Center for Internet Security Critical Security Controls

A set of 18 prioritized security controls designed to stop the most pervasive and dangerous cyber attacks. These controls are developed through a unique consensus-driven process involving security experts from various sectors. They provide specific and actionable ways to thwart common attacks and are regularly updated to address emerging threats.

JurisdictionTechnical Standards
CategoryTechnical Standards
StatusActive
Latest development

Analysis

Key Requirements

The Center for Internet Security (CIS) Critical Security Controls consist of 18 prioritized security controls designed to mitigate the most common cyber attacks. The key requirements include:

  • Inventory and Control of Enterprise Assets: Actively manage all enterprise assets (end-user devices, network devices, servers, etc.) connected to the infrastructure physically, virtually, remotely, and those within cloud environments. CIS Controls v8
  • Inventory and Control of Software Assets: Actively manage all software on the network so that only authorized software is installed and can execute, and unauthorized and unmanaged software is found and prevented from installation or execution. CIS Controls v8
  • Data Protection: Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data. CIS Controls v8
  • Secure Configuration of Enterprise Assets and Software: Establish and maintain the secure configuration of enterprise assets (end-user devices, network devices, servers, and software) and software. CIS Controls v8
  • Account Management: Use processes and tools to assign and manage authorization to credentials for user accounts, including administrator accounts, as well as service accounts, to enterprise assets and software. CIS Controls v8

These controls are organized into three Implementation Groups (IGs) to help organizations prioritize their efforts based on their resources and cybersecurity expertise. CIS Implementation Groups

Compliance Challenges

Organizations often face several challenges when implementing the CIS Controls:

  • Resource Constraints: Many organizations, especially small and medium-sized businesses, struggle with limited budgets and personnel to implement all controls effectively. SANS 2021 CIS Controls Survey
  • Technical Complexity: Some controls require advanced technical knowledge and tools, which can be challenging for organizations with limited IT expertise. Cybersecurity Insiders Report
  • Integration with Existing Systems: Organizations often struggle to integrate new security controls with their existing IT infrastructure and business processes. EY Global Information Security Survey

Implementation Best Practices

To effectively implement the CIS Controls, organizations should:

  1. Conduct a Gap Analysis: Assess your current security posture against the CIS Controls to identify areas for improvement. CIS CSAT Pro
  1. Prioritize Controls: Focus on implementing the most critical controls first, based on your organization's risk profile and resources. CIS Controls v8 Implementation Groups
  1. Leverage Automation: Use automated tools and processes to implement and maintain controls more efficiently. CIS SecureSuite
  1. Provide Training: Ensure that all staff members understand their roles in maintaining security and compliance. SANS Security Awareness Training
  1. Regularly Test and Update: Conduct regular assessments and penetration testing to ensure the effectiveness of implemented controls. NIST SP 800-115

Recent Updates

The most recent major update to the CIS Controls was version 8, released in May 2021. Key changes include:

  • Consolidation of the controls from 20 to 18
  • Reorganization to align with modern attack tactics and technologies
  • Enhanced focus on cloud and mobile technologies

CIS Controls v8 Release Announcement

Organizations should aim to transition to v8 as soon as possible, although no strict deadline has been set.

Related Regulations

The CIS Controls align with and complement several other cybersecurity frameworks and regulations:

  • GDPR: The CIS Controls can help organizations meet many GDPR requirements, particularly in data protection and security. CIS Controls and GDPR

Industry Impact

The CIS Controls have had significant impacts across various industries:

  • Healthcare: Helps organizations protect sensitive patient data and comply with HIPAA requirements. HIPAA and CIS Controls
  • Small and Medium-sized Businesses: Offers a prioritized approach to cybersecurity that can be scaled based on available resources. CIS Controls for SMBs

Sources

Recent developments

  • — Informal announcement and discussion of **CIS Controls v8.1**, highlighting added governance security function, revised asset classes, updated glossary definitions, minor Safeguard description fixes, and realigned mappings to NIST CSF 2.0, with practitioners noting stronger alignment to compliance and governance expectations.[4] (source)
  • — Updated Splunk guidance on **CIS Controls v8.1** explains the 18 prioritized safeguards, expanded focus on hybrid and cloud environments, and alignment with NIST, GDPR, and ISO 27001, emphasizing task-based implementation that many security teams are adopting to operationalize the Controls in modern architectures.[3] (source)
  • — MetricStream’s refreshed “Complete Guide” to **CIS Critical Security Controls** positions the Controls as a central benchmark for cyber risk and GRC programs, describing them as regularly revised best practices and noting growing use by enterprises to structure assessments, training, and continuous monitoring for compliance and resilience.[2] (source)
  • — Armis analysis of **CIS Control 12 in v8** details changes in network infrastructure management, including new enterprise-managed VPN requirements and safeguard restructuring, and discusses how organizations are responding by increasing device discovery, segmentation, and encrypted communications to reduce breach risk.[1] (source)
  • — Splunk blog update highlights how **CIS Controls v8.1** mappings to frameworks like NIST CSF 2.0 and ISO 27001 are being used by security teams to rationalize overlapping requirements, improving audit readiness and reducing framework fatigue in multi-regulated environments.[3][4] (source)
  • — MetricStream notes broader **industry adoption of CIS Controls as a de facto technical standard**, with organizations integrating the Controls into cyber hygiene programs (asset management, patching, log monitoring) to meet insurer and regulator expectations and to demonstrate due care in incident investigations.[2] (source)
  • — Cybersecurity practitioners on Reddit react to **CIS Controls v8.1**, discussing the practical impact of new governance recommendations and asset-class refinements, with many viewing the update as a modest but useful improvement for policy definition and evidence gathering for audits.[4] (source)
  • — Splunk’s guidance describes how security operations centers are mapping SIEM use cases and detections directly to **CIS Controls**, reflecting a trend of using the Controls as an operational playbook for monitoring, incident response, and vulnerability management rather than only a high-level compliance checklist.[3] (source)
  • — MetricStream emphasizes that **recent revisions of the CIS Controls** are driving organizations to formalize assessments and training around the Controls, influencing risk scoring models and control catalogs in GRC platforms to better capture cyber posture against a widely recognized technical standard.[2] (source)
  • — Armis reports increased customer focus on **CIS Control 12 (network infrastructure)** and related safeguards, noting that organizations are tightening VPN, segmentation, and configuration management to align with CIS guidance, especially in response to recent breaches tied to misconfigurations and unmanaged devices.[1] (source)

Read the full guide to Center for Internet Security Critical Security Controls

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates