CIS Controls
The CIS Critical Security Controls are a prioritized catalog of 18 security controls with 153 concrete individual steps, the so-called safeguards, developed from the analysis of real attacks and freely available. Three implementation groups that build on one another turn them into a roadmap you can work through: from basic protection for small IT teams to defense against targeted attacks.
Why, what and how: where the CIS Controls fit
Before we get to the catalog itself, some context. Law, framework, control catalog: these terms are constantly mentioned in the same breath, even though they answer three different questions. The CIS Controls sit at the very bottom, on the most concrete level. The quickest way to understand this is a single example that runs through all three levels:
Section 30(2) no. 10 BSIG explicitly requires entities in scope to use “solutions for multi-factor authentication or continuous authentication”. Which access paths it applies to, which method to use and how compliance is measured are not in the law.
Article 9(4)(d) DORA requires financial entities to implement “policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems”. The word MFA does not appear even once, and which standard is meant remains open.
Large customers mandate MFA contractually, in security annexes, framework agreements and data processing agreements. This is not a recommendation but a contractual obligation: anyone who does not meet it is out. Which access paths it applies to is usually not stated there either.
Cyber insurers make MFA a condition, typically for remote access, administrative accounts and email. Depending on the provider, it decides the premium, the deductible or whether there is a policy at all. Here, the scope is defined by the insurer, not the legislator.
The CSF states outcome PR.AA-03 as: “Users, services, and hardware are authenticated.” Six words, no method. The same outcome applies to a craft business with twelve computers and to a bank; only the path there differs.
Annex A 8.5 “Secure authentication” requires secure authentication procedures derived from your own access policy; A 5.17 governs the handling of the authentication information itself. Here, too, the goal is stated, not the tool. Which procedure is appropriate is decided by your risk assessment.
MFA for all externally exposed applications, your own and third-party ones, where supported. Enforcement through a directory service or SSO provider explicitly counts as fulfilled. A sentence that can be answered with yes or no.
MFA for all remote access to the enterprise network. Exactly the route real adversaries use most often to get in: a valid password on a VPN gateway without a second factor.
MFA for all administrative accounts on all assets, whether self-operated or run by a service provider. The account an adversary uses to turn a breach into a total loss.
The law establishes the obligation, the framework translates it into an outcome, and the control catalog makes it verifiable. Anyone who only reads the law does not know when they are done. Anyone who only works through the catalog cannot explain why.
This chain works entirely without a certificate. The BSIG requires appropriate measures and their documentation; international standards are to be taken into account, not acquired. Even the obligation to provide evidence under Section 39 BSIG applies only to operators of critical facilities and explicitly allows security audits and inspections in addition to certifications. So if you are not under hard pressure to provide evidence to customers, regulators or insurers, the CIS Controls will get you there faster than a management system: free of charge, prioritized out of the box and with an implementation status that can be demonstrated safeguard by safeguard. How far this route takes you is shown by the effectiveness measurement further down this page.
You need a certificate when someone wants to see one. You need effective security either way.
What are the CIS Controls?
The CIS Critical Security Controls are a prioritized catalog of 18 security controls with 153 concrete individual steps, the so-called safeguards, developed from the analysis of real attacks and freely available. Three implementation groups that build on one another turn them into a roadmap you can work through: from basic protection for small IT teams to defense against targeted attacks.
They are published by the Center for Internet Security (CIS), a nonprofit organization that maintains the controls together with a worldwide community of practitioners, authorities and companies. They were created in 2008 in response to real data losses and were long known as the “SANS Top 20”. The current version 8.1 (2024) comprises 18 controls with 153 safeguards and is aligned with the Govern function of the NIST Cybersecurity Framework 2.0. They are free to use.
The decisive difference from standards catalogs: the CIS Controls are prescriptive. Each safeguard describes a concrete, verifiable measure; not “access is to be restricted appropriately”, but, for example, multi-factor authentication for all externally exposed applications. That makes them a list you can work through with visible progress rather than room for interpretation.
Implementation Groups: not everything, but the right things first
Hardly any organization can implement 153 measures at once, and hardly any has to. The controls therefore come with their own prioritization: three implementation groups (IGs) that build on one another assign each safeguard to a stage. The right group depends on size, risk profile and the data an organization processes.
The starting point is always IG1, which the CIS deliberately calls “Essential Cyber Hygiene”: the minimum every organization needs against the most common attacks. Once you have IG1 under control, you expand to IG2 and IG3 as needed. The result is a roadmap with clear milestones instead of an overwhelming complete list.
Measured against real attacks: the Community Defense Model
Most security catalogs claim effectiveness; the CIS Controls measure it. The CIS Community Defense Model (CDM) breaks down the five most common attack types from industry threat data, namely malware, ransomware, web application attacks, insider misuse and targeted attacks, into the underlying attack techniques according to MITRE ATT&CK. Each safeguard is then mapped against them: which techniques does it prevent or hinder?
The result is remarkable: IG1 alone, the 56 safeguards of basic protection, defends against 77 percent of the ATT&CK techniques found in the five most common attack types. With all safeguards, the figure rises to 91 percent. For ransomware, coverage is 78 and 92 percent respectively. The single most effective safeguard across all five attack types turned out to be secure configuration (Safeguard 4.1): the out-of-the-box state of systems is the adversary’s best friend.
