What CIS Controls for state and local government costs and who pays for what
Eligible state, local, tribal and territorial (SLTT) entities can join CIS SecureSuite free of charge, and the CIS Controls themselves are free for any organization to use to improve its own cybersecurity. The cost that matters is therefore not a license fee. It is the internal staff time to assess current practice, write policies, change configurations and collect evidence, plus any implementation partner you hire to do part of that work. Be aware that MS-ISAC services moved to a fee-based membership as of June 23, 2025, so any budget that assumed no-cost MS-ISAC services needs to be revisited. Confirm the current MS-ISAC fee with MS-ISAC directly before you finalize the budget. Consider a city agency whose grant or insurer asks for CIS Controls alignment (illustrative): its largest line items will be the people who run the assessment and the engineering hours to close gaps, not software.
How large those costs are depends on two things: the scope you set and your starting maturity. An agency that already runs centralized identity, managed endpoints and tested backups will spend far less than one that has no current asset inventory. Start with the Implementation Group 1 Safeguards, which CIS describes as essential cyber hygiene and the minimum standard for every enterprise. The CIS white paper on the cost of cyber defense says that obtaining and deploying commercially supported IG1 tools should cost less than 20% of the IT budget for any size enterprise, but that is CIS's estimate and not a figure for your agency. Ask your team to inventory current staff time, tool contracts and any outside help, then compare that against the Safeguards in scope before you request quotes.
CIS does not certify or audit government agencies, so no CIS fee buys a report or attestation. An independent assessor is needed only when a specific external scheme requires one, such as a grant condition, an insurer requirement or a state mandate that names an assessor. Confirm with the funding body or regulator whether it accepts an internal self-assessment or requires third-party evidence, and ask for that in writing before you hire anyone. If an assessor is needed, the agency pays for that engagement separately. An implementation partner can prepare systems and evidence, but the agency still owns its controls and the assessor issues any formal result. Request quotes that separate scope, deliverables, evidence handover and any post-assessment support.
What free SecureSuite membership gives an eligible government entity
SecureSuite membership is free for US state, local, tribal and territorial entities and public academic institutions. The benefits below are the ones supplied for this page, and they work together: membership gives access to the Controls and tools, CIS-hosted CSAT gives a place to record self-assessment, and the IG1 templates give a starting set of written policies. Confirm the current benefit list and eligibility with CIS before relying on any of them.
Free SecureSuite membership
CIS SecureSuite membership is free for US SLTT government entities and US public academic institutions. Eligibility is set by CIS, so a county agency, a city department or a tribal government should confirm that its own entity type qualifies before it plans around the benefit. Membership is the entry point for the other items on this list, so confirm the eligibility step first. The entity must still own its controls and decide which Safeguards apply to its environment.
CIS-hosted CSAT for self-assessment
CIS says CIS-hosted CSAT is free to every organization for non-commercial use in assessing its own implementation of the CIS Controls. For a government entity, this is a place to record the current state of each Safeguard against the assessment specification and to track gaps over time. Ask CIS which CSAT features are included in the free tier, since a hosted tool does not replace the evidence the entity keeps in its own systems.
Free IG1 policy templates
CIS publishes free IG1 policy templates covering the written policies the Controls call for. A small city IT team or county office can adapt them rather than drafting policies from nothing. Each template still needs local approval, owners and review dates, and the entity must confirm that the written process matches what staff actually do. The assessment specification checks the documented process, so a template that is never adopted will not show implementation.
Controls content for internal use
The CIS Controls are free for any organization to use to improve its own cybersecurity, under a Creative Commons license that restricts commercial use. For a government entity, this means the Safeguard text, the implementation groups and the assessment specification can guide internal programs without a license fee. Reuse outside the entity, such as offering the Controls as a paid service, needs CIS approval, so check the terms before a shared service or contractor arrangement.
IG1 as a starting scope
CIS says every enterprise should start with IG1, which it defines as essential cyber hygiene: 56 foundational Safeguards that guard against the most common attacks. For a government entity with limited staff, IG1 gives a bounded first target and a defensible baseline for leadership and oversight bodies. Decide early whether the entity's sensitive data or regulatory obligations require IG2 or IG3 Safeguards, because membership does not change which group applies.
Confirm benefits before relying on them
Benefit lists, eligibility rules and tool features can change. Before budgeting staff time or planning a program around any free item, ask CIS in writing which SecureSuite benefits apply to your entity type, whether any services carry fees, and what happens to access if eligibility changes. Record the answers with the date, since a benefit confirmed today may be different when a grant or audit asks about it.
