CIS Controls Implementation: A Phased, Evidence-Based Approach

Implementing the CIS Critical Security Controls is most defensibly done by selecting an Implementation Group (IG), inventorying assets, applying that group’s Safeguards in a deliberate sequence, and then measuring and repeating the process. The Center for Internet Security (CIS) describes the Controls as a prescriptive, prioritized, and simplified set of best practices for strengthening cybersecurity posture. This article examines how an organization in the United States can move from selecting a group to demonstrable, measurable implementation, and how that work relates to the NIST Cybersecurity Framework.

TL;DR

• Every enterprise is advised by CIS to begin with IG1 and progress to IG2 and IG3 according to size, data sensitivity, resources, threats, and risk.
• IG1 comprises 56 foundational Safeguards; IG2 adds 74; IG3 contains the remaining 23, for 153 in total.
• Assessment distinguishes binary checks (is the Safeguard implemented) from performance checks (how well does it work), and both should be recorded as evidence.
• The Controls are not federally mandatory, although several states reference them in safe harbor statutes.
• Implementation is iterative: environments and threats change, so the assessment cycle must be repeated.

Table of Contents

• What the CIS Controls Are and What Version 8.1 Changed
• Are the CIS Controls Mandatory?
• Choosing an Implementation Group
• A Step-by-Step Implementation Sequence
• Assessing Implementation Against the Controls
• How the CIS Controls Relate to NIST
• Common Implementation Failures
• Our Perspective
• Support for Your Implementation
• FAQ
• Sources

What the CIS Controls Are and What Version 8.1 Changed

The CIS Controls are a set of 18 top-level Controls, each divided into Safeguards, which are discrete and testable actions. Version 8.1.2 lists 18 Controls, and they are organized around activities (for instance, inventory and control of enterprise assets, data protection, access control management, and continuous vulnerability management) rather than around organizational roles or device ownership.

Version 8.1, launched on June 25, 2024, added new asset classes and a governance security function intended to help identify the policies, procedures, and processes used to protect assets and demonstrate compliance. The practical consequence is that an implementation program now has an explicit place for documented governance, not only technical configuration.

A clarification on scope is warranted. CIS itself acknowledges that a listing of activities is not a silver bullet for all threats; the intent is to provide activities for defending against common threats. That framing is useful for planning, because it supports an implementation program that is scoped, prioritized, and honest about residual risk.

Are the CIS Controls Mandatory?

The CIS Controls are a voluntary framework and not a federal statute. Their legal relevance is nonetheless growing. According to CIS, the Controls have been included in state cybersecurity safe harbor statutes in Ohio, Utah, Connecticut, and Iowa, and they are mapped to and referenced by multiple legal, regulatory, and policy frameworks.

For organizations operating in Alabama, Georgia, Mississippi, or Tennessee, the more common drivers are contractual: customer security questionnaires, cyber insurance applications, and audit frameworks that request evidence of a recognized control set. Counsel should confirm whether any state statute, sector regulation, or contract applies to a specific entity, since the answer depends on facts that a general article cannot determine.

Choosing an Implementation Group

Implementation Groups exist so that organizations of different resources do not face a single undifferentiated list of 153 Safeguards. CIS states that every enterprise should begin with IG1 and then move to IG2 and IG3 based on size and complexity, data types, resources and technology, threat types, and risk.

Why IG1 is a rational starting point

The empirical case for IG1 rests on the CIS Community Defense Model. Version 2.0 of that model found that IG1 Safeguards defend against 77% of ATT&CK (sub-)techniques used across the top five attack types, rising to 91% when all Safeguards are implemented. The findings, as CIS interprets them, reinforce the value of a relatively small number of well-chosen, basic defensive steps. Because the model is published by the same body that maintains the Controls, it is best read as supporting evidence for prioritization and not as an independent validation.

Factors that move an organization beyond IG1

Several conditions justify an earlier move to IG2: storage or processing of regulated data (health records, payment data, student records), a dedicated IT function that manages multiple enterprise systems, and customers who require attestation. Independent healthcare practices, professional services agencies, and small manufacturers commonly sit near this boundary. IG3 is appropriate where sensitive data and capable adversaries combine, and where a dedicated security staff exists to operate the more demanding Safeguards.

