SecurityGlobal

CIS v8

Keep essential cyber hygiene owned and evidenced

Organise a practical security improvement programme around the CIS Controls v8 entry in Netra.

Version note. CIS Controls v8.1 is a later update to this version. See CIS v8.1

Full title
CIS Critical Security Controls Version 8
Issued by
Center for Internet Security (CIS), a US non-profit organisation, developed with a global community of practitioners
Published
May 2021. Superseded by v8.1, an iterative update released in June 2024.
Applies to
Any organisation, of any size or sector, that wants a prioritised set of defensive actions
Nature
Voluntary best-practice framework. There is no CIS certification.
Structure
18 Controls containing 153 Safeguards, prioritised through three Implementation Groups

Overview

What CIS Controls v8 is

The CIS Critical Security Controls are a prioritised set of actions that defend against the most common cyber attacks on systems and networks. They are written for the people who operate security day to day: each Safeguard is a specific, measurable action, such as keeping an inventory of enterprise assets, enforcing multi-factor authentication or testing data recovery. The Controls began in 2008 as a community effort and have been maintained by the Center for Internet Security since version 6.

Version 8, released in May 2021, reduced the Controls from 20 to 18 and renamed the former Sub-Controls as Safeguards, 153 in all. It organised the Controls by activity rather than by who manages a device, reflecting cloud services, mobile working and outsourced IT, where physical network boundaries matter less. It also added a Control for service provider management.

Not every organisation needs to implement every Safeguard at once. Implementation Groups set an order of priority. IG1, defined by CIS as essential cyber hygiene, contains 56 Safeguards that every organisation should put in place. IG2 adds 74 Safeguards for organisations with more complex environments, and IG3 adds the final 23 for organisations facing sophisticated attacks or holding highly sensitive data.

CIS released CIS Controls v8.1 in June 2024 as an iterative update. It keeps the 18 Controls and the Implementation Groups, revises asset classes and definitions and aligns the Controls with NIST CSF 2.0, including its Govern function. This page supports organisations maintaining an existing v8 programme and planning a controlled move to v8.1.

Who it applies to

CIS Controls v8 can be adopted by any organisation. It is most often used by:

  • Small and mid-sized organisations that need a clear starting point, usually IG1
  • IT and security operations teams that want concrete, testable actions
  • Managed service providers and MSSPs setting a baseline across many clients
  • Organisations mapping technical controls to ISO 27001, NIST CSF or sector regulations
  • Public sector bodies and their technology suppliers
  • Organisations answering cyber insurance or customer security questionnaires

The CIS Controls are voluntary. Some US state laws refer to them as a recognised framework, but adoption is generally a choice or a contractual expectation.

Structure

The 18 Controls

Each Control states why it matters and lists its Safeguards. Every Safeguard is assigned an asset type, a security function and the Implementation Groups it belongs to.

Controls 1–3

Know what you have and what it holds

Control 1: Inventory and Control of Enterprise Assets
Actively manage all enterprise assets, including end-user devices, network devices, IoT devices and servers, physical, virtual and in the cloud, and deal with unauthorised ones.
Control 2: Inventory and Control of Software Assets
Keep an inventory of software, make sure it is authorised and supported, and prevent unauthorised software from being installed or run.
Control 3: Data Protection
Identify, classify, handle, retain and dispose of data securely, including a data inventory, access control lists, encryption and data flow documentation.
Controls 4–6

Configure securely and control access

Control 4: Secure Configuration of Enterprise Assets and Software
Establish and maintain secure configurations for enterprise assets and software, manage default accounts, and secure session locking and firewalls.
Control 5: Account Management
Manage user, administrator and service accounts through their lifecycle, with unique passwords, removal of dormant accounts and restricted administrator privileges.
Control 6: Access Control Management
Grant and revoke access through defined processes, require multi-factor authentication for external applications, remote access and administrative access, and use role-based access.
Controls 7–10

