CIS Controls v8 vs v8.1
CIS Controls v8.1 is an iterative update to v8. CIS says it realigns mappings to NIST CSF 2.0, expands glossary definitions and clarifies selected Safeguards while preserving the overall 18-Control/153-Safeguard model.
A Control groups a security objective; a Safeguard is a specific defensive action. Implementation Groups prioritize Safeguards for different risk/complexity profiles.
The 18 CIS Controls
| # | Control |
|---|---|
| 1 | Inventory and Control of Enterprise Assets |
| 2 | Inventory and Control of Software Assets |
| 3 | Data Protection |
| 4 | Secure Configuration |
| 5 | Account Management |
| 6 | Access Control Management |
| 7 | Continuous Vulnerability Management |
| 8 | Audit Log Management |
| 9 | Email and Web Browser Protections |
| 10 | Malware Defenses |
| 11 | Data Recovery |
| 12 | Network Infrastructure Management |
| 13 | Network Monitoring and Defense |
| 14 | Security Awareness and Skills Training |
| 15 | Service Provider Management |
| 16 | Application Software Security |
| 17 | Incident Response Management |
| 18 | Penetration Testing |
Sequence dependencies: asset/software knowledge and identity foundations usually come before advanced detection and testing.
Implementation Groups
| Group | Safeguards | Purpose |
|---|---|---|
| IG1 | 56 | Essential cyber hygiene for every enterprise |
| IG2 | 130 total | Adds 74 for greater complexity/sensitive data |
| IG3 | 153 total | Adds final 23 for high-risk/sophisticated-threat environments |
Groups are cumulative. IG2 includes IG1; IG3 includes everything.
IG1: Essential Cyber Hygiene
IG1 prioritizes practical foundations: inventories, secure configuration, account/access control, vulnerability management, backups, malware defenses, logging and incident readiness. Evidence should be operational—for example reconciled cloud inventories rather than a spreadsheet updated annually.
IG2
IG2 is intended for organizations with dedicated IT/security responsibility, multiple departments and more sensitive/regulated data. It adds rigor around service providers, networks, monitoring and operational security.
IG3
IG3 is intended for organizations facing sophisticated adversaries or high public/mission impact. It adds the final 23 Safeguards and usually requires specialized security skills, deeper testing and mature architecture—not just more tools.
Implementation Method
- Select target IG based on threat/data/complexity.
- Baseline current Safeguard status.
- Sequence dependencies.
- Assign accountable owners.
- Define evidence for each implemented Safeguard.
- Track exceptions and coverage.
- Reassess as environments/threats change.
Examples of Evidence
| Area | Evidence |
|---|---|
| Assets/software | CMDB/cloud discovery + ownership |
| Accounts/access | Identity inventories and access reviews |
| Vulnerability | Coverage, SLA and remediation evidence |
| Logs | Source inventory, retention, detection coverage |
| Backups | Configuration + restore tests |
| Application security | SDLC, dependency testing, code/runtime findings |
| Providers | Supplier inventory/assessments/contracts |
| IR | Plan, exercises and corrective actions |
CIS Controls and API Security
API security spans inventory, access, secure configuration, application security, logging, incident response and provider management. No single CIS Control owns 'API security.'
Related Ammune reading: API security checklist for 2026 and API security CI/CD pipeline.
How to Select the Right Implementation Group
Implementation Groups are a prioritization mechanism, not security labels that should be chosen for marketing reasons. Start by understanding the data and services the organization must protect, the skills and staffing available, the consequences of disruption, legal/contractual duties and the sophistication of likely adversaries.
IG1 is the minimum starting point for every enterprise. Moving to IG2 is appropriate when the organization has dedicated operational/security responsibility, handles more sensitive data and has enough complexity that informal processes no longer scale. IG3 is aimed at environments where sophisticated targeted attacks or major public/mission impact justify the full Safeguard set.
| Question | If yes, consider |
|---|---|
| Do we lack reliable asset/software inventories or basic access control? | Finish IG1 foundations first |
| Do we run multiple departments/cloud environments with sensitive data? | IG2 is often a better target |
| Would compromise materially affect public safety, national/economic interests or critical services? | Evaluate IG3 |
| Are we choosing advanced tooling while basic Safeguards remain incomplete? | Re-sequence toward lower-group dependencies |
| Do regulatory/customer obligations demand controls beyond selected IG? | Add those requirements; IG does not override obligations |
Use CIS Benchmarks and vendor hardening guides as configuration-level companions where relevant, but do not confuse a benchmark with the CIS Controls program. Benchmarks answer 'how should this product be configured?' while Controls/Safeguards answer 'which defensive practices should the enterprise implement?'
How to Measure CIS Safeguard Coverage
A Safeguard should not be marked complete merely because a policy or product exists. Measure coverage, enforcement and exceptions. Asset inventory can be reconciled against cloud and endpoint discovery; MFA can be measured against all in-scope identities; vulnerability management can be measured by scan coverage and remediation age.
| Area | Weak metric | Stronger metric |
|---|---|---|
| Assets | Inventory document exists | % discovered assets with owner and lifecycle state |
| MFA | MFA enabled somewhere | % in-scope accounts enforced + exceptions |
| Vulnerabilities | Scanner deployed | Coverage + critical remediation time + overdue risk |
| Logging | SIEM purchased | % critical sources ingested, retained and monitored |
| Backups | Jobs configured | Restore tests against recovery objectives |
This evidence-driven approach makes progress from IG1 toward IG2/IG3 easier to govern because the enterprise can see which foundational Safeguards actually operate.
CIS Controls Dependencies: What to Implement First
The numbered Controls are not a strict project plan, but some capabilities depend heavily on others. Advanced monitoring is difficult when assets are unknown; access reviews are unreliable when account ownership is unclear; vulnerability metrics are misleading when scan coverage is incomplete.
| Foundation | Enables |
|---|---|
| Enterprise and software inventories | Vulnerability coverage, secure configuration, incident scoping |
| Account and access management | Privileged control, MFA coverage, attribution |
| Secure configuration | Stable baselines and meaningful drift detection |
| Audit-log management | Network monitoring, detection and incident investigation |
| Service-provider inventory | Third-party risk and incident coordination |
| Application security lifecycle | Repeatable prevention and remediation of software risk |
Use dependencies to sequence remediation, especially in IG1. Buying an advanced detection platform before establishing inventories and identities usually creates visibility without reliable context.
CIS Controls Checklist
- Use v8.1 as current baseline.
- Choose IG1/IG2/IG3.
- Implement IG1 foundations first.
- Assign owners.
- Define evidence.
- Track cloud/SaaS coverage and exceptions.
- Map tools to Safeguards without equating tools with effectiveness.
- Test backups, detection and IR.
- Review providers.
- Reassess target IG periodically.
Frequently Asked Questions
What is the current CIS Controls version?
CIS Controls v8.1 is current.
How many Safeguards are there?
153.
How many are in IG1?
56 Safeguards.
What is IG2?
IG2 includes IG1 and adds 74 Safeguards for 130 total.
What is IG3?
IG3 includes all 153 Safeguards.
Primary References
Map Runtime API Security Into Your CIS Controls Program
Use Implementation Groups to prioritize enterprise safeguards and connect API inventory, monitoring and threat evidence to the controls you measure.