CIS Controls v8.1 · Critical security controls
CIS Controls implementation consulting for the safeguards that stop the attacks you are most likely to face.
The CIS Critical Security Controls turn cyber defence into a ranked list of safeguards, so a team with limited time knows what to do first and what can wait. Sterling's expert and experienced consultants choose your Implementation Group with you, put the safeguards into daily operation and leave you with evidence a customer, insurer or board can test. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cybersecurity consultants, advising on security programmes across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify, and no certificate exists for the CIS Controls
8,100+ client engagements in 60+ countries.
CIS Controls client experience
What it is
What are the CIS Controls and what are they used for?
The CIS Critical Security Controls are a set of cyber defence practices published by the Center for Internet Security, a non-profit organisation. They are organised by activity into 18 Controls, broken down into 153 Safeguards, and are free for any organisation to use on its own security.
Their value lies in the ordering: three Implementation Groups let a small organisation start with the essentials and a larger one see what lies beyond. Security teams use them as a work plan, insurers as a yardstick, and many organisations as the technical layer beneath NIST CSF 2.0 or ISO/IEC 27001; CIS maps the Controls to both.
Current edition. CIS Controls v8.1, released in June 2024. It updates version 8 of May 2021 with the Govern security function from NIST CSF 2.0, revised asset classes and clearer Safeguard wording.
Who it is for
Who needs to implement the CIS Controls?
The CIS Controls are voluntary, but they appear wherever someone wants proof of basic cyber hygiene. Most enquiries begin with one of four prompts:
- A customer's security questionnaire names them. Enterprise buyers often ask which Implementation Group you meet and how you know.
- A tender or cyber insurance application asks for them. Answers on the form need evidence if a claim follows.
- A regulator or sector body points to recognised good practice. The Controls show that technical safeguards exist and operate.
- A parent company or group security team adopts them. Subsidiaries report against the same Safeguards.
Requirements
What are the main CIS Controls requirements?
The requirements are the Safeguards inside the 18 Controls. Implementation Group 1, which CIS calls essential cyber hygiene, holds 56 Safeguards; IG2 adds 74 for enterprises with more complex environments; IG3 adds the last 23, completing all 153. The Controls, at title level:
- 1. Inventory and Control of Enterprise Assets: every device on your network, known.
- 2. Inventory and Control of Software Assets: only authorised software runs.
- 3. Data Protection: data classified, handled and disposed of securely.
- 4. Secure Configuration of Enterprise Assets and Software: hardened settings, maintained.
- 5. Account Management and 6. Access Control Management: access granted, reviewed and removed.
- 7. Continuous Vulnerability Management: find and fix weaknesses on a cycle.
- 8. Audit Log Management: logs collected and reviewed.
- 9. Email and Web Browser Protections and 10. Malware Defenses: the usual routes in.
- 11. Data Recovery: backups proven by restores.
- 12. Network Infrastructure Management and 13. Network Monitoring and Defense: a managed, watched network.
- 14. Security Awareness and Skills Training: staff who spot and report attacks.
- 15. Service Provider Management: suppliers holding your data.
- 16. Application Software Security: secure software, built or acquired.
- 17. Incident Response Management and 18. Penetration Testing: a rehearsed response and tested defences.
What does useful CIS Controls evidence look like?
An inventory that matches what the network sees, baselines with exception records, signed access reviews, scan results showing what was fixed and when, a timed restore test and an incident exercise with its lessons acted on.
Implementation
How do you implement the CIS Controls?
With no certification body, the route ends in proof: a defensible self-assessment, or an independent assessment where someone asks for one.
- 01Set the scope and the target Implementation Group.Agree the networks, cloud services and data in scope, and whether IG1, IG2 or IG3 fits your risk.
- 02Gap analysis: each Safeguard against how you work today.We test what is really in place and record gaps with owners and priority.
- 03Implement the Safeguards in priority order.Inventories and configuration first, then access, vulnerabilities, logging and recovery, with records kept as you go.
- 04Check it internally and report to management.Internal audit tests each Safeguard against its evidence; management funds what remains open.
- 05Self-assess, or commission an independent assessment.Record your implementation, for example in the CIS Controls Self Assessment Tool, and bring in an independent assessor if an outside opinion is needed.
Check the route before you sign. CIS does not certify organisations against the Controls, so treat any "CIS certified" certificate with suspicion. CIS runs CIS Controls Accreditation for service providers who implement, audit or assess against the Controls; if you want an independent assessor, ask whether the firm is accredited and confirm it on cisecurity.org. The certification buyer's checklist
Cost
How much does CIS Controls implementation cost?
The Controls are free to use. The budget goes on implementation, any tools the Safeguards need and, optionally, an outside assessment.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Target Implementation Group, current maturity, environments in scope, and whether you choose Design™ or Drive™ |
| Independent assessment, if you want one | Scope, sites and sampling, quoted separately by the assessor you appoint |
| Security tooling | Any inventory, scanning, logging or backup tools the gap analysis shows you lack |
| Your team's time | IT and system owners configuring, reviewing and producing evidence |
| Software and learning | Effivity and Sterling Academy access, itemised at no additional cost |
What moves the price
- IG1 alone, or IG2 and IG3 on top
- On-premises, cloud and remote estates in scope
- Sites, entities and headcount
What a Sterling proposal always shows
- Deliverables, assumptions and exclusions in writing
- Milestones linked to Safeguards delivered
- One all-inclusive proposal for our work
Timeline
How long does CIS Controls implementation take?
