CIS Critical Security Controls

By the end of this lesson you will be able to pick a starting group of CIS Controls for a small company. You will also run a simple self-assessment and turn its gaps into a quarter-by-quarter plan with Python.

NIST CSF tells you what outcomes to aim for. ISO 27001 tells you how to run a management system. But a small company with one IT person asks a simpler question: "What should we do first, second and third?" The CIS Critical Security Controls answer that question. They are a ranked list of concrete actions, a bit like a doctor's checklist for a basic health check-up. You can read about the other frameworks in Security Frameworks: NIST CSF 2.0 & ISO 27001.

What the CIS Controls are

The Center for Internet Security (CIS) is a non-profit organisation. It publishes the controls with help from security workers around the world. The controls are based on what attackers really do, and they are free to download. The current version is v8.1 (2024). It updates v8 (2021). It has:

• 18 controls. Each is a broad area, such as account management or data recovery.
• 153 safeguards inside them. A safeguard is one specific action you can check, such as "use MFA for remote network access".
• Three Implementation Groups. They say which safeguards to do first.

Version 8.1 added a Govern security function to match NIST CSF 2.0. It also updated its mappings to CSF 2.0, made some safeguard wording clearer and added more words to the glossary.

The 18 controls

The order is on purpose. Controls 1 and 2 come first because you cannot protect what you do not know about. Think of a school hostel warden: before locking up at night, the warden first needs the list of rooms and students.

Implementation Groups

No organisation can do all 153 safeguards at once. So CIS sorts them into three groups:

Each group includes the ones below it, like school classes: Class 3 builds on everything from Class 2. CIS calls IG1 the minimum every organisation should meet. IG1 is aimed at common attacks that are not aimed at anyone in particular, such as phishing and ransomware. Here is a rough way to pick a starting group:

def implementation_group(has_security_staff, sensitive_or_regulated_data, targeted_attacks_likely):
    if has_security_staff and sensitive_or_regulated_data and targeted_attacks_likely:
        return "IG3"
    if sensitive_or_regulated_data or has_security_staff:
        return "IG2"
    return "IG1"

organisations = [
    ("Tuition centre in Rohtak, 12 staff", False, False, False),
    ("Diagnostic lab chain in Pune, 2 IT staff", False, True, False),
    ("Fintech app with a security team", True, True, True),
]
for name, staff, data, targeted in organisations:
    print(f"{implementation_group(staff, data, targeted)}  {name}")

IG1  Tuition centre in Rohtak, 12 staff
IG2  Diagnostic lab chain in Pune, 2 IT staff
IG3  Fintech app with a security team

Real decisions also depend on regulators, what customers ask for in contracts and the company's own risk assessment. Still, the idea is simple: start with IG1, then grow.

Running a self-assessment

A self-assessment means going through the safeguards of your chosen group one by one. For each one, you write down its status: yes, partial or no. CIS offers free tools for this, and a spreadsheet works too. Here is a small sample of safeguards for the tuition centre, written in short words:

assessment = [
    (1, "Detailed inventory of all devices", "partial"),
    (2, "Inventory of installed software", "no"),
    (4, "Secure configuration process", "no"),
    (5, "Inventory of all accounts", "yes"),
    (6, "MFA for externally exposed apps and remote access", "partial"),
    (7, "Documented vulnerability management process", "no"),
    (8, "Audit logs collected", "yes"),
    (10, "Anti-malware on all endpoints", "yes"),
    (11, "Automated backups and restore tests", "partial"),
    (14, "Security awareness programme", "no"),
]
POINTS = {"yes": 1.0, "partial": 0.5, "no": 0.0}

score = sum(POINTS[status] for _, _, status in assessment)
print(f"Score: {score} of {len(assessment)} ({100 * score / len(assessment):.0f}%)")
for control, safeguard, status in assessment:
    if status != "yes":
        print(f"  Control {control:>2} [{status:<7}] {safeguard}")

Score: 4.5 of 10 (45%)
  Control  1 [partial] Detailed inventory of all devices
  Control  2 [no     ] Inventory of installed software
  Control  4 [no     ] Secure configuration process
  Control  6 [partial] MFA for externally exposed apps and remote access
  Control  7 [no     ] Documented vulnerability management process
  Control 11 [partial] Automated backups and restore tests
  Control 14 [no     ] Security awareness programme

Be honest when you score. Every "partial" needs a note that says exactly what is missing, for example "MFA on email, not yet on the VPN". A score that looks better than reality is like hiding a bad mark from your parents. It only hides the gaps from the people who could pay to fix them.