This means the CIS Controls speak the same language as our core approach: Threat-Informed Defense asks which attack techniques are relevant to an organization, and the CIS Controls provide the control catalog whose effectiveness against exactly these techniques has been measured. The threat profile determines which safeguards count first; the controls turn this into a list you can work through.
The 18 controls at a glance
The 18 controls cover the entire lifecycle of defense, from knowing what you are protecting in the first place (Controls 1 and 2) through hardening and access control to detection, recovery and testing your own defenses:
CIS Controls or ISO 27001?
It is the most common question in our consulting work, and it rests on a misunderstanding: the two do not compete, they answer different questions. ISO 27001 is a management system: it governs how an organization manages information security, with risk assessment, policies, responsibilities and certifiable proof. The CIS Controls are a control catalog: they say specifically what needs to be done technically, in what order, and how to measure progress.
| CIS Controls v8.1 | ISO 27001:2022 | |
|---|---|---|
| Character | Prescriptive control catalog: 18 controls, 153 concrete safeguards | Management system (ISMS) with 93 Annex A controls as a framework |
| Prioritization | Built in: three implementation groups, ordered by attack relevance | Must be derived from your own risk assessment |
| Proof of effectiveness | Measured on the basis of ATT&CK (Community Defense Model) | The management system is audited, not the technical effect |
| Certification | None, but a measurable, auditable implementation level | Accredited certification, internationally recognized |
| Cost of the framework | Free | Purchase of the standard, certification audits, ISMS upkeep |
| Typical driver | Real risk reduction, faster visible impact | Customer or regulatory requirement, obligation to provide evidence |
Our position: not every company needs a certified ISMS. If you have no certification obligation, the CIS Controls often get you to real security faster, measurably and without mountains of paper. And if you later do need ISO 27001, you lose nothing: the CIS provides an official mapping of the safeguards to the Annex A controls, so the measures you have implemented count directly toward certification. Conversely, if a customer or regulator demands the certificate, there is no way around ISO 27001, and the CIS Controls become the technical backbone of the ISMS.
How we implement the CIS Controls with you
We start by assessing where you stand: which safeguards are already in place, which are missing, and which implementation group fits the size, risk and data of your organization? If you wish, we sharpen the prioritization with your threat profile: the techniques of your real adversaries then determine which gaps are closed first. Threat-Informed Defense in practice.
We then work through the measures in order of priority, from asset and access management through configuration hardening to logging. You receive a measurable implementation status instead of a binder full of concepts, and, if you wish, proof for customers, insurers or as a preliminary step toward ISO 27001 certification.
Frequently asked questions about the CIS Controls
What are the CIS Controls?
The CIS Critical Security Controls are a prioritized catalog of 18 security controls with 153 concrete individual steps, the so-called safeguards, developed from the analysis of real attacks and freely available. Three implementation groups that build on one another turn them into a roadmap you can work through: from basic protection for small IT teams to defense against targeted attacks. They are published by the nonprofit Center for Internet Security; the current version 8.1 was released in 2024.
What do the CIS Controls cost?
The framework itself is free: the Center for Internet Security makes the controls, safeguards and accompanying documents freely available. The effort comes from implementation: the IT team’s time and, where necessary, tools and external support. For smaller organizations in particular, this is one of the biggest advantages over certification-driven approaches.
What is an implementation group, and which one do we need?
The three implementation groups (IG1 to IG3) are the built-in prioritization of the CIS Controls: IG1 comprises 56 fundamental safeguards for every organization, IG2 extends this to 130 for growing IT environments with regulated data, and IG3 comprises all 153 for organizations targeted by adversaries. The choice depends on size, risk profile and data types; the starting point is practically always IG1.
Is IG1 really enough?
Against the most common attacks, it goes surprisingly far. According to the CIS Community Defense Model, IG1 defends against 77 percent of the ATT&CK techniques of the five most common attack types, and against 78 percent for ransomware. Whether that is enough for your organization depends on your real threat landscape, and that is exactly what a threat profile clarifies: if you are targeted by adversaries, you need more than basic protection.
CIS Controls or ISO 27001: which should we do first?
If no customer and no regulator demands a certificate: the CIS Controls, because they lead to measurable security faster and the framework costs nothing. If there is an obligation to provide evidence, there is no way around ISO 27001; the CIS Controls then become the technical backbone of the ISMS. Thanks to the official mapping to the Annex A controls, no preparatory work is lost if certification is added later.
Can you get certified to the CIS Controls?
There is no accredited certification as there is for ISO 27001. However, the implementation level can be measured cleanly and demonstrated to customers, insurers or auditors, per safeguard and implementation group. For many requests, for example from cyber insurers, this proof is exactly what counts.
Daniel Thomas Heessel was named CISO of the Year 2026 and, as the security lead of an international group of companies, steered security programs along real threats. Daniel is a certified ISO 27001 Senior Lead Auditor, CISSP, CISM and MITRE ATT&CK Defender and therefore knows both sides of the question “CIS Controls or ISO 27001?” from practice.
Reviewed in August 2026. All figures come from the original documents of the Center for Internet Security (v8.1, Community Defense Model 2.0).