CIS Controls v8.1: Implementation Groups and Where to Start

TL;DR: Start with Implementation Group 1 (IG1), the 56 safeguards the Center for Internet Security (CIS) calls essential cyber hygiene. Version 8.1 of the CIS Controls holds 18 controls and 153 safeguards in three cumulative Implementation Groups: IG2 builds on IG1, and IG3 covers all 153. Adoption is voluntary. Begin with the device and software inventories, then accounts and tested backups, and report the share of safeguards complete to your board.

What are the CIS Controls?

The Center for Internet Security (CIS) publishes the CIS Critical Security Controls, which it describes as "a prioritized set of CIS Safeguards to defend against the most prevalent cyber attacks against systems and networks" (CIS). The current version, 8.1, contains 18 controls and 153 safeguards, sorted into three Implementation Groups (IGs). Adoption is voluntary.

How the pieces fit

A control is a broad area of defense. A safeguard is a specific action inside that area, and it is the unit an assessor checks. CIS notes that safeguards were previously referred to as CIS Sub-Controls. That matters if your last audit report predates version 8, because its line items will carry the older name.

The groups are cumulative: IG2 builds upon IG1, and IG3 is comprised of all the Controls and Safeguards. CIS assigns an enterprise to a group by its risk profile and the resources it has to implement the controls.

Who maintains them

The controls are not the work of a single vendor or regulator. CIS says that under its lead they have matured into an international community of volunteer individuals and institutions. Part of that community's stated work is to map the CIS Controls to regulatory and compliance frameworks.

Version and status

Version 8.1 keeps the same safeguard count as version 8. The section What changed in version 8.1, later in this guide, covers the details.

On status, organizations align with CIS Controls rather than certifying to them, so there is no CIS certificate to hold. CIS also says the controls are mapped to and referenced by multiple legal, regulatory, and policy frameworks. In our reading, that makes the practical check simple: before you treat adoption as optional, confirm whether a contract, regulator or cyber insurer you deal with names the controls.

For the related terms, see the glossary.

The 18 controls in the order CIS publishes them

The full list below follows the table of contents of the v8.1 document, in the order CIS prints it.

Where the Implementation Group 1 counts live

The Center for Internet Security (CIS) publishes the per-control split on its Implementation Groups page. The page introduces it as "a list of the CIS Controls in v8.1, and how many Safeguards in each are applicable to each Implementation Group." Read them directly from the CIS page before you build a plan.

This is a practical step. Put a column next to each control in your own tracker, copy the IG1 count from CIS, and record the date you copied it. The counts are what turn the list above into a first-year workload.

Pages that still say 20 controls

Some explainer pages still describe a list of 20. One guide, for example, calls the controls "a set of 20 prioritized cybersecurity best practices" and sorts them into Basic, Foundational, and Organizational categories.

In our reading, that page describes the older version 7 structure. The names give it away: titles such as Controlled Use of Administrative Privileges do not appear in the v8.1 contents above. If a vendor questionnaire, audit request or internal policy cites a control number, check which version it means before you map anything. In our reading, Control numbers and names moved between versions.

How IG1, IG2 and IG3 differ

The Center for Internet Security (CIS) sorts enterprises into three Implementation Groups (IGs). It bases them on size and/or complexity, data types, resources and technology, threat types, and risk.

What the IG1 profile adds

The IG1 page names a business concern as well as a technical one. These enterprises want to keep operating and have a limited tolerance for downtime. The page also says the Safeguards are typically built to work with small or home office commercial off-the-shelf (COTS) hardware and software.

CIS calls this group "essential cyber hygiene". For a reader, that means standard equipment and modest staffing.

How the groups stack

The groups are cumulative. IG2 builds on IG1, and IG3 covers all the Controls and Safeguards. The v8 and v8.1 catalogue holds 153 Safeguards in total. An IG3 enterprise therefore works against the full list, and an IG1 enterprise works against a subset of 56.

