFA |
| 7 | Continuous Vulnerability Management | Patch and scan regularly |
| 8 | Audit Log Management | Collect and keep logs |
| 9 | Email and Web Browser Protections | Reduce risk from email and browsing |
| 10 | Malware Defenses | Anti-malware and related protections |
| 11 | Data Recovery | Backups you can actually restore |
| 12 | Network Infrastructure Management | Keep network gear secure and current |
| 13 | Network Monitoring and Defense | Detect and respond to network threats |
| 14 | Security Awareness and Skills Training | Train people to spot threats |
| 15 | Service Provider Management | Manage risk from vendors |
| 16 | Application Software Security | Build and buy secure software |
| 17 | Incident Response Management | Plan for and handle incidents |
| 18 | Penetration Testing | Test defenses like an attacker would |
How implementation groups work
The implementation groups (IGs) are what make the CIS Controls practical for small teams. Each IG builds on the one before it.
| Group | Safeguards | Typical organization |
|---|---|---|
| IG1 | 56 | Small to medium-sized organizations with limited IT and security expertise, mostly protecting employee and financial data |
| IG2 | IG1 + 74 more (130 total) | Organizations with dedicated IT staff, multiple departments, sensitive client data and possible regulatory obligations |
| IG3 | All 153 | Organizations with security specialists, highly sensitive data and exposure to targeted, sophisticated attacks |
CIS describes IG1 as “essential cyber hygiene,” the foundational safeguards every enterprise should apply regardless of size to defend against the most common, non-targeted attacks. In other words, even large organizations should treat IG1 as the floor.
Key takeaway: Don’t try to implement all 153 safeguards. Start with the 56 in IG1, get them working and documented, and move to IG2 only when your risk, data or customers require it.
The first IG1 safeguards small teams should adopt
IG1 has 56 safeguards, which is still a lot for a small team. Here’s a practical order, grouped by impact. All of the safeguards named below are part of IG1.
1. Know what you have (Controls 1 and 2)
You can’t protect devices and software you don’t know about. Build a simple inventory of laptops, phones, servers, cloud accounts and the software running on them (Safeguards 1.1 and 2.1). A spreadsheet is fine to start; device management tools make it easier to keep current.
2. Lock down accounts and access (Controls 5 and 6)
Stolen credentials are behind a huge share of breaches, so this is where small teams get the most protection for the least money.
- Turn on multi-factor authentication for externally exposed applications, remote network access and administrative access (Safeguards 6.3, 6.4 and 6.5). Our guide to multi-factor authentication explains the options.
- Use separate admin accounts for administrative work, rather than everyday accounts with admin rights (Safeguard 5.4). This is the core of the principle of least privilege.
- Keep an account inventory and disable dormant accounts (Safeguards 5.1 and 5.3).
- Have a process to grant and revoke access, especially when people leave (Safeguards 6.1 and 6.2). See our employee offboarding IT security checklist.
3. Patch automatically (Control 7)
Turn on automated patching for operating systems and applications (Safeguards 7.3 and 7.4), and set up a simple vulnerability management process (Safeguard 7.1).
4. Back up and test restores (Control 11)
Perform automated backups, protect them and keep an isolated copy that ransomware can’t reach (Safeguards 11.2, 11.3 and 11.4). Then test a restore. Our guide on how to back up business data walks through the 3-2-1 approach.
5. Secure configurations and encrypt devices (Controls 3 and 4)
Change default settings and passwords, and encrypt data on laptops and phones (Safeguard 3.6). CIS publishes free CIS Benchmarks with hardening guidance for common operating systems and cloud platforms.
6. Train people and plan for incidents (Controls 14 and 17)
Run a security awareness program (Safeguard 14.1) and designate who handles incidents (Safeguard 17.1). Our guides on security awareness training and how to create an incident response plan cover both.
How the CIS Controls compare with other frameworks
The CIS Controls aren’t the only option, and they work well alongside others.
| Framework | What it is | Best used for |
|---|---|---|
| CIS Controls | Prioritized, prescriptive list of safeguards | Deciding what to do first and measuring progress |
| NIST Cybersecurity Framework | High-level outcomes organized by function | Structuring a program and talking to leadership |
| ISO/IEC 27001 | Certifiable management system standard | Formal certification for customers |
| SOC 2 | Attestation report on controls | Proving security to SaaS customers |
Because CIS maps its safeguards to NIST CSF 2.0, many teams use the CIS Controls as the “how” behind NIST’s “what.” The Controls also show up in cyber insurance applications, which often ask about MFA, backups and patching; see our guide to cyber insurance requirements.
