CIS Critical Security Controls v8.1: a prioritised baseline

What it is

The CIS Critical Security Controls, maintained by the Center for Internet Security, are a prescriptive list of defensive actions. Where the NIST CSF describes outcomes, the CIS Controls describe concrete safeguards, such as "establish and maintain a software inventory" or "use a standard, secure configuration for network infrastructure". They grew out of a 2008 effort to agree which actions stop the most common real attacks.

Version 8 (2021) reduced the list from 20 to 18 Controls and organised it around activities rather than who manages a device, recognising cloud and remote work. It contains 153 Safeguards. Version 8.1, released in June 2024, is an iterative update rather than a rewrite.

Why it matters

Many small and medium organisations have no dedicated security staff. A framework that says "manage risk" leaves them stuck. The CIS Controls tell them what to do first. Implementation Group 1 (IG1) is defined as essential cyber hygiene: a set of 56 safeguards that a small team with limited expertise can implement and that defends against the most common opportunistic attacks. IG2 adds safeguards for organisations with more complex IT and sensitive data; IG3 covers all safeguards for organisations facing skilled, targeted attackers.

The Controls are also widely mapped to other frameworks and regulations, and some cyber insurance questionnaires and government programmes refer to them, so they are a practical bridge between engineering work and compliance language.

Key ideas

The 18 Controls cover, in order: inventory of enterprise assets; inventory of software; data protection; secure configuration; account management; access control management; continuous vulnerability management; audit log management; email and browser protections; malware defences; data recovery; network infrastructure management; network monitoring and defence; security awareness training; service provider management; application software security; incident response management; and penetration testing.

• Order is deliberate. You cannot protect what you do not know you have, so asset and software inventory come first.
• Safeguards are measurable. Each states one action with a clear subject, which makes audits and progress tracking easier than with outcome-based frameworks.
• Security functions. Each safeguard is tagged with a function (such as Identify, Protect or Detect) and an asset type (devices, software, data, users, network, documentation).

What changed in v8.1

• NIST CSF 2.0 alignment. Function mappings were updated to match CSF 2.0.
• Govern function. A Governance security function was added, and safeguards that involve policies, processes and plans are now labelled as governance-related, so leadership responsibilities are easier to see.
• New asset classes such as documentation, with updated mappings to safeguards.
• Clarifications. Glossary terms were added and some safeguard descriptions were tightened. The Implementation Groups were not changed.

CIS has said it is already gathering ideas for a version 9, but as of October 2026 v8.1 is the current release.

How practitioners apply it

1. Self-assess against IG1 using the free CIS assessment spreadsheet or tool. Be honest: "partially implemented" is common and useful.
2. Fix inventory first. Combine DHCP logs, switch MAC tables, endpoint management and cloud asset lists. Network commands from the essential network commands note help with discovery in small sites.
3. Secure configuration baselines. Use CIS Benchmarks for operating systems, network devices and cloud services, and apply them through automation rather than by hand. The switch hardening playbook is a good example.
4. Centralise logs and agree how long to keep them (Control 8).
5. Move to IG2 once IG1 is stable and evidenced, prioritising the safeguards that address your real threats.

Tip: Many IG1 safeguards are cheap but tedious, such as keeping an inventory current. Automate them, or they will drift within months.

For students and junior engineers, the Controls make an excellent study structure. Each safeguard can become a small lab task: build an asset inventory for a home lab, apply a benchmark to a Linux server, set up log forwarding, then test restoring from backup. Documenting each task against its safeguard number also produces a portfolio that employers recognise.

Limitations and open questions

• Prescriptive by design. A safeguard may not fit an unusual environment, such as an industrial network or a pure SaaS company, without interpretation.
• IG1 is a floor, not a target. Organisations handling sensitive data or facing targeted attackers need much more.
• Evidence quality varies. "Implemented" can mean anything from a written policy to an automated, monitored control.
• Cloud-native and AI systems are covered mainly through generic safeguards and companion guides, which is one reason a version 9 is being discussed.