From gaps to a roadmap

Now turn the gaps into a plan, one quarter at a time. Follow these simple rules:

1. Fix the lowest-numbered controls first, because later controls depend on earlier ones.
2. Move up anything that blocks the most common attacks. MFA and backups are classic quick wins against phishing and ransomware.
3. Stop adding tasks to a quarter when the team's capacity is full.

gaps = [(1, "Device inventory", 2), (2, "Software inventory", 2), (4, "Secure configuration", 3),
        (6, "MFA everywhere remote", 1), (7, "Vulnerability process", 2), (11, "Backups with restore tests", 1),
        (14, "Awareness programme", 2)]
QUICK_WINS = {6, 11}
CAPACITY_PER_QUARTER = 4   # effort points the team can handle per quarter

ordered = sorted(gaps, key=lambda g: (g[0] not in QUICK_WINS, g[0]))
quarter, used, plan = 1, 0, {}
for control, task, effort in ordered:
    if used + effort > CAPACITY_PER_QUARTER:
        quarter, used = quarter + 1, 0
    plan.setdefault(f"Q{quarter}", []).append(f"C{control} {task}")
    used += effort
for q, tasks in plan.items():
    print(f"{q}: {'; '.join(tasks)}")

Q1: C6 MFA everywhere remote; C11 Backups with restore tests; C1 Device inventory
Q2: C2 Software inventory
Q3: C4 Secure configuration
Q4: C7 Vulnerability process; C14 Awareness programme

The effort points and the capacity are estimates that the team agrees on. A one-page roadmap like this is easy to show a small business owner. It is also easy to update every quarter.

How CIS fits with other frameworks

CIS publishes mappings from its safeguards to NIST CSF 2.0, ISO/IEC 27001 and other standards. A mapping is a table that shows which safeguard meets which requirement. So the CIS work also counts towards those standards. Many organisations use IG1 as their practical first year. Later they grow into ISO 27001 certification.

CIS also publishes the CIS Benchmarks. These are detailed setting guides for specific products, and you use them to meet Control 4 (see Endpoint Hardening). Do not mix the two up. The Controls say what to do. The Benchmarks say how to set up one particular system, like a recipe for one dish.

Common mistakes

• Skipping Controls 1 and 2 and jumping straight to expensive tools.
• Trying to do IG3 in a small company, and finishing nothing.
• Scoring yourself too generously.
• Confusing CIS Controls with CIS Benchmarks.
• Treating the assessment as a one-off instead of repeating it every year.

Key points

• CIS Controls v8.1 has 18 controls and 153 safeguards, ranked by how real attackers behave.
• IG1 (56 safeguards) is essential cyber hygiene for every organisation; IG2 adds 74 and IG3 adds 23 more.
• Start with device and software inventories; you cannot protect what you do not know.
• Self-assess honestly, write down what "partial" means, and turn gaps into a quarterly roadmap.
• v8.1 added a Govern function and mappings to NIST CSF 2.0.
• CIS Benchmarks give product-specific settings that put Control 4 into practice.

gaps = [(1, "Device inventory", 2), (2, "Software inventory", 2), (4, "Secure configuration", 3),
        (6, "MFA everywhere remote", 1), (7, "Vulnerability process", 2), (11, "Backups with restore tests", 1),
        (14, "Awareness programme", 2)]
QUICK_WINS = {6, 11}
CAPACITY_PER_QUARTER = 5

ordered = sorted(gaps, key=lambda g: (g[0] not in QUICK_WINS, g[0]))
quarter, plan = 1, {"Q1": ([], 0)}
for control, task, effort in ordered:
    tasks, used = plan[f"Q{quarter}"]
    if used + effort > CAPACITY_PER_QUARTER:
        quarter += 1
        tasks, used = [], 0
    plan[f"Q{quarter}"] = (tasks + [f"C{control}"], used + effort)
for q, (tasks, used) in plan.items():
    print(f"{q} (effort {used}): {', '.join(tasks)}")