CIS Controls v8.1: Implementation Groups and the 18 Critical Controls

The CIS Controls (in full, the CIS Critical Security Controls) are a free, prioritised list of security actions that defend against the most common attacks, published by the Center for Internet Security. The current version, CIS Controls v8.1, was released in June 2024 and contains 18 Controls broken down into 153 specific Safeguards. The Safeguards are sorted into three implementation groups, so a small business and a bank can use the same list without doing the same amount of work.

There is no CIS certificate; you use the Controls as a technical roadmap and benchmark. If you need a cyber hygiene certificate for an organisation outside the UK, our guide to IASME Cyber Baseline explains what IASME offers now. For UK organisations the useful questions are how they compare with Cyber Essentials, which you can be certified against, and how they fit an ISO 27001 management system.

What are the 18 CIS Controls?

The order puts foundations first. Controls 1 to 3 establish which devices, software and data you have; 4 to 7 configure them, control access and patch them; 8 to 13 add logging, email and browser protection, malware defences, backups and network defences; and 14 to 18 cover people, suppliers, development, incident response and testing. The table gives each Control’s official name, what it means in practice, the implementation group where its first Safeguard appears, and the closest ISO/IEC 27001:2022 Annex A controls.

Fifteen of the 18 Controls start at IG1. Network monitoring (13), application software security (16) and penetration testing (18) start at IG2. The Annex A column is our indicative mapping, not an official CIS crosswalk, so check it against your own Statement of Applicability. The full ISO list is in our guide to the ISO 27001 Annex A controls.

Free download: the CIS Controls to Cyber Essentials and ISO 27001 mapping (.xlsx) puts this table and the Cyber Essentials mapping below in one spreadsheet, with columns to record your implementation group, status, evidence and owner for each Control.

What are the CIS implementation groups (IG1, IG2 and IG3)?

CIS implementation groups are cumulative tiers that tell you which Safeguards to implement first, based on your risk profile and resources rather than headcount alone. CIS describes IG1 as essential cyber hygiene and says every organisation should start there.

IG1 is designed to be achievable with off-the-shelf tools and limited specialist skill against general, non-targeted attacks. IG3 assumes a sophisticated attacker coming for you specifically.

How do the CIS Controls compare with Cyber Essentials?

Cyber Essentials covers a narrower set of technical controls than CIS IG1 but adds what CIS cannot: an independently assessed certificate that UK buyers recognise. The five Cyber Essentials controls sit almost entirely inside CIS IG1, as the mapping below shows.

Cyber Essentials is also more prescriptive in places. Under the current NCSC requirements (v3.3), high-risk and critical updates must be installed within 14 days, where CIS asks for automated patching monthly or more often, and MFA must be switched on for every cloud service that offers it. Since the Danzell question set took effect in April 2026, failing either is an automatic fail. Our guide to the Cyber Essentials controls explains each one.

The bigger difference is what Cyber Essentials leaves out. IG1 includes six areas that Cyber Essentials does not require:

• Data protection (Control 3): a data inventory, retention and secure disposal.
• Audit logs (Control 8): collecting and keeping logs at all.
• Data recovery (Control 11): backups, with an isolated copy. Cyber Essentials recommends backups but does not require them.
• Awareness training (Control 14).
• Service providers (Control 15): knowing who your suppliers are.
• Incident response (Control 17): named people and a reporting process.

How do the CIS Controls fit with ISO 27001?

ISO 27001 is a management system standard, so it tells you how to choose and run controls, while CIS gives you a concrete list of technical controls to choose from. They work well together. ISO 27001 clause 6.1.3 lets you determine controls from any source, then requires you to compare them with Annex A to check nothing necessary has been omitted, which is where the mapping in the first table helps.

In practice, CIS is strongest on the technological controls in Annex A theme 8 and lighter on governance, people, physical security and supplier management. You still need ISO 27001’s risk assessment, Statement of Applicability, internal audit and management review. If ISO 27001 is the goal, our ISO 27001 consultancy can use your CIS work as evidence rather than starting again.

Should a UK organisation use CIS Controls, Cyber Essentials or both?

Use Cyber Essentials when someone needs proof, and CIS when you need a roadmap. The two answer different questions, so in most situations the answer is both, in the order the table suggests.

How do you assess yourself against the CIS Controls?

Pick the implementation group that matches your risk, then score each Safeguard in it as implemented, partly implemented or not implemented, with evidence. CIS provides a self-assessment tool, CIS CSAT, for tracking this, and the CIS Benchmarks give product-level settings for Control 4. For a first pass at Control level, our free mapping spreadsheet has status, evidence and owner columns beside each Control.

Some Safeguards can only be evidenced by testing. Control 7 calls for automated internal and external vulnerability scans from IG2, which our vulnerability scanning service provides, and Control 18 calls for external penetration tests at IG2 and internal tests at IG3. Configuration claims under Controls 4 and 12 are best checked by someone other than the person who configured the device.

Why Sovereign Secure?

There is no CIS certificate to sell you, so we focus on the parts of a CIS programme that can be independently verified. Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates against the NCSC requirements. We are ISO 27001 certified ourselves and provide ISO 27001 consultancy, with certification audits carried out by our partner certification body, MQA International.

Our penetration testing and vulnerability scanning provide the independent evidence that Controls 7 and 18 ask for, and our firewall configuration reviews check the settings that Controls 4 and 12 describe. We are also a PCI SSC Qualified Security Assessor (QSA) company and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028, so where card data is in scope we can tell you how your CIS work lines up with PCI DSS v4.0.1.

Next step

Tell us which framework you have been asked about and where you are today, and we will suggest a sensible order of work: Cyber Essentials, CIS IG1 gaps, testing or ISO 27001. Contact us or call +44 161 523 5276.