The CIS Critical Security Controls are a prioritised set of defensive actions that stop the most common attacks. Version 8 has 18 controls. Each is broken into safeguards, and three Implementation Groups let a small organisation start with essential hygiene and add more as it grows. This list covers the 18 controls.
Free account needed to download. You come straight back to the file.
Who it is for. Organisations of any size that want a practical, ordered baseline, and teams that need to show customers or insurers a recognised set of controls without a full certification.
What this list covers. CIS Critical Security Controls v8, the 18 controls (safeguards not listed): 18 controls. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it asks for |
|---|---|---|
| CIS 1 | Inventory and control of enterprise assets | Know every device on the network, managed or not, and act on the ones you did not expect. |
| CIS 2 | Inventory and control of software assets | Know what software runs where, allow only what is authorised, and remove or block the rest. |
| CIS 3 | Data protection | Know what data you hold and how sensitive it is, then protect it with access limits, encryption, retention rules and secure disposal. |
| CIS 4 | Secure configuration of enterprise assets and software | Set a secure baseline for devices, software and accounts, apply it everywhere and correct drift. |
| CIS 5 | Account management | Manage the whole life of user, administrator and service accounts, and disable the ones nobody uses. |
| CIS 6 | Access control management | Give each account only the access its role needs, strengthen sign-in with multi-factor authentication and control access centrally. |
| Ref | Control | What it asks for |
|---|---|---|
| CIS 7 | Continuous vulnerability management | Scan internal and external assets on a schedule, rank what you find and fix it within set times. |
| CIS 8 | Audit log management | Collect, time-synchronise, protect, keep and review logs so you can detect and investigate incidents. |
| CIS 9 | Email and web browser protections | Limit browsers and email clients to supported, filtered use, with URL, DNS and anti-phishing controls. |
| CIS 10 | Malware defenses | Prevent, detect and respond to malicious software on every endpoint, and control removable media. |
| CIS 11 | Data recovery | Back up in-scope data, protect the backups and test restores so recovery works when needed. |
| CIS 12 | Network infrastructure management | Keep network devices documented, updated and securely configured, with a separate management network. |
| CIS 13 | Network monitoring and defense | Watch and filter network traffic for threats, with alerting and a response path. |
| CIS 14 | Security awareness and skills training | Train staff in the habits and threats that matter to their role, and repeat it. |
| CIS 15 | Service provider management | List your service providers, assess them, and contract for the security you need from them. |
| Ref | Control | What it asks for |
|---|---|---|
| CIS 16 | Application software security | Build, buy, test and fix in-house and third-party applications securely, across their whole life. |
| CIS 17 | Incident response management | Have a plan, named roles, contacts and regular exercises for handling incidents. |
| CIS 18 | Penetration testing | Test your defences by simulating attacks, and fix what the tests show. |
Groups 1, 2 and 3. Group 1 is essential cyber hygiene for any organisation. Group 2 adds safeguards for organisations with more staff, data and regulatory exposure. Group 3 is for those that face determined attackers.
The Controls say what to do across the organisation. The Benchmarks are detailed hardening guides for one product, such as a particular operating system or firewall.
No. You can map your own controls to it and report progress, but no body certifies against it.
No, it stops at the 18 controls. The Center for Internet Security publishes the full safeguards and the Implementation Group each belongs to.