The pace is set by the target group and by how much of your estate is unknown: without an asset inventory, the first weeks go on finding out what you own. As an estimate, IG1 usually takes three to six months, with IG2 and IG3 in later phases.
| Phase | What sets the pace |
|---|---|
| Scope and gap analysis | Access to system owners, consoles and existing records |
| Safeguard roll-out | Change windows, procurement lead times and IT capacity |
| Operating period | Enough weeks of running to show scans, reviews and restores happen |
| Assessment | Self-assessment effort, or the independent assessor's calendar |
Your engagement
What your CIS Controls engagement includes
Every engagement runs on Sterling OS™. Sterling does not certify, and no certificate exists for the CIS Controls: any independent opinion comes from the assessor you appoint.
Design™: guided support
Your IT team implements the Safeguards; a Sterling consultant sets priorities, reviews evidence and coaches owners.
Drive™: managed support
The alternative to Design™ for stretched teams: Sterling drafts policies and baselines with your owners and runs the programme.
Sustain™: after implementation
Safeguard checks, internal audits, exercises and support when CIS releases a new version.
Automate™: Effivity
Your security programme runs in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Assessment opinions remain with the independent assessor.
Often combined with
Standards organisations pair with CIS Controls
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
- DORADORA compliance consulting for EU financial entities and ICT providers: ICT risk, incident reporting, resilience testing and third-party risk, evidenced.
Effivity · security management software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of CIS Controls v8.1.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. For a CIS Controls client, your consultant configures the security workspace within the agreed scope: policies and procedures, risks, audits, nonconformities, incidents, supplier evaluations, training records, KPIs and management review in one place. Your technical tools still do the scanning, logging and backing up; Effivity holds the programme around them, so each Safeguard has an owner, a record and a review date. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Scope and asset records
The environments, entities and asset classes in scope, recorded once and reviewed when the estate changes.
Policies and data handling rules
Classification, retention and disposal rules under version control, with owners and review dates.
Baselines and exceptions
Approved configuration standards and every exception to them, with its reason, approver and expiry.
Access reviews
Periodic reviews assigned to system owners, completed and signed inside the platform.
Findings to closure
Findings raised as actions with owners and dates, followed until the fix is confirmed.
Training records
Completion by team and role, linked to Sterling Academy, ready to show at assessment.
Supplier evaluations
Security expectations and evaluations for the providers that hold or process your data.
Incidents, exercises and lessons
Incidents and exercise results logged, investigated and turned into corrective actions that are checked.
What this means at the assessment
An assessor sampling Control 5 will ask for the last access review and what happened to the accounts it flagged. With Effivity, the review, the actions raised and their closure are already linked and dated.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for QMS, EMS, OHSMS, FSMS and more when you integrate other standards
Sterling Academy · security e-learning
Make every employee part of Control 14, not just the IT team.
Sterling Academy offers video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness training that teaches staff to spot and report phishing and social engineering
- Internal auditor training, as applicable to your standard, as part of the engagement
- Completion reports by team, usable as training evidence
- New joiners trained in their first weeks, so coverage never slips
Keep exploring
Explore more about CIS Controls
CIS Controls resources
Services for CIS Controls
Why Sterling
Want a successful CIS Controls implementation? Come to Sterling.
The Controls are easy to read and hard to sustain. Sterling ties each Safeguard to an owner and a record, with one engagement team accountable.
60+ countries since 2003
Security programmes across sectors, with offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; any independent assessment shown separately.
One set of Safeguards, several frameworks
Safeguards mapped to ISO/IEC 27001, NIST CSF 2.0 or SOC 2, so one set of evidence serves each.
Expert and experienced consultants
Security specialists who look at your consoles and logs before they look at your policies.
The Sterling Promise
What our CIS Controls implementation success guarantee means
We stay with you until your agreed CIS Controls outcome is achieved, through implementation, the operating period and the closure of any assessment findings.
The engagement identifies the framework, Implementation Group, scope, outcome and responsibilities. Your organisation supplies accurate information and operates the agreed Safeguards. Any independent assessor forms and retains its own opinion. Our commitment concerns the agreed consulting support, not a promise of every future contract award or flawless performance.
FAQs
Frequently asked questions about the CIS Controls
Which CIS Controls Implementation Group should we start with?
Start with IG1. CIS describes it as the baseline every enterprise should apply; move to IG2 when your data, departments or regulators demand more.
Are the CIS Controls free to use?
Yes, for your own organisation's security; the cost lies in implementing them, not in the document.
How do the CIS Controls relate to ISO/IEC 27001?
They complement it. ISO/IEC 27001 is a certifiable management system; the CIS Controls are a prioritised set of technical and operational safeguards that CIS maps to the ISO 27000 series.
How can we prove CIS Controls compliance to a customer or insurer?
With evidence and, where needed, an independent opinion: a self-assessment shows status by Safeguard, and an assessor's report adds an outside view.
What is the difference between CIS Controls and CIS Benchmarks?
The Controls say what to do across your whole security programme; the Benchmarks are CIS's detailed secure configuration guides for specific technologies. Benchmarks are a common way to meet the secure configuration Safeguards in Control 4.
Keep exploring
More on CIS Controls and related standards
More in Information security, cyber & cloud
Talk to a consultant
Put the CIS Controls to work, starting with the Safeguards that matter most.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice