CIS Controls

Nothing changed in the last 90 days. Sign in to read further back.

1. 2024-06-25 CIS announces CIS Controls v8.1 with the new governance security function
2. 2021-05-18 CIS Controls v8 released, consolidating 20 Controls into 18
3. 2019-04-04 CIS Controls v7.1 introduces Implementation Groups

1. 2024-06-24
   CIS Controls v8.1 RevisionCurrent

   Iterative update to v8 that adds the "Govern" security function from NIST CSF 2.0 and revises asset classes and Safeguard descriptions. source

   More

   • NIST CSF security function mappings were realigned to match NIST CSF 2.0.
   • New and expanded glossary definitions for reserved words such as plan, process and sensitive data.
   • Revised asset classes, with new mappings to Safeguards.
   • Minor typos fixed and a few Safeguard descriptions clarified.
   • CIS states that v8.1 is backwards compatible and gives prior users a migration path.
2. 2021-05-18
   CIS Controls v8 Major version

   Reorganized the Controls by activity rather than by who manages the devices, reducing them from 20 to 18 Controls with 153 Safeguards (formerly Sub-Controls). source

   More

   • Added coverage of cloud and mobile technologies.
   • Sub-Controls were renamed Safeguards.
3. 2019-04-04
   CIS Controls v7.1 Revision

   Introduced Implementation Groups (IG1 to IG3) that group the Sub-Controls to help organizations prioritize them, with editorial changes clarifying certain Controls and Sub-Controls. source

A free, prioritized set of Safeguards for any enterprise. Every enterprise is meant to start with Implementation Group 1, essential cyber hygiene.

What it is

A prioritized set of CIS Safeguards to defend against the most prevalent cyber attacks against systems and networks, mapped to and referenced by multiple legal, regulatory and policy frameworks. source

Structure

18 top-level Controls containing 153 Safeguards; v8 and v8.1 both have 153 Safeguards. source source

Implementation Groups

Safeguards are split into three Implementation Groups by risk profile and resources. Every enterprise should start with IG1, defined as essential cyber hygiene; IG2 builds on IG1, and IG3 comprises all Controls and Safeguards. source

Free use

Free to use by anyone to improve their own cybersecurity. Vendors and consultants using the Controls in tools or services need a CIS SecureSuite membership or authorized Supporter status. source

Relation to regulations

The CIS Controls are not a replacement for any existing regulatory, compliance or authorization scheme; they map to frameworks such as the NIST CSF, NIST SP 800-53, ISO 27000, PCI DSS, HIPAA, NERC CIP and FISMA. source

Organizations measure their own implementation, for example with the CIS CSAT tool; CIS also accredits members who implement, audit or assess the Controls for customers.

Self-assessment tool

The CIS Controls Self Assessment Tool (CSAT) is offered for assessing implementation of the CIS Controls. source

Assessment Specification

The CIS Controls Assessment Specification, released in 2020, sets out what should be measured to verify that CIS Safeguards are properly implemented. source

Accreditation of assessors

CIS Controls Accreditation lets eligible CIS SecureSuite members show they meet CREST standards when providing CIS Controls implementation, auditing or assessment to customers, as a "stamp of approval" at the organization level. source

Some US state laws include the CIS Controls in cybersecurity safe harbor statutes, and several states mention them as a way for public bodies to show reasonable security.

State safe harbor laws

CIS states that the Controls have been included in state cybersecurity safe harbor statutes in Ohio, Utah, Connecticut and Iowa. source

Public sector

Multiple US states require executive branch agencies to implement cybersecurity best practices, and several mention the CIS Controls as a way of demonstrating a "reasonable" level of security. source

1. Standard CIS Critical Security Controls v8.1 (download page)
2. Standard CIS Critical Security Controls v8.1 white paper page
3. Guidance CIS Controls Implementation Groups
4. FAQ CIS Critical Security Controls FAQ
5. Standard CIS Critical Security Controls v8 (previous version)

1. CIS Benchmarks

   CIS Benchmarks are configuration hardening guides for specific products; the CIS Controls are a general, product-neutral set of security practices.

2. NIST CSF

   The NIST CSF lists outcomes; the CIS Controls are a prescriptive, prioritized list of Safeguards that v8.1 maps to the CSF 2.0 functions.

3. ISO 27001

   ISO/IEC 27001 is a certifiable management system standard; the CIS Controls are free best practices with no certification of the implementing organization.

4. NIST SP 800-53

   NIST SP 800-53 is a full control catalogue for US federal systems; the CIS Controls are a shorter, prioritized list that maps to it.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to CIS Controls (RSS)