What Is the CIS Controls?

Definition

The CIS Critical Security Controls (CIS Controls) are a prioritized list of specific security steps published by the nonprofit Center for Internet Security. CIS describes them as "a prioritized set of CIS Safeguards to defend against the most prevalent cyber attacks against systems and networks." The current version is 8.1.

How It Works

The Controls are grouped into numbered areas such as asset inventory, software inventory, data protection, secure configuration, account management, access control, vulnerability management, logging, email and browser protections, malware defenses, data recovery, security training, service providers, and incident response. Each Control breaks down into concrete Safeguards, which are the specific steps to implement and check.

The most useful feature for small businesses is the Implementation Groups (IGs):

IG1 is what CIS calls "essential cyber hygiene," a foundational set of 56 Safeguards that "every enterprise should apply to defend against the most common attacks." CIS says a typical IG1 enterprise is "small to medium-sized with limited IT and cybersecurity expertise."
IG2 adds Safeguards for organizations managing more sensitive data or more complex environments.
IG3 covers the full set for organizations facing sophisticated attackers.

Where the NIST CSF describes outcomes, the CIS Controls describe actions, so many businesses use the CSF to organize their program and IG1 as the to-do list. CIS says the Controls are "mapped to and referenced by multiple legal, regulatory, and policy frameworks," which makes evidence collected for one useful elsewhere.

Real-World Example

In February 2016, California Attorney General Kamala Harris's California Data Breach Report recommended that "the 20 controls in the Center for Internet Security's Critical Security Controls identify a minimum level of information security that all organizations that collect or maintain personal information should meet." The report went further: "The failure to implement all the Controls that apply to an organization's environment constitutes a lack of reasonable security." Ohio's later safe harbor law also lists the CIS Controls among qualifying frameworks.

Why It Matters for a Small Business

"Reasonable security" is the standard that regulators, courts, and insurers apply after a breach, and it is vague by design. The CIS Controls, and IG1 in particular, give a small business a defensible, concrete answer: here is the recognized baseline, and here is the evidence we meet it. IG1 is also realistic for a small team, and most of it overlaps with what cyber insurance applications already ask. Working through IG1 also produces a simple record of what is in place, which shortens every future questionnaire and audit.

How to Spot It / How DTS Handles It

Warning signs: no inventory of devices or software, admin rights handed out freely, no tested backups, logs that are not kept, and nobody able to say which baseline the business follows.

DTS can assess a business against CIS Controls IG1, rank the gaps by impact, and help fix the highest-impact ones first while keeping evidence for insurers and customers. CIS does not present the Controls as a certification for businesses: its FAQ says they "are not a replacement for any existing regulatory, compliance, or authorization scheme," and its CIS Controls Accreditation program accredits assessment providers, not the businesses they assess. See our vCISO service, or our managed IT service for the hands-on work.

Related Terms

NIST Cybersecurity Framework (CSF 2.0): the outcome framework the Controls map to.
CIS Benchmarks: CIS's secure configuration guides.
Asset inventory: the first Control.
Patch management: part of vulnerability management.
Backups and the 3-2-1 rule: the data recovery Control.
Security awareness training: the training Control.
Cyber insurance: applications that overlap heavily with IG1.

Sources

Center for Internet Security, CIS Critical Security Controls Version 8.1: https://www.cisecurity.org/controls/v8-1
Center for Internet Security, CIS Controls Implementation Group 1 (IG1): https://www.cisecurity.org/controls/implementation-groups/ig1
California Department of Justice, Office of the Attorney General, California Data Breach Report (February 2016): https://oag.ca.gov/breachreport2016
Center for Internet Security, CIS Critical Security Controls FAQ ("Are the CIS Controls a replacement for the other frameworks?" and "What Is CIS Controls Accreditation?"): https://www.cisecurity.org/controls/cis-controls-faq

Last updated October 14, 2026.