CIS Critical Security Controls

The CIS Controls are a set of security measures ranked in priority order, published by the Center for Internet Security (CIS), a US nonprofit. The framework started in the late 2000s as the "20 Critical Controls", long distributed by the SANS Institute, hence the SANS Top 20 nickname that still turns up on some applications. Version 8, released in 2021, cut the list to 18 controls, each broken down into finer safeguards. It spreads them across three implementation groups. IG1 gathers what CIS calls essential cyber hygiene, the minimum it considers within reach of a company with no dedicated security team; IG2 and IG3 add on as the organization and the sensitivity of its data grow. The ordering is telling. The hardware asset inventory and the software inventory come first, ahead of any protection, on the view that you cannot protect what you do not know you have. Unlike ISO 27001, where an accredited body certifies a management system, the CIS Controls are a list of technical measures, and CIS issues no certificate of compliance with them. A cyber underwriter finds most of its own application in there, in a different order: multi-factor authentication (MFA), backups, vulnerability management, logging. Hence the temptation for insureds to answer "we are aligned with CIS IG1" instead of giving the detail. Without an auditor, the sentence proves nothing. The underwriter asks what self-assessment was done, when and by whom, then checks whatever an external scan can see, starting with exposed services and email.