Our AI strategy for preemptive security
The Center for Internet Security (CIS) is a nonprofit that develops practical cybersecurity resources for public- and private-sector organizations.
A cybersecurity framework is a structured set of guidelines, best practices, standards, and methodologies designed to help organizations manage and mitigate cybersecurity risks effectively. These frameworks serve as a blueprint for organizations to establish, implement, and improve their security posture, overall cybersecurity posture and readiness, and continuous improvement of that posture. This structure provides measurable threat prevention by forcing organizations to tackle the highest‑frequency attack patterns first.
There are several cybersecurity frameworks available, developed by various organizations and governments, widely adopted by government entities, enterprises, and the nonprofit sector alike, each with its own focus, approach, and target audience. Unlike many standalone cybersecurity standards, the CIS Controls prescribe exactly how to implement each requirement, not just what to do. These frameworks are not mutually exclusive, and organizations often choose to adopt elements from multiple security frameworks based on their specific needs, industry regulations, regulatory requirements, and business goals. A cybersecurity framework gives organizations a systematic way to manage cyber risk. It supports identifying, protecting against, detecting, responding to, and recovering from cyber threats across cloud computing, hybrid environments, operating systems, network architecture, and applications. When executed well, it transforms abstract guidance into day‑to‑day cyber threat prevention actions that block adversaries early.
The CIS Controls v8.1 are a prescriptive, prioritized set of safeguards that help organizations defend systems, networks, enterprise assets, and sensitive data from common cyber attacks. The Center for Internet Security maintains the framework with input from global cybersecurity practitioners. Teams can use the Controls alongside the NIST Cybersecurity Framework (CSF), NIST Special Publication 800-53, and ISO 27001 to turn broad security objectives into practical actions.
The CIS Framework helps organizations better anticipate shifts in the threat landscape and assess threats and rapidly adapt to new advanced threats. By prioritizing Safeguards in order of risk, the Controls shrink an organization’s overall attack surface in measurable increments. As a result, your security operations center can better share information and ultimately faster select and implement the best defensive mitigations. It is also essential that cyber defenders can share their tools.
First released by SANS in 2008 as the Consensus Audit Guidelines, the framework was later transferred to the Center for Internet Security. Today, the CIS Controls turn high-level cybersecurity objectives into prioritized safeguards that teams can implement and measure.
It might surprise you that in 2008 the very first version of the framework was known as the Consensus Audit Guidelines. Many other names and acronyms describe the framework. You may have heard of it as the CIS Critical Security Controls (CSC), the SANS Top 20, and more. More important is that the CIS CSC is widely used today because it translates broad objectives from frameworks like NIST CSF into concrete, prioritized safeguards.
Rather than asking teams to treat every security measure equally, CIS prioritizes safeguards that are practical, measurable, and informed by common attacker behavior. This helps teams focus on the actions most likely to reduce risk, measure coverage, and improve their cybersecurity program over time.
CIS Controls v8.1 contains 18 Controls and 153 Safeguards. These Safeguards provide a prioritized path for protecting systems, software, enterprise assets, and sensitive data. You will find that each of these security controls, in turn, consists of various sub-controls. All of these together support the five crucial areas defined above. The broad set of capabilities offered by the CIS CSC provides your cyber defense team with one of the best practices available to identify, meet, and defeat dangerous cyber attackers and their tools.
Organizations start by selecting an Implementation Group (IG) based on their risk profile and available resources. Each IG identifies a prioritized set of safeguards, allowing teams to begin with essential cyber hygiene and expand coverage as their security program matures.
The criteria for the self-classification include how the data used by the organization must be managed, the relative sensitivity and privacy required by that data, and the available services that must be offered and delivered by that organization. Further, the specific technical capabilities of the organization’s cybersecurity team may limit the ability of any organization to implement certain types of controls and the complex automation and integration that they require. Funding and available personnel are also critical limiting factors to be considered carefully. Finally, the CIS Controls Framework requires that organizations perform a risk assessment – it is preferred that organizations use the risk model provided by CIS. The CIS calls its model the CIS Risk Assessment Model (RAM).
CIS Control user organizations must self-select their implementation group. There are three implementation groups as follows:
Teams can use their selected IG to prioritize asset inventory, secure configuration management, access control, audit log management, and continuous vulnerability management.
CIS Controls v8.1 is organized around 18 Controls and their Safeguards, rather than the Basic, Foundational, and Organizational categories used in earlier versions. Teams prioritize implementation through IG1, IG2, and IG3 based on risk and available resources. Together, the Controls span enterprise asset and software inventory, data protection, access control, continuous vulnerability management, audit logs, incident response, and penetration testing.
The 18 controls are:
At a practical level, Safeguards can include protecting credentials with multi-factor authentication and privileged access control, using encryption to protect sensitive data, maintaining secure configuration management, reviewing firewall and network settings, and using a vulnerability scanner to identify issues for remediation and security assessment.
CIS has published mappings between the CIS Controls and Safeguards and MITRE Enterprise ATT&CK. These mappings help defenders compare their defensive priorities with known adversary techniques.
Modern systems expand the attack surface across cloud computing, hybrid environments, remote work, mobile devices, Internet of Things deployments, and third-party services. During cloud migrations, teams may need to account for AWS accounts, VPCs, security groups, Kubernetes clusters, cloud provider APIs, and Windows Server environments alongside traditional infrastructure. Consistent asset inventory and configuration management help reduce those vulnerabilities as AI-driven threats evolve.