A Step-by-Step Implementation Sequence

CIS publishes an implementation model in its Essential Guide: implement IG1 at Level 1, IG2 at Level 2, and all applicable Controls at Level 3, using the CIS Controls Navigator to export Safeguard lists. The sequence below follows that logic and adds the operational detail a project plan typically needs.

1. Define scope and ownership. Establish which business units, networks, cloud tenants, and third-party services fall inside the program, and assign a named owner to each Control. Governance documentation, which v8.1 emphasizes, begins here.
2. Select the group and export the Safeguards. Use the Navigator to generate the IG1 list (or IG2, where warranted) and import it into a tracking register.
3. Build the asset foundation. Controls 1 and 2 (enterprise assets and software assets) underlie nearly every later Safeguard, since an organization cannot protect, patch, or monitor what it has not inventoried.
4. Address data and access. Data protection, secure configuration, account management, and access control management reduce the exposure created by default settings and excess privilege.
5. Operationalize vulnerability and log management. Scanning, remediation timelines, and log collection convert one-time configuration into continuing assurance. A vulnerability management program and a tested patch management strategy are the usual vehicles.
6. Prepare for incidents and email and web threats. Email and browser protections, malware defenses, and a documented incident response plan complete the baseline.
7. Record evidence and review. Capture the artifact that proves each Safeguard (a configuration export, a policy approval, a screenshot, a ticket history) and set the review calendar.

Treating implementation as a cycle

CIS emphasizes that implementation is not a one-time event. Organizations are advised to treat it as an iterative process because environments, business objectives, and threat landscapes change continuously. In practice, this means each Safeguard has a status, an owner, a last-verified date, and a next-review date, and that mergers, new SaaS adoption, and staff turnover trigger targeted reassessment outside the normal cycle.

Assessing Implementation Against the Controls

Assessment is the second query readers commonly pair with implementation, and the two activities are inseparable. CIS directs organizations to the CIS Controls Assessment Specification to measure whether Safeguards are implemented, and notes that its CSAT tool can help measure how well they are implemented.

Binary and performance measurement

The specification categorizes measurement into two approaches: binary checks (is the Safeguard in place) and performance or effectiveness checks (how well is it working). It supplies measures, meaning what to track, and metrics, meaning the formulae for calculating results, to help verify that specific Safeguards are properly in place and functioning. Both are needed. A binary check may confirm that an asset inventory exists; a performance check asks what percentage of devices on the network appear in it and how current the data is.

The examples in the right-hand columns are illustrative measures an organization might choose; the authoritative formulae are those in the specification.

Tooling and documentation

The CSAT Pro dashboard provides an assessment average, industry average comparisons for opted-in users, and heat maps for tracking progress against Safeguards. For organizations that must document control implementation in a machine-readable form, the CIS Controls OSCAL Repository, available for v8 and v8.1, reduces the burden of manual documentation. Spreadsheets remain acceptable for smaller environments, provided each row carries an owner, an evidence reference, and a date. A one-row-per-gap compliance register is a workable structure for that purpose.

Reassessment frequency

CIS does not prescribe a single universal interval, which is consistent with its description of implementation as iterative. A defensible practice is an annual full assessment, quarterly review of open gaps, and event-driven reassessment after significant change. The organization should record the chosen cadence in its governance documents so that auditors and insurers can see it was deliberate.

How the CIS Controls Relate to NIST

The CIS Controls and the NIST Cybersecurity Framework serve different purposes and are designed to be used together. The NIST framework describes outcomes at a relatively high level (govern, identify, protect, detect, respond, recover), whereas the CIS Controls specify prioritized actions. CIS publishes mappings of its Controls and Safeguards to NIST CSF 2.0, which allows an organization to select outcomes in the framework and trace each to concrete Safeguards.

For U.S. organizations that report to a board or respond to customer assessments, a common arrangement is to use the framework to express target profiles and the Controls to implement them. The related guidance on implementing the NIST CSF over six to twelve months and on a seven-step risk assessment process describes how the two layers are joined to a documented risk decision.

