SecurityGlobal

CIS v8.1

Give your security safeguards a clear operational home

Coordinate implementation, evidence and recurring reviews across your CIS Controls programme.

Full title
CIS Critical Security Controls Version 8.1
Issued by
Center for Internet Security (CIS), a US non-profit organisation, developed with a global community of practitioners
Published
June 2024. CIS has since issued point-release materials labelled v8.1.2 within the same version.
Applies to
Any organisation, of any size or sector, that wants a prioritised set of defensive actions
Nature
Voluntary best-practice framework. There is no CIS certification.
Structure
18 Controls containing 153 Safeguards, three Implementation Groups, and six security functions including Govern

Overview

What CIS Controls v8.1 is

The CIS Critical Security Controls are a prioritised set of actions that defend against the most common cyber attacks on systems and networks. Each Safeguard is a specific, measurable action that an IT or security team can implement, check and show evidence for. Version 8.1 is the current version, released by the Center for Internet Security in June 2024.

CIS describes v8.1 as an iterative update to CIS Controls v8, designed to keep disruption to existing users low. The 18 Controls, their titles and the Implementation Groups are unchanged. What changed is the way Safeguards are described and labelled: mappings were realigned to NIST CSF 2.0, a Govern security function was added, asset classes were revised and expanded, glossary definitions were added for reserved words such as plan, process and sensitive data, and some Safeguard descriptions were clarified or corrected.

The Govern function is the most visible change. Safeguards that require an organisation to establish and maintain a documented plan, process or policy are now labelled as governance activities. This makes it easier to see which parts of the Controls produce documented evidence of how security is directed, and it lines the Controls up with the Govern function in NIST CSF 2.0.

Implementation Groups still set the order of priority. IG1, essential cyber hygiene, contains 56 Safeguards that every organisation should implement. IG2 and IG3 build on it for larger and more exposed organisations, reaching all 153 Safeguards. CIS has since published materials labelled v8.1.2 as point releases within v8.1, and as of October 2026 no version 9 had been released.

Who it applies to

CIS Controls v8.1 can be adopted by any organisation. It is most often used by:

  • Small and mid-sized organisations that need a clear starting point, usually IG1
  • IT and security operations teams that want concrete, testable actions
  • Managed service providers and MSSPs setting one baseline across many clients
  • Organisations already using NIST CSF 2.0 that want technical Safeguards beneath its outcomes
  • Regulated organisations, including Indian banks and NBFCs, mapping technical hygiene to their own regulatory requirements
  • Organisations answering cyber insurance or customer security questionnaires

The CIS Controls are voluntary. Some US state laws refer to them as a recognised framework, but adoption is generally a choice or a contractual expectation.

Structure

The 18 Controls

Each Control states why it matters and lists its Safeguards. In v8.1 every Safeguard is labelled with an asset class, one of six security functions and its Implementation Groups.

Controls 1–3

Know what you have and what it holds

Control 1: Inventory and Control of Enterprise Assets
Actively manage all enterprise assets connected to the infrastructure, physical, virtual, remote and in the cloud, and address unauthorised and unmanaged assets.
Control 2: Inventory and Control of Software Assets
Keep an inventory of software, make sure only authorised and supported software is installed and can run, and remove or isolate the rest.
Control 3: Data Protection
A data management process, data inventory, classification, access control, encryption, retention and secure disposal of sensitive data.
Controls 4–6

Configure securely and control access

Control 4: Secure Configuration of Enterprise Assets and Software
Documented secure configuration processes for enterprise assets, network infrastructure and software, with default accounts managed and unnecessary services removed.
Control 5: Account Management
An inventory of user, administrator and service accounts, unique passwords, removal of dormant accounts and restricted administrator privileges.
Control 6: Access Control Management
Processes to grant and revoke access, multi-factor authentication for external applications, remote and administrative access, and role-based access control.
Controls 7–10