Where to start: a 30-day plan
- Week 1: Download CIS Controls v8.1 from the CIS website and list the 56 IG1 safeguards in a tracker with an owner and status for each.
- Week 1: Build your hardware and software inventory.
- Week 2: Turn on MFA for email, remote access, cloud apps and admin accounts. Split admin accounts from daily accounts.
- Week 2: Turn on automatic updates everywhere you can.
- Week 3: Confirm automated backups, set up an isolated copy and test a restore.
- Week 3: Encrypt laptops and phones and change any default passwords.
- Week 4: Launch basic awareness training, name an incident lead and write a 1-page incident contact list.
- Ongoing: Review progress monthly and tackle remaining IG1 safeguards before moving on.
If you don’t have the time or skills in-house, a managed IT or security provider can implement IG1 for you. Our guide on how to choose a managed IT service provider explains what to ask.
Conclusion
The CIS Controls are one of the most practical frameworks available to small teams because they tell you what to do first. Start with IG1, focus on inventories, MFA, admin accounts, patching and backups, and track progress in a simple spreadsheet. Once IG1 is in place, you’ll have a solid security baseline and a clear path to IG2 as your company grows.
Sources
- Center for Internet Security: CIS Critical Security Controls v8.1 — current version and what changed
- CIS: The 18 CIS Critical Security Controls — list of Controls
- CIS: Implementation Groups — IG structure and 153 safeguards total
- CIS: Implementation Group 1 — 56 safeguards and typical IG1 organization
- CIS: Implementation Group 2 — 74 additional safeguards and typical IG2 organization
- CIS Controls Assessment Specification — safeguard titles and implementation group assignments
Frequently asked questions
What are the CIS Controls?
The CIS Critical Security Controls are a prioritized set of cybersecurity best practices from the Center for Internet Security. Version 8.1 has 18 Controls containing 153 specific Safeguards, covering areas such as asset inventory, access control, patching, backups and incident response. They're designed to stop the most common attacks and to be practical for organizations of any size.
What is CIS Implementation Group 1?
IG1 is the starting set of 56 safeguards that CIS calls "essential cyber hygiene." It's aimed at small to medium-sized organizations with limited IT and security expertise, but CIS says every enterprise should apply it. IG1 covers inventories, secure configuration, MFA, admin accounts, patching, malware defense, backups, training and incident response basics.
How many CIS Controls are there?
There are 18 CIS Controls in version 8.1, containing 153 safeguards in total. Implementation Group 1 includes 56 safeguards, IG2 adds 74 more for 130, and IG3 includes all 153. Most small organizations only need IG1 to start, then add IG2 safeguards as their data sensitivity and regulatory obligations grow.
Are the CIS Controls free?
Yes, the CIS Controls documents are free to download from the Center for Internet Security website after registering. CIS also publishes free CIS Benchmarks for hardening specific systems. Some related tools and memberships have costs, and you may pay for software or a provider to implement the safeguards, but the framework itself is free.
What is the difference between CIS Controls and NIST CSF?
The NIST Cybersecurity Framework describes high-level security outcomes organized by functions such as Govern, Identify, Protect, Detect, Respond and Recover. The CIS Controls are more prescriptive, listing specific prioritized safeguards. CIS v8.1 maps its safeguards to NIST CSF 2.0, so many teams use NIST CSF for structure and the CIS Controls for implementation.
Can you get certified in the CIS Controls?
No, there's no formal certification for an organization's compliance with the CIS Controls in the way there is for ISO 27001. Organizations self-assess or hire an assessor to measure their implementation. If customers need formal proof, consider SOC 2 or ISO 27001, using the CIS Controls as the practical foundation underneath.
How long does it take to implement CIS IG1?
It depends on your size and starting point. A small company with modern cloud tools can cover the highest-impact IG1 safeguards, like MFA, patching and backups, within a few weeks. Completing and documenting all 56 typically takes longer. Track each safeguard with an owner and status, and review progress monthly.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com