cis-controls

Implementation Group determination depends on IT staffing, data sensitivity, and risk tolerance. IG1 fits small organizations with limited IT resources, IG2 fits mid-size organizations with dedicated IT staff and sensitive data, and IG3 fits enterprises with security teams and regulated data.

A CIS gap assessment starts by determining your Implementation Group, then scoring each applicable safeguard as implemented, partial, or not implemented. Gaps are prioritized IG1 first, mapped to business risk using MITRE ATT&CK, and organized into a remediation roadmap.

Each of the 18 CIS Controls maps to NIST CSF 2.0 functions and ISO 27001:2022 Annex A controls. For example, Control 8 (Audit Logs) maps to NIST Detect categories DE.AE and DE.CM, and to ISO controls 8.15 and 8.16.

CIS Controls v8 consolidated 20 controls into 18, reduced sub-controls from 171 to 153 safeguards, and reorganized around asset types instead of technology types. It also added explicit cloud and mobile coverage and enhanced Implementation Group assignments.

IG1 covers essential cyber hygiene but is generally insufficient for regulated industries. Healthcare organizations under HIPAA and financial institutions under PCI DSS typically need IG2 as a minimum, with IG3 elements for large or high-risk environments.