Find weaknesses and defend the endpoints

Control 7: Continuous Vulnerability Management
A documented vulnerability management and remediation process, automated patching, and internal and external vulnerability scanning.
Control 8: Audit Log Management
A documented audit log management process, with logs collected, stored, protected, reviewed and retained.
Control 9: Email and Web Browser Protections
Supported browsers and email clients, DNS and URL filtering, and email server protections against malicious content.
Control 10: Malware Defenses
Centrally managed anti-malware, automatic signature updates and protections against malicious code on removable media and through exploits.
Controls 11–13

Recover, and run and watch the network

Control 11: Data Recovery
A documented data recovery process, automated and protected backups, an isolated copy of recovery data, and tested recovery.
Control 12: Network Infrastructure Management
Up-to-date network infrastructure, a documented secure network architecture, and secure administration and authentication of network devices.
Control 13: Network Monitoring and Defense
Centralised security event alerting, intrusion detection and prevention, traffic filtering and network-level access control.
Controls 14–16

People, providers and software

Control 14: Security Awareness and Skills Training
A security awareness programme covering social engineering, authentication, data handling and incident reporting, with role-specific training.
Control 15: Service Provider Management
An inventory of service providers, a management policy, classification by risk, security requirements in contracts, and assessment and monitoring.
Control 16: Application Software Security
A secure development process, handling of software vulnerabilities, secure design principles, code review and security testing for in-house and acquired software.
Controls 17–18

Respond and test

Control 17: Incident Response Management
Designated incident handlers, contact information, a documented incident response process, exercises and post-incident reviews.
Control 18: Penetration Testing
A penetration testing programme, periodic external and internal tests, and remediation of findings.
IGs

Implementation Groups

Unchanged from v8. Each group builds on the one before it, and organisations self-select the group that fits their risk and resources.

IG1: essential cyber hygiene (56 Safeguards)
The minimum for every organisation, aimed at general, non-targeted attacks.
IG2 (130 Safeguards in total)
For organisations managing IT across several departments with different risk profiles.
IG3 (all 153 Safeguards)
For organisations with security specialists, sensitive data and exposure to sophisticated attacks.
What changed

Changes from v8 to v8.1

Govern security function
Added alongside Identify, Protect, Detect, Respond and Recover, to align with NIST CSF 2.0. Safeguards that establish documented plans, processes and policies carry this label.
Asset classes
Revised and expanded, with Devices, Software, Data, Users, Network and a new Documentation class, and updated mappings to Safeguards.
Definitions
New and expanded glossary entries for reserved words such as plan, process and sensitive data.
Mappings
Mappings realigned from NIST CSF 1.1 to NIST CSF 2.0.
Wording
Some Safeguard descriptions clarified, and minor errors corrected. CIS publishes a change log listing each difference.

Implementation roadmap

How to implement it, step by step

A practical route for a new v8.1 programme. Organisations moving from v8 can start at step 3 and use the CIS change log to update mappings.

  1. 1

    Choose your Implementation Group

    Decide which group fits your size, data and threat exposure. Most organisations start with IG1 and plan towards IG2.

    OutputsTarget IGScope statement
  2. 2

    Build the asset and software inventories

    Controls 1 and 2 come first because every other Safeguard depends on knowing what is in the environment.

    OutputsEnterprise asset inventorySoftware inventory
  3. 3

    Put the governance Safeguards in place

    Write and approve the plans, processes and policies the Govern-labelled Safeguards require, such as data management, vulnerability management and incident response.

    OutputsDocumented processesApproval records
  4. 4

    Assess current Safeguards

    Score each Safeguard in your target group as implemented, partly implemented or not implemented, with evidence, using the v8.1 definitions.

    OutputsBaseline assessmentGap list
  5. 5

    Assign owners and prioritise

    Give each gap an owner and a date, starting with IG1 and the Safeguards that close the most exposure.

    OutputsPrioritised planNamed owners
  6. 6

    Implement and run recurring Safeguards

    Put technical Safeguards in place, then schedule the inventory reviews, account reviews, scans, log reviews and recovery tests that must recur.

