CIS Controls v8: A Practical Implementation Guide

Why the CIS Controls

The CIS Controls stand apart from other security frameworks for a specific reason: they are explicitly prioritised by expected impact on reducing security risk. While other frameworks describe comprehensive catalogues of security practices, the CIS Controls are ordered by implementation priority — controls implemented first provide the most significant risk reduction for most organisations.

Version 8 reorganised the controls around activities and outcomes and explicitly mapped controls to enterprise, small business, and individual implementation groups.

The Three Implementation Groups

IG1 (Essential) covers 56 safeguards across 18 controls that every organisation should implement — "basic cyber hygiene." For small organisations without dedicated security staff, IG1 is the realistic target.

IG2 (Foundational) adds 74 additional safeguards appropriate for organisations with a dedicated security function and greater attack surface.

IG3 (Organisational) covers all 153 safeguards for organisations with mature security programmes facing sophisticated adversaries.

Control Implementation Priorities

Controls 1-3: Basic Asset Management

The first three controls — Inventory of Enterprise Assets, Inventory of Software Assets, and Data Protection — establish the foundation everything else builds on. You cannot secure what you don't know about.

The most common implementation failure: assuming existing asset management processes are sufficient. Most organisations discover significant gaps — unmanaged endpoints, unlicensed software, forgotten cloud resources, data in undocumented locations.

Controls 4-6: Access Control Fundamentals

Secure Configuration of Enterprise Assets, Account Management, and Access Control Management address access control hygiene preventing the majority of commodity attacks.

Key implementation points: eliminating default credentials on all network infrastructure, ensuring every privileged account has MFA, and implementing least privilege for all user and service accounts.

Controls 7-9: Vulnerability and Log Management

Continuous Vulnerability Management means scanning and addressing findings on an ongoing cadence — not an annual penetration test and nothing in between. Audit Log Management means centrally aggregated, tamper-protected logs retained sufficiently long to support incident investigation.

Controls 10-18: Defensive Posture and Response

The remaining controls address malware defences, data recovery, network infrastructure management, network monitoring, security awareness, service provider management, application software security, incident response management, and penetration testing.

Measuring Progress

CIS provides a self-assessment tool (CSAT) enabling organisations to score implementation against each safeguard and track progress over time. More meaningful are operational metrics: patch lag time for critical vulnerabilities, MFA coverage across privileged accounts, mean time to detect and respond to incidents. Outcome metrics confirm that control implementation achieves risk reduction rather than just checking boxes.