What the move to fee-based MS-ISAC membership changes in the budget
CIS states that the MS-ISAC introduced a fee-based membership as of June 23, 2025, so any budget line, plan or procurement note that assumes MS-ISAC services are free no longer holds. Budget owners should treat the no-cost assumption as expired and rebuild the line from current terms. Older roadmaps written for state and local government often list MS-ISAC participation as a zero-cost item beside SecureSuite membership, and that pairing needs to be checked before the next budget cycle closes.
Start with an inventory of what your entity actually uses from MS-ISAC. Sort services into three groups: those you rely on daily (threat intelligence feeds, alerting, incident support, training, or peer sharing), those used occasionally, and those that appear only in old documents. For each service in the first group, confirm with the provider whether it is covered by the membership fee, sold separately, or no longer offered. Ask for the fee schedule in writing, the billing term, whether the fee is one-time or recurs each year, and what happens to access if the fee is not paid on time. Keep in mind that the free SecureSuite membership for state, local, tribal and territorial entities is a separate arrangement, so confirm which benefits depend on it and which depend on MS-ISAC membership.
Use the current pricing from the provider, not from a secondary source, a vendor reseller or this page. Pricing and service scope can change, and this guidance cannot state a fee amount. Once you have confirmed figures, map each paid service to the CIS Controls Safeguards it supports, such as those in Control 17 for incident response or Control 14 for training, so that the spend can be justified against the controls your entity has committed to. If a service would be dropped to save money, record which Safeguards lose a supporting resource and whether the internal team can cover them. That record gives an auditor or board a clear view of the trade-off.
Which mappings to use: CISA goals, CJIS or both
The CIS Controls Navigator for v8.1 includes a mapping to the CISA Cybersecurity Performance Goals v1.0.1. Use this mapping when the agency's driver is a cyber posture target, such as a state grant condition, a shared-services expectation or an executive direction that points to CISA's goals. The mapping shows which CIS Safeguards contribute to each goal, so a team can see where its existing Safeguard work already answers a goal and where a gap remains.
- Start from the goal list: Read the goals as the target and the Safeguards as the means, then record which Safeguards your team already evidences.
- Track partial coverage: A goal may draw on several Safeguards across more than one Control, so one missing Safeguard can leave a goal open.
- Keep the mapping version fixed: Record that you used CISA Cybersecurity Performance Goals v1.0.1 and Navigator for v8.1 so the baseline stays reproducible.
- Assign owners by goal: Each goal should have a named owner who signs off on the evidence behind it.
- Note what the mapping does not do: It shows alignment, not compliance with any CISA requirement.
Before you report progress against a goal, confirm with your state or sponsoring authority which version and reporting format they expect.
The Navigator also maps the CIS Controls to the CJIS Security Policy v5.9.5 and v6. Agencies that access, store or transmit criminal justice information need this mapping when the CJIS obligation is the driver. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme, so the mapping helps teams plan work but does not satisfy CJIS on its own. The CJIS Security Policy itself, and the requirements your CJIS Systems Agency applies to your environment, remain the binding source.
- Confirm version applicability: Ask your CJIS Systems Agency which CJIS Security Policy version governs your systems and when any transition applies.
- Use the mapping as a planning aid: Identify which CJIS requirements align with Safeguards you are already building, such as access control and audit logging.
- Document CJIS-specific controls separately: Requirements such as personnel screening or physical security may fall outside the CIS Controls and need their own evidence.
- Keep the CJIS audit trail: Your CJIS auditor or the CJIS Systems Agency will test against the policy text, so evidence must map to CJIS requirements directly.
- Plan for version changes: Moving from v5.9.5 to v6 may change requirement numbering, so re-check each mapped item.
Ask your CJIS Systems Agency to confirm in writing which policy version and audit approach apply to your agency.
Many state and local agencies face a CISA-aligned posture goal and a CJIS obligation together, often for the same systems. Running two separate evidence programs doubles the work and risks inconsistent answers. A practical approach is to use the CIS Controls as the shared internal baseline, use the Navigator to tag each Safeguard with the CISA goals and CJIS requirements it supports, and then keep the binding CJIS evidence in the form the CJIS Systems Agency expects.
- Build one Safeguard register: Record each Safeguard, its owner, its evidence location and its mapped goals and CJIS requirements in one place.