    OutputsImplemented SafeguardsOperating evidence
  7. 7

    Map and report

    Use the NIST CSF 2.0 alignment to report coverage by function to management, and map Safeguards to the other frameworks you follow.

    OutputsCoverage by functionFramework mappings

Audit and evidence guide

What auditors look for, and the evidence to keep

There is no CIS certification. Organisations assess themselves, often with CIS assessment tools, or ask an independent assessor or internal audit to test implementation. With the Govern function, assessors increasingly expect documented processes as well as technical settings.

What reviewers look for

  • Documented, approved and reviewed processes for each Govern-labelled Safeguard
  • Complete and current inventories of enterprise assets, software, data and service providers
  • Account inventories, dormant account removal and restricted administrator rights
  • Multi-factor authentication for external applications, remote and administrative access
  • Patch timeliness and the results of internal and external scans
  • Audit log collection, retention and review
  • Backups that are protected, isolated and restored in tests
  • Security awareness training completion
  • Incident response roles, contacts and exercises

Examples of Safeguard frequencies

Review the enterprise asset inventory (1.1)At least bi-annually
Validate the account inventory (5.1)At least quarterly
Disable dormant accounts (5.3)After 45 days of inactivity
Internal vulnerability scans (7.5)Quarterly or more often
External vulnerability scans (7.6)Monthly or more often
Audit log retention (8.10)At least 90 days
Test data recovery (11.5)At least quarterly
Review documented processesAnnually or on major change

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Governance

  • Approved processes and policies
  • Review and approval history
  • Roles and owners

Inventories

  • Enterprise asset inventory
  • Software inventory
  • Data inventory
  • Service provider inventory

Configuration and access

  • Secure configuration standards
  • Account inventory reviews
  • MFA configuration

Vulnerabilities

  • Scan reports
  • Patch records
  • Remediation tracking

Logging and monitoring

  • Log review records
  • Alert records
  • Retention settings

Recovery

  • Backup configuration
  • Recovery test results

People and response

  • Training completion
  • Incident response plan
  • Exercise reports

Areas that often need attention

  • Technical Safeguards in place but no documented process behind them
  • Mappings and reports still using v8 asset types and CSF 1.1 functions
  • Inventories that are incomplete or not kept up to date
  • Dormant and shared accounts left active
  • Scans run, but findings not remediated
  • Backups never test-restored
  • Service providers not classified or reviewed

How Netra helps

Where each part of the work lives in Netra

Netra loads CIS Controls v8.1 as Safeguard-level requirements, tasks and policies. Work done for it also counts towards NIST CSF 2.0 and other frameworks where the same control applies.

Safeguards owned and recurring work scheduled

Task Engine

Safeguards arrive as tasks with owners and due dates, and recurring tasks cover reviews, scans and recovery tests.

Coverage by Control, function and Implementation Group

Compliance Centre

Status is derived from completed tasks and evidence, never typed in, and one task can satisfy several frameworks.

Govern-labelled plans, processes and policies

Policy Hub

A policy library generated at onboarding, with a policy score that moves as the work behind each policy is completed.

Asset and software inventories

Asset Management

Assets are recorded and linked to the tasks that protect them.

Gaps treated as risks

Risk Manager

A risk register with inherent and residual heatmaps. Risks reduce as the linked tasks are completed.

Service Provider Management (Control 15)

Third-Party Risk

Vendors found from what Accounts and Purchase pay, assessed through a vendor portal, with decisions and ratings recorded.

Drafting processes and finding missing evidence

Netra AI

Netra AI works from the organisation’s own records, suggests missing evidence and drafts SOPs. It never changes status on its own.

One baseline across many clients

Partner Portal

MSSPs and vCISOs manage every client’s CIS programme from one login.

Netra organises the work and evidence for the CIS Controls. It does not by itself establish that Safeguards are effective, and it is not a vulnerability scanner, an endpoint tool or a SIEM. Technical Safeguards are implemented in your own environment.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

CIS v8

Keep essential cyber hygiene owned and evidenced

Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

See CIS v8.1 in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.