Find weaknesses and defend the endpoints

Control 7: Continuous Vulnerability Management
Continuously assess and track vulnerabilities, patch operating systems and applications, and run internal and external vulnerability scans.
Control 8: Audit Log Management
Collect, store, review and retain audit logs that help detect, understand and recover from an attack.
Control 9: Email and Web Browser Protections
Use supported browsers and email clients, DNS filtering, URL filtering and email protections to reduce attacks through people’s everyday tools.
Control 10: Malware Defenses
Prevent or control the installation, spread and execution of malicious software, with centrally managed and updated anti-malware.
Controls 11–13

Recover, and run and watch the network

Control 11: Data Recovery
Keep data recovery practices that can restore in-scope assets to a trusted state, with protected and isolated backups and tested recovery.
Control 12: Network Infrastructure Management
Manage network devices to prevent attackers exploiting vulnerable services and access points, with secure architecture and up-to-date infrastructure.
Control 13: Network Monitoring and Defense
Operate processes and tools for network monitoring and defence, including alerting on security events, intrusion detection and traffic filtering.
Controls 14–16

People, providers and software

Control 14: Security Awareness and Skills Training
Run a security awareness programme so the workforce is security-conscious and has the skills to reduce risk.
Control 15: Service Provider Management
New in v8: evaluate service providers who hold sensitive data or run critical platforms and processes, and make sure they protect them appropriately.
Control 16: Application Software Security
Manage the security lifecycle of in-house developed, hosted or acquired software, to prevent, detect and remediate weaknesses.
Controls 17–18

Respond and test

Control 17: Incident Response Management
Establish a programme to prepare for, detect and respond quickly to attacks, with defined roles, communications and post-incident reviews.
Control 18: Penetration Testing
Test the effectiveness and resilience of enterprise assets by identifying and exploiting weaknesses in controls, people, processes and technology.
IGs

Implementation Groups

Each group builds on the one before it. Organisations self-select the group that fits their risk and resources.

IG1: essential cyber hygiene (56 Safeguards)
The minimum for every organisation, aimed at general, non-targeted attacks, and suitable for organisations with limited security expertise.
IG2 (74 additional, 130 in total)
For organisations managing IT across several departments with different risk profiles, often with dedicated IT staff.
IG3 (23 additional, all 153)
For organisations with security specialists, sensitive data and exposure to sophisticated, targeted attacks.
Attributes

How each Safeguard is labelled in v8

Asset type
Devices, Applications, Data, Users or Network. Version 8.1 revised these classes.
Security function
Identify, Protect, Detect, Respond or Recover, following NIST CSF 1.1. Version 8.1 adds Govern.

Implementation roadmap

How to implement it, step by step

A practical route for adopting v8, or keeping an existing v8 programme in good order while planning the move to v8.1.

  1. 1

    Choose your Implementation Group

    Decide which group fits your size, data and threat exposure. Most organisations start with IG1 and plan towards IG2.

    OutputsTarget IGScope statement
  2. 2

    Build the asset and software inventories

    Controls 1 and 2 come first because every other Safeguard depends on knowing what is in the environment.

    OutputsEnterprise asset inventorySoftware inventory
  3. 3

    Assess current Safeguards

    Score each Safeguard in your target group as implemented, partly implemented or not implemented, with evidence for each.

    OutputsBaseline assessmentGap list
  4. 4

    Assign owners and prioritise

    Give each gap an owner and a date, starting with IG1 Safeguards and the ones that close the most exposure.

    OutputsPrioritised planNamed owners
  5. 5

    Implement and document processes

    Put the technical Safeguards in place and write the processes that many Safeguards require, such as data management, vulnerability management and incident response.

    OutputsImplemented SafeguardsDocumented processes
  6. 6

    Run recurring Safeguards

    Inventory reviews, account reviews, scans, log reviews and recovery tests must recur. Schedule them so evidence builds up over time.

