Key Facts
- Regulator
- Center for Internet Security, Inc. (CIS)
- Latest version
- CIS Critical Security Controls v8.1 (an iterative update to v8.0)
- Effective
- 24 June 2024
- Official text
- www.cisecurity.org ↗
What is CIS Critical Security Controls (CIS CSC)?
The CIS CSC, or CIS Critical Security Controls, is a prescriptive, prioritised set of cybersecurity best practices published by the Center for Internet Security (CIS) and developed through community consensus. It is voluntary and applies to any organisation, from small firms with limited IT expertise to large enterprises, that wants a clear starting point for cyber defence.
The current version is CIS Critical Security Controls v8.1, published on 24 June 2024 as an iterative update to v8.0. It contains 18 Controls and 153 Safeguards. CIS describes the Controls as a "must-do, do-first" starting point for every enterprise improving its cyber defence.
CIS stands for the Center for Internet Security, the publisher, which is why people search for everything from "cis csc" to "centre for internet security". The set is also called the CIS Controls, and "CIS v8" means version 8 of them.
Why it matters
A customer asks which security framework you work to. ISO 27001 sounds like a programme; a long list of best practice sounds like homework with no order.
The CIS CSC answers the ordering problem. It is prescriptive and prioritised, and its Implementation Groups tell a small team what to do first and a larger one what to add.
Two further reasons it gets named:
- Work that carries over. CIS says the Controls map to the NIST Cybersecurity Framework, NIST SP 800-53 and the ISO 27000 series, and to regulations such as PCI DSS and HIPAA. It also says implementing them creates an on-ramp to complying with PCI DSS, HIPAA and other industry regulations.
- A defensible baseline. In her state's 2016 Data Breach Report, California's then Attorney General called the earlier set of 20 Controls "a floor" for any organisation holding personal information, as CIS's FAQ records. In the UK they can support an argument that technical measures are appropriate (see the UK position below).
A framework that ranks nothing leaves a small team exactly where it started.
Who it applies to
CIS positions the Controls for every enterprise. The Implementation Groups prioritise Safeguards by an enterprise's risk profile and resources. CIS says an IG1 enterprise is typically small to medium-sized, with limited IT and cybersecurity expertise, and that every enterprise should start with IG1 before moving to IG2 and IG3.
The obligation is voluntary. The CIS CSC is a best-practice framework that anyone can use free of charge on their own security, and CIS states that the Controls "are not a replacement for any existing regulatory, compliance, or authorization scheme."
For an ISO 27001 holder, the two sit side by side. ISO 27001 asks you to run a risk-driven management system and choose controls; the CIS CSC supplies a prescriptive, ordered list of actions. Neither replaces the other, and the ISO 27001 vault covers the management system.
The UK position
A UK firm meets the CIS CSC commercially or by choice, not by statute. CIS lists the UK's Centre for the Protection of National Infrastructure (CPNI) among the organisations that recommend the Controls, and says ETSI, the European standards body, has adopted and published them. CPNI has since closed and been replaced by the National Protective Security Authority (NPSA). Neither recommendation is a UK legal requirement.
The nearest legal hook is UK GDPR and the Data Protection Act 2018, which require appropriate security of processing. CIS says the Controls give an on-ramp to GDPR compliance. They can serve as evidence of appropriate technical measures, but UK law does not mandate them. None of the sources checked shows the FCA, PRA or ICO naming the Controls.
In practice the first encounter is usually a customer questionnaire or a US-facing contract asking which framework you align to.
Key requirements
The CIS CSC is a structure of actions rather than a set of clauses:
- Controls. CIS says there are 18, each a theme of cyber defence.
- Safeguards. Each Control is broken into Safeguards, and each Safeguard requires you to do one thing. There are 153 in v8 and v8.1.
- Implementation Groups. IG1, IG2 and IG3 rank the Safeguards. IG1 is essential cyber hygiene and consists of 56 Safeguards. IG2 builds on IG1, and IG3 comprises all the Controls and Safeguards.
- Governance. v8.1 added the "Govern" security function introduced in NIST CSF 2.0, revised the asset classes and expanded the glossary definitions.
IG1 is the on-ramp, not the destination.
Is there a CIS CSC 19?
No. The current Controls number 18, and CIS's own FAQ asks "Why are there 18?". A search for "CIS CSC 19" may come from a miscount or a source citing a different version. Check any numbered reference against the version it names, and cite v8.1 for the current set.
CIS Controls and CIS Benchmarks
The two are separate. The CIS Controls are a general set of recommended practices. CIS Benchmarks are guidelines for hardening specific operating systems, middleware, software applications and network devices. A firm can follow the Controls without adopting a single Benchmark, and the reverse.
Frequently asked questions
In cybersecurity, CIS usually means the Center for Internet Security, Inc., a community-driven nonprofit responsible for the CIS Critical Security Controls (CIS CSC) and the CIS Benchmarks. CIS describes both as globally recognised best practices for securing IT systems and data, and it leads a global community of IT professionals that keeps refining them.
CIS v8 controls are version 8 of the CIS Critical Security Controls: 18 Controls broken into 153 Safeguards, each of which requires one action. Version 8.1, published on 24 June 2024, is an iterative update to v8.0 that added the Govern security function from NIST CSF 2.0. Both versions carry the same 153 Safeguards.
IG1, IG2 and IG3 are the CIS CSC Implementation Groups. CIS calls IG1 "an emerging minimum standard of information security" and says every enterprise, whatever its size, should start there. IG2 extends IG1, and IG3 takes in all 153 Safeguards. An enterprise moves up the groups according to its risk profile and the resources it has available.
The current version of the CIS CSC is CIS Critical Security Controls v8.1, published on 24 June 2024. CIS says v8.1 is backwards compatible with earlier versions and gives a migration path, and it still lists v8.0 and v7.1. Check the Center for Internet Security's Controls page for the latest release before citing a version in a questionnaire or contract.
No. The CIS CSC v8.1 stops at Control 18, and CIS says there is "no magic to the number 18": practitioners agreed that eighteen actions stop the vast majority of attacks seen today. Earlier releases carried 20 Controls, so a reference to Control 19 usually comes from an older edition and should be checked against the version it cites.
No UK law makes the CIS CSC mandatory, and the sources checked show no UK regulator naming it. Any firm can use the CIS CSC free of charge on its own security, but a consultant or vendor that builds the Controls into its services or products is asked to take out a CIS SecureSuite membership. Most UK firms meet it through a customer request or a US-facing contract.