- Separate binding from aligned: Mark CJIS requirements as binding and CISA goals as targets so reviewers know which gaps carry consequences.
- Identify gaps unique to CJIS: Plan separate work for requirements the CIS Controls do not address.
- Avoid double counting: One piece of evidence may satisfy several mappings, but confirm each mapping individually before claiming it.
- Review on each version change: Update tags when either the Navigator mapping or the CJIS policy version changes.
Before committing to a combined program, ask your CJIS Systems Agency and your state sponsor to confirm which evidence each will accept.
Agencies with limited staff often ask where to begin. The CIS Controls Navigator lists 30 frameworks and versions in total, so the choice of mapping should follow the driver, not the other way round. Start with the obligation that carries consequences, then use the CIS Controls to build the technical baseline that supports it. CIS recommends that every enterprise start with Implementation Group 1, which it describes as essential cyber hygiene, and that baseline is a sensible foundation before tailoring to CISA goals or CJIS requirements.
- Confirm the binding obligation first: Identify whether a CJIS agreement, a grant condition or a state directive applies.
- Use IG1 as the baseline: The 56 IG1 Safeguards form a common starting set for either mapping.
- Add mapped Safeguards next: Extend the baseline with Safeguards that the chosen mapping highlights.
- Record the Navigator version you used: This keeps future comparisons honest.
- Ask for scope in writing: If you bring in outside help, agree in writing which mappings, systems and evidence are in scope.
A good first question for your CJIS Systems Agency or state sponsor is which mapping they will use to judge your progress.
How a city or county starts with IG1 in practice
A sequence of six steps takes an SLTT team from the 56 IG1 Safeguards to a documented baseline, a gap list and a review cycle that the agency runs and signs off itself.
Confirm the scope of the 56 IG1 Safeguards
The IT lead and the agency's security or compliance owner read the IG1 Safeguard list against the 18 Controls and agree which systems, departments and data sets sit in scope. Cities and counties often run separate environments for public safety, utilities, courts and general administration, so the team records which of these the baseline covers and which need their own assessment. The output is a written scope statement and a copy of the IG1 checklist annotated with owners. The step is done when the agency's leadership has approved that scope in writing.
Build an asset and software inventory
Before any self-assessment can be answered honestly, the team needs to know what it runs. Staff pull device records from directory services, endpoint tools, network scans and procurement files, then reconcile them against each other to find unmanaged devices and applications. Data owners identify where sensitive records such as personal, financial and criminal justice information live. The output is an inventory of enterprise assets, software and data stores with named owners. The step closes when the department heads have confirmed that the list reflects their environment.
Self-assess IG1 in CIS-hosted CSAT
Using the agency's own inventory, the team answers each IG1 Safeguard in CIS-hosted CSAT, which CIS provides free to organizations for non-commercial use in assessing their own implementation. Each answer should point to evidence such as a screenshot, a configuration export or a signed policy, not to memory or intent. Staff should record where a Safeguard is not yet implemented rather than mark it as met. The output is a completed assessment record with evidence references. The step is done when every IG1 Safeguard has an answer, an owner and a supporting artifact. Confirm the current CSAT terms with CIS before relying on the platform for formal reporting.
Map IG1 gaps to existing controls and obligations
Many cities and counties already run controls that satisfy part of IG1 under other frameworks, state rules or internal policy. The team compares the self-assessment against those existing controls and against any obligations the agency already reports on, such as criminal justice or grant requirements. Where a mapping is needed, the agency should use CIS's published Navigator mappings and confirm each one against the framework text with its own compliance lead. The output is a gap list that names each unmet Safeguard, its risk to the agency and a proposed owner. The step closes when leadership has accepted or deferred each gap in writing.
Adopt the IG1 policy templates
CIS publishes free IG1 policy templates for the written policies that several Safeguards require. Counsel, records staff and IT leads adapt each template to the agency's governing ordinances, union agreements, records retention schedules and state law before adoption. The team should remove any text the agency cannot enforce and add local procedures that describe how the work is actually done. The output is an approved policy set with version numbers, approval dates and named owners. The step is done when the governing body or designated official has signed the policies and the staff who operate them have acknowledged them.
Close priority gaps and collect evidence
With the policies approved, staff work the gap list in priority order, starting with Safeguards that protect the most sensitive data and the most exposed systems. Work may involve configuration changes, account reviews, backup tests or training, and the agency may choose to fund some items through its own staff, existing vendors or outside help. Each closed gap generates evidence that the owner files with the assessment record. The output is an updated CSAT record and an evidence folder indexed by Safeguard. The step is done when an internal reviewer can trace each claimed Safeguard to a dated artifact.