    OutputsRecurring scheduleOperating evidence
  7. 7

    Measure and report

    Track coverage by Control and Implementation Group, and report progress to management.

    OutputsCoverage reportManagement updates
  8. 8

    Plan the move to v8.1

    Review the CIS v8 to v8.1 change log, update asset classes and mappings, and add the governance Safeguards before changing reports.

    OutputsChange reviewUpdated mappings

Audit and evidence guide

What auditors look for, and the evidence to keep

There is no CIS certification. Organisations assess themselves, often with CIS tools, or ask an independent assessor or internal audit to test implementation. Customers, insurers and regulators may ask for that evidence.

What reviewers look for

  • Complete and current inventories of enterprise assets and software
  • Documented processes behind each Safeguard, reviewed at the stated intervals
  • Account inventories, dormant account removal and restricted administrator rights
  • Multi-factor authentication for external applications, remote and administrative access
  • Patch timeliness and the results of internal and external scans
  • Audit log collection, retention and review
  • Backups that are protected, isolated and actually restored in tests
  • Security awareness training completion
  • Service provider inventory and assessment
  • Incident response roles, contacts and exercises

Examples of Safeguard frequencies

Review the enterprise asset inventory (1.1)At least bi-annually
Validate the account inventory (5.1)At least quarterly
Disable dormant accounts (5.3)After 45 days of inactivity
Internal vulnerability scans (7.5)Quarterly or more often
External vulnerability scans (7.6)Monthly or more often
Audit log retention (8.10)At least 90 days
Test data recovery (11.5)At least quarterly
Review documented processesAnnually or on major change

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Inventories

  • Enterprise asset inventory
  • Software inventory
  • Data inventory
  • Service provider inventory

Configuration

  • Secure configuration standards
  • Configuration review records
  • Firewall settings

Accounts and access

  • Account inventory reviews
  • MFA configuration
  • Access grant and revoke records

Vulnerabilities

  • Scan reports
  • Patch records
  • Remediation tracking

Logging and monitoring

  • Log management process
  • Log review records
  • Alert records

Recovery

  • Backup configuration
  • Recovery test results

People and response

  • Training completion
  • Incident response plan
  • Exercise reports

Areas that often need attention

  • Inventories that are incomplete or not kept up to date
  • Dormant and shared accounts left active
  • MFA not extended to all remote and administrative access
  • Scans run, but findings not remediated
  • Logs collected but never reviewed
  • Backups never test-restored
  • Processes written once and never reviewed

How Netra helps

Where each part of the work lives in Netra

Netra loads CIS Controls v8 as Safeguard-level requirements, tasks and policies. Work done for it also counts towards other frameworks where the same control applies.

Safeguards owned and recurring work scheduled

Task Engine

Safeguards arrive as tasks with owners and due dates, and recurring tasks cover reviews, scans and recovery tests.

Coverage by Control and Implementation Group

Compliance Centre

Status is derived from completed tasks and evidence, never typed in.

Enterprise asset and software inventories

Asset Management

Assets are recorded and linked to the tasks that protect them.

Documented processes

Policy Hub

A policy library generated at onboarding, with a policy score that moves as the work behind each policy is completed.

Gaps treated as risks

Risk Manager

A risk register with inherent and residual heatmaps. Risks reduce as the linked tasks are completed.

Service Provider Management (Control 15)

Third-Party Risk

Vendors found from what Accounts and Purchase pay, assessed through a vendor portal, with decisions and ratings recorded.

Progress reporting

Dashboard & Reports

A live Posture Score and a one-click report per framework for management and the board.

Netra organises the work and evidence for the CIS Controls. It does not by itself establish that Safeguards are effective, and it is not a vulnerability scanner, an endpoint tool or a SIEM. Technical Safeguards are implemented in your own environment.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

CIS v8.1

Give your security safeguards a clear operational home

Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

See CIS v8 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.