CISOs are struggling to protect their organizations. For many boards, this also demonstrates tangible progress toward mandated cybersecurity compliance benchmarks. The CIS Controls Framework provides the guidance and scale they need to scale up more effective protection. In addition, they need to move quickly to protect their enterprise’s brand and reputation. As a result, CIS compliance will bring compelling value to most commercial and government organizations. Practitioners pursuing GIAC Certification reference the Controls as a hands‑on study framework.
Want to learn more? Check out our FREE Bugcrowd University to sharpen your hacking skills.
Organizations the world over need your help! Join our researcher community to connect with hundreds of organization programs focused on finding their security vulnerabilities. Our vast directory includes programs for all skill levels, across many industries and from around the world.
What is the Center for Internet Security (CIS)?
The Center for Internet Security is a nonprofit organization focused on improving cybersecurity globally through collaboration and innovation. It provides a suite of best practice solutions, tools, and services to secure organizations against cyber threats.
What are the CIS Controls?
The CIS Controls are a set of best practices and actions for cyber defense that help organizations prevent and respond to cybersecurity threats. These controls prioritize actions in a way that provides clear guidance to improve an organization’s security posture.
Who can benefit from CIS resources?
CIS resources are beneficial to a wide range of audiences, including small to medium-sized businesses, large enterprises, government agencies, and educational institutions looking to enhance their cybersecurity strategies.
How do CIS Controls contribute to cybersecurity today?
By providing a prioritized set of actions and practices, CIS Controls help organizations to systematically protect themselves against cyber threats, ensuring a more secure environment for data management and network usage.
What is the CIS Benchmarks?
The CIS Benchmarks are consensus-based, globally recognized standards for securing IT systems and data against cyber attacks. They are developed through a process involving cybersecurity professionals and practitioners from various industries.
Why are CIS Benchmarks important?
CIS Benchmarks provide detailed configuration guidelines for securely setting up IT systems, which help organizations mitigate the risk of security breaches and ensure compliance with industry and regulatory standards.
How does CIS help in developing cybersecurity policies?
CIS offers frameworks and guidelines that organizations can reference when developing internal cybersecurity policies, ensuring these policies are comprehensive, robust, and up to standard with current cyber threats.
What is the Multi-State Information Sharing and Analysis Center (MS-ISAC)?
MS-ISAC is a division of CIS offering support to state, local, tribal, and territorial (SLTT) governments in the United States. It provides threat intelligence, incident response, and cybersecurity best practices.
How does the CIS SecureSuite Membership work?
The CIS SecureSuite Membership provides organizations with access to advanced resources and tools, including automated configuration assessment tools, CIS Controls Pro, and other valuable cybersecurity materials.
What is the role of CIS in election security?
CIS plays a crucial role in election security by working with election officials to ensure the integrity, availability, and confidentiality of election systems. They offer resources, guidelines, and technical support to secure the electoral process.
How can organizations implement CIS Controls and Benchmarks?
Begin with an accurate inventory of enterprise assets and software, then select the appropriate Implementation Group. Prioritize safeguards such as multi-factor authentication, privileged access control, secure configuration management, audit log management, and continuous vulnerability management. A vulnerability scanner and regular penetration testing can validate whether controls are working as intended.
What are the challenges in adopting CIS Controls?
Some of the challenges include resource constraints, lack of expertise, and the complexity of integrating new practices into existing IT environments. However, CIS provides guidance and assistance to help overcome these barriers.
Is CIS alignment recognized in compliance standards?
CIS Controls are mapped to and referenced by multiple legal, regulatory, and policy frameworks, but CIS alignment is not a certification or a substitute for meeting an organization’s specific regulatory requirements. Organizations subject to the Health Insurance Portability and Accountability Act (HIPAA), GDPR, or the European Union’s NIS2 Directive can use the Controls as an operational baseline, then map safeguards and evidence to their applicable obligations.
How do CIS Controls help address common cyber threats?
By improving asset inventory, protecting credentials, securing configurations, monitoring vulnerabilities, and testing defenses, CIS Controls help reduce opportunities for ransomware, business email compromise, third-party attacks, and other cyber incidents. They also help teams reduce shadow IT and alert fatigue by improving visibility, prioritization, and threat protection.
What role does community play in developing CIS resources?
CIS resources are developed through a community consensus process involving IT security professionals and cybersecurity practitioners. That community-driven approach helps CIS keep its safeguards, asset classes, and best practices relevant as software, cloud environments, and threats evolve.
By using the recommended CIS resources, best practices, and community support, organizations strengthen their cybersecurity infrastructure, making it more resilient against current and future cyber threats.
Center for Internet Security: CIS Controls v8.1 Center for Internet Security: The 18 CIS Critical Security Controls Center for Internet Security: Implementation Groups NIST Cybersecurity Framework 2.0
Security programs do not improve by policy alone. When CIS Controls identify vulnerabilities that need real-world validation, Bugcrowd Pen Testing as a Service helps teams test the effectiveness and resiliency of their enterprise assets.
Get started with Bugcrowd
Hackers aren’t waiting, so why should you? See how Bugcrowd can quickly improve your security posture.