In our reading, the blank cells for IG2 and IG3 are less of a problem than they look. The IG1 row sets a baseline profile. We think the practical test is whether you exceed it. Your enterprise may exceed it in several ways:

• your data goes well beyond employee and financial records
• you have dedicated security staff
• you expect attackers to pick you out specifically

If any of these is true, you have probably outgrown the IG1 profile. That is our reading, not a CIS rule.

CIS offers a downloadable guide that it says helps enterprises efficiently and less subjectively determine your IG. That guide is the place to check the IG2 count and the fuller definitions before you commit a budget.

The assignment is not permanent. CIS says Safeguard implementation is not a one-time activity. In our reading, an acquisition, a new data type or a shift in threats can move an enterprise from one group to the next.

What changed in version 8.1

CIS presents version 8.1 as a revision, not a rebuild. In its own words, CIS Controls v8.1 is "an iterative update to v8". The safeguard count and the Implementation Group structure described earlier carry over. A security leader who already runs v8 mostly needs to spot what moved. Relearning the framework is not required.

A vendor explainer gives the timing: v8.1 was released in June 2024.

The changes CIS lists

CIS names the additions in one sentence. The update brings updated alignment to industry frameworks, revised asset classes and CIS Safeguard descriptions, and the addition of the Govern security function from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) 2.0.

The glossary is the change we think readers most often skip. A policy that calls something a process when CIS would call it a plan can still pass a self-assessment. It may read differently to an assessor who works from the CIS definitions.

The three design principles

For 8.1 they are context, coexistence, and consistency:

• Context adds specific examples and additional explanations to Safeguards.
• Coexistence aligns with other major security frameworks to the extent practical while keeping what is distinct about the CIS Controls.
• Consistency aims for little to no change due to this update for existing users.

In our reading, the consistency principle sets the scale of the job. A team on v8 should plan a review of mappings and definitions. A fresh gap assessment should not be needed.

What comes in the download

The v8.1 download includes a PDF, Excel, Change Log, Implementation Groups file set. CIS also lists French and Italian translations.

A practical order, in our view:

1. Read the change log first.
2. Compare the Excel against your current control mapping.
3. Mark every Safeguard whose wording changed.
4. Check those Safeguards against the evidence your auditors already hold.

The 56 IG1 safeguards a small team should finish first

The IG1 set is short enough to fit on one planning page.

CIS is direct about sequence. Its guidance says every enterprise should start with IG1, and it calls IG1 the on-ramp to the CIS Controls. It also describes IG1 as an emerging minimum standard of information security for all enterprises. That line is useful in a budget conversation.

How the work clusters

The table groups IG1 work by what a small team actually does. The grouping is ours, not CIS's, and the per-control counts live on the CIS page linked above.

Why inventory comes first

Control 1 covers Inventory and Control of Enterprise Assets and Control 2 covers Inventory and Control of Software Assets. In our reading, their place at the top is deliberate. Every later Safeguard assumes you know what you are protecting. A laptop missing from the asset list never gets the secure baseline. It never gets the patch, and it never lands in the backup job.

Software works the same way. Consider an unapproved remote access tool on a reception PC. It sits outside your patch cycle and your license review. Finding it in week one is cheap. Finding it during an incident is not.

We think there is a second reason. A generalist can do inventory work with tools already on hand. That fits the CIS aim that IG1 Safeguards should be implementable with limited cybersecurity expertise. The result is visible fast, and it feeds every later step.

A practical order for the first weeks

1. Build the device list from sources you already have: directory exports, your endpoint management console, network address logs.
2. Build the software list from the same tools, and mark each item as authorized or not.
3. Give every device and application a named owner.
4. Move to configuration and patching only after that, using the two lists as your scope.

This matches the framework's founding intent. CIS set out to focus defenders on the most common and important real-world cyber attacks that affect enterprises every day. A complete inventory is where that focus becomes measurable. More step-by-step material is in our guides.

A practical order of work for the first 90 days

In our reading, most teams of one to five people can make visible progress through Implementation Group 1 (IG1) in a quarter if they work in a fixed order and keep one piece of evidence per month. The sequence below is our view, not a CIS schedule. CIS is cited only to name the controls each step touches.