Set a review cycle and assign ownership
IG1 is a baseline that drifts as systems, staff and threats change, so the agency needs a recurring review. The team sets a review calendar, names the official who owns the baseline and the staff who refresh each Safeguard's evidence, and defines what triggers an early review, such as a major system change or an incident. Leadership approves the calendar and the reporting path to the governing body. The output is a documented review schedule and an updated assessment record for the next cycle. The step closes when the agency has recorded who signs off each review and how exceptions are approved.
Who owns the controls, the evidence and the independent check
The agency owns its controls, its evidence and the risk it accepts. A state, local, tribal or territorial government decides which CIS Controls Safeguards apply to its environment, assigns an accountable owner for each, and decides what residual risk leadership is willing to carry. CIS publishes the Controls and the CIS Controls Assessment Specification, which describes what to measure for each Safeguard, but it does not operate an agency's security program or certify that the agency meets the Controls. The agency that completes a self-assessment, typically in CSAT, is the party attesting to its own implementation status, so the answers need to be backed by records that a second person could check.
An implementation partner such as DeployOpen works on the agency's side of that line. Under a written, fixed scope, DeployOpen can prepare systems and configuration, set up logging and retention, document the policies and procedures the Safeguards call for, and organize the evidence the agency will show to its own reviewers or to an external assessor. Before engaging, confirm who in the agency signs off on each control, which Safeguards are in scope, and whether the partner's work product will be handed over in a form the agency's staff can maintain after the engagement ends.
Only an independent auditor, assessor or certification body issues a report or a certificate. CIS does not certify agencies, and a CSAT result or a Navigator mapping is not an audit opinion. DeployOpen does not issue reports, attestations or certificates, and hiring DeployOpen does not guarantee that any assessor, auditor, state reviewer or federal program will reach a particular conclusion. If a grant, contract or statute requires an independent review, ask the requesting body which assessor qualifications it accepts and confirm that before scoping the preparation work.
What each cost line covers for a government entity
This table separates the cost lines an SLTT entity faces when adopting the CIS Controls, showing who is paid, whether each line is one-time or recurring, and what drives it. Read it as a checklist for building a quote request, since the free and fee-based items sit alongside costs that depend entirely on your scope. The main takeaway is that the membership lines are the most predictable part of the budget, while staff time and partner fees vary with your environment.
| Cost line | Who is paid | One-time or recurring, and what drives it |
|---|---|---|
| SecureSuite membership | No fee for eligible SLTT entities (CIS End User pricing) | Free to eligible state, local, tribal and territorial entities. Confirm eligibility with CIS before relying on it in a budget. |
| MS-ISAC membership | CIS, for the fee-based MS-ISAC membership introduced June 23, 2025 | Recurring. Check current fee terms with MS-ISAC, since no-cost MS-ISAC services no longer apply. |
| Internal staff time | Your own employees, funded from existing payroll or new positions | Mostly one-time for initial inventory and policy work, then recurring for reviews, patching and log review. Driven by asset count and existing maturity. |
| IG1 tooling | Software and support vendors for commercially supported tools | Partly one-time (deployment) and partly recurring (licenses and support). CIS estimates these should cost less than 20% of the IT budget for any size enterprise (CIS white paper). Ask vendors for licensing terms per device or user. |
| Implementation partner fees | An outside firm that prepares systems, configurations and evidence | Usually one-time for a fixed scope, with optional recurring retainers for upgrades and support. Driven by the agreed written scope, number of systems and procurement rules. |
| External assessor or auditor | An independent assessor, if your program requires one | Recurring when a cycle is required by a contract or regulator. Driven by the assessment scope and the framework being checked. Confirm whether your program requires an external assessment at all. |
| CSAT assessment platform | No fee for non-commercial use of CIS-hosted CSAT | Free to every organization for assessing its own implementation. Confirm your use is non-commercial before relying on it. |
What makes IG1 take longer or cost more in government
Government IG1 work rarely stalls on the Safeguards themselves. It stalls on how many departments, networks, shared services and procurement steps sit between a decision and a control that works. Each card below names one driver and the first move that keeps it in check.
Many departments and separate networks
Each department, court, utility or agency often runs its own network, asset inventory and admin team. Every separate environment repeats Control 1 and Control 2 work, and each needs