Common Implementation Failures

Three patterns recur. First, organizations attempt IG2 or IG3 before the asset inventory is reliable, so later Safeguards are applied to an incomplete population. Second, implementation is recorded as a checklist with no evidence, which fails at the first customer audit. Third, ownership is assigned to a role that no longer exists after staff changes, so reviews lapse. Each is addressed by the sequence above: scope and ownership first, an accurate inventory second, evidence recorded continuously.

A related risk is treating framework alignment as equivalent to security. Alignment reduces exposure to common attack techniques; it does not remove the need for a risk assessment tied to the organization’s own data, vendors, and regulatory obligations.

Our Perspective

In our work on technical risk reviews, the most frequent obstacle to CIS implementation is rarely the absence of a tool. It is the absence of clarity: who owns a Safeguard, what evidence demonstrates it, and which gaps matter first when time is limited. Teams under pressure tend to purchase software before they have an inventory, and then discover that the software has no accurate population to act upon.

We therefore advise a deliberately narrow beginning. Select IG1, assign owners, and document the evidence for each Safeguard before attempting anything further. This approach is designed to produce a defensible record quickly, and it gives leadership a precise picture that can be communicated in plain terms to a board, an insurer, or a customer.

Our position is that technical remediation and leadership communication belong in the same engagement. A control that cannot be explained to the people who fund it is seldom maintained, and a plan that cannot be executed calmly during an incident is seldom followed. That conviction informs how we structure advisory work, from the initial review to the register that the organization keeps after we leave.

Jesse Hart

Support for Your Implementation

PROJECT-JTH provides technical advisory services covering cybersecurity assessments, risk assessment and mitigation, and security remediation for organizations in Alabama, Georgia, Mississippi, and Tennessee, as well as fractional leadership support where a full-time security executive is not warranted. A scoped technical systems and risk review can establish the IG1 baseline, identify the gaps, and leave a register your team can maintain. For independent consultants and small firms that need structured tooling for engagements and records, the Project Praxis offer is priced at $99 per month.

Where remediation is the immediate concern, the guidance on closing control gaps before an audit window describes how findings are converted into prioritized work.

FAQ

What is the difference between IG1, IG2, and IG3?

IG1 contains 56 foundational Safeguards considered essential cyber hygiene for every enterprise. IG2 adds 74 Safeguards for organizations with greater operational complexity, and IG3 adds the remaining 23 for mature organizations facing sophisticated threats. The groups are cumulative, so IG2 includes IG1 and IG3 includes both.

How long does CIS Controls implementation take?

The timeline depends on the starting condition of the environment, the size of the organization, and the group selected, and CIS does not publish a single duration. Because the asset inventory and ownership assignments condition every later step, they should be completed and verified before the schedule for further Safeguards is fixed. A phased plan with quarterly review of open gaps is a reasonable structure.

Do small organizations need to implement all 18 Controls?

IG1 touches most of the Controls but includes only a subset of Safeguards within each. Smaller organizations are therefore not required to implement all 153 Safeguards, and CIS recommends beginning with IG1. The group should be revisited as data types, resources, and risk change.

How is a CIS Controls assessment performed?

An assessor applies the measures and metrics in the CIS Controls Assessment Specification to each in-scope Safeguard, recording binary results and performance results with supporting evidence. Tools such as CSAT Pro can track results and display progress by Safeguard. The findings are then entered into a remediation register with owners and target dates.

Sources

• CIS Critical Security Controls
• CIS Controls v8.1 press release
• Guide to Implementation Groups, CIS Controls v8.1
• CIS Controls v8.1.2 guide (PDF)
• CIS Controls v8 Implementation Groups handout, Virginia Tech
• CIS Community Defense Model v2.0
• Implementing the CIS Controls, Essential Guide
• Establishing Essential Cyber Hygiene
• CIS Controls Assessment Specification
• CSAT Pro User Guide
• Automating the CIS Controls with OSCAL
• CIS Controls v8.1 mapping to NIST CSF 2.0

Recommended

• Patch Management Strategy for IT: Test CISA Rules in 30 to 90 Days
• Turn Findings Into Fixes: Cloud Security Assessment for CISOs
• Leaders: 7-Step Risk Assessment Process Mapped to ISO, NIST, OSHA
• DevOps for Compliance: SBOMs & Signed Artifacts for U.S. Regulated Orgs