CIS Controls
The CIS Controls (formerly Critical Security Controls) are a prioritized set of actions developed by the Center for Internet Security (CIS) to protect organizations from the most common cyber attacks. They provide a practical, actionable approach to cybersecurity — focusing on the controls that have the greatest impact on reducing risk. The CIS Controls v8 consolidates 18 controls with implementation groups that scale to an organization's size and resources.
Key Components
Implementation Groups (IGs)
Three implementation groups (IG1, IG2, IG3) that scale the controls based on organizational size and risk profile — IG1 for small organizations, IG2 for medium, IG3 for large or high-risk.
Inventory and Control of Enterprise Assets (CIS-1)
Know what assets exist and manage them — the foundation for all other controls.
Inventory and Control of Software Assets (CIS-2)
Know what software is running and manage it to prevent unauthorized or vulnerable software.
Secure Configuration of Enterprise Assets and Software (CIS-4)
Establish and maintain secure configurations for all assets and software.
Account Management (CIS-5)
Manage accounts and access to prevent unauthorized use and ensure accountability.
Access Control Management (CIS-6)
Control access to data and systems based on need-to-know and least-privilege principles.
Continuous Vulnerability Management (CIS-7)
Identify and remediate vulnerabilities on an ongoing basis.
Audit Log Management (CIS-8)
Collect, store, and analyze logs for detection, investigation, and forensics.
Email and Web Browser Protections (CIS-9)
Protect against email and web-based attacks.
Malware Defenses (CIS-10)
Prevent and detect malware infections and lateral movement.
Data Recovery (CIS-11)
Ensure data can be recovered after an incident.
Network Monitoring and Defense (CIS-12)
Monitor and defend networks against attacks.
Security Awareness and Skills Training (CIS-14)
Ensure people have the knowledge and skills to maintain security.
Incident Response Management (CIS-17)
Establish and maintain an incident response process.
Penetration Testing (CIS-18)
Test defenses through simulated attacks.
Benefits
- Practical, prioritized controls focused on the most common and damaging attacks
- Scales to organizations of all sizes through Implementation Groups
- Maps to NIST CSF, ISO 27001, and other frameworks for unified compliance
- Community-driven and continuously updated based on real-world threat data
- Provides clear, actionable steps rather than abstract principles
How MPG Helps
MPG's Cyber Governance module maps your controls to CIS Controls v8, tracks implementation status by Implementation Group, conducts gap assessments, and manages remediation. Vulnerability tracking, incident management, and audit trail features directly support CIS Controls implementation. The governance knowledge graph connects CIS controls to your risks, policies, and compliance obligations.
Educational Content
This page provides educational information about CIS Controls. MPG does not provide legal or regulatory advice. Always consult qualified professionals and the official framework documentation for specific compliance requirements.