Days 1 to 30: know what you have

• Build the device list, with owners. A spreadsheet is enough. List every laptop, server, phone, network device and cloud account, with columns for owner, location, operating system and date last seen. Pull from your endpoint tool, your router's client list and finance's purchase records, then reconcile the three.
• Add a second tab for software, starting with what is installed on admin workstations and servers. These two tabs map to the two inventory controls covered earlier in this guide.
• Mark anything with no owner. Each unowned device is a decision for the next meeting: assign it or retire it.

Board evidence: the inventory export, with its date in the file name.

Days 31 to 60: lock down accounts

• Export every account with admin rights from your directory, email platform and cloud consoles. This is the core of Control 5, Account Management.
• Turn on multifactor authentication (MFA) for those admin accounts first, then for email and remote access such as a virtual private network. This work sits under Control 6, Access Control Management.
• Disable accounts belonging to people who have left. Check the list against HR's leavers report, not against memory.

Board evidence: an MFA coverage list showing each admin account, its MFA status and the date checked.

Days 61 to 90: prove you can recover

• Pick one system the business cannot run without, often the finance or file server. Restore it from backup to a separate machine and time the process from start to a working login. This is the practical test behind Control 11, Data Recovery.
• Set a monthly patch window for operating systems and browsers. That gives Control 7, Continuous Vulnerability Management a starting rhythm.
• Write a one-page incident contact sheet: who decides, who calls the insurer, who talks to staff. It is a first step toward Control 17, Incident Response Management.

Board evidence: a timed restore record, including any step that failed.

Leave phishing training under Control 14, Security Awareness and Skills Training until after day 90 unless an incident forces it sooner. In our reading, a tested restore protects a small team more than a training module in the first quarter. For the wider plan around these steps, see the first 90 days guide.

Reporting IG progress to executives and the board

A board does not need the safeguard list. It needs to know how much of each Implementation Group (IG) is done, what comes next and when. We think two measures cover most of that: the share of safeguards complete in each IG, and the dates of the next steps.

What to put on the page

Keep the report to one slide or one page. A director should be able to read it in a minute.

Count a safeguard as complete only when it is in place and someone can show evidence of it. A partly deployed tool is not complete. Report it under slipped work with a new date.

Avoid invented maturity scores

In our reading, the CIS Controls give you safeguards grouped by IG. They do not give you a scoring scale. If an assessor uses a scoring model, name the model and keep it separate from the safeguard counts.

Track the same measures every quarter. A board can follow a trend in a share of safeguards complete. It cannot follow a scale that changes each time a new assessor arrives. For how committees handle this material, see board committee oversight and the glossary entry on board cybersecurity oversight.

Copying CIS text into board packs

The Controls carry a license that matters if you paste safeguard wording into slides. The v8.1 guide says the work is under a Creative Commons Attribution-NonCommercial-No Derivatives 4.0 license. Here is what the guide states:

• Copying and redistribution are allowed for non-commercial purposes only, with credit to CIS and a link to the license.
• If you remix, transform or build on the Controls, you may not distribute the modified materials.
• Users must point to the CIS Controls page on the CIS website when referring to the Controls.
• Commercial use requires prior approval from the Center for Internet Security.

A reader can check three things before a pack goes out. Does each slide that quotes CIS text credit CIS and link the license? Has any safeguard wording been reworded and then shared outside the team? Will the pack reach a client or a paying audience? Whether a given use counts as commercial is a question for your counsel. A safe working habit is to cite safeguard numbers and keep CIS wording unchanged. For how this report fits a CISO's wider duties to the board, see CISO accountability.

What this guide does not cover

This guide does not reproduce the per-control IG1 safeguard counts or the IG2 total, and it does not describe the IG2 and IG3 enterprise profiles in detail. It does not assess or recommend tools or vendors. It is not legal or financial advice: whether a regulation, contract or license term applies to you is a question for your counsel. For the rules and the record behind it, see SEC Cybersecurity Disclosure Rules for CISOs: Item 1.05, Item 106 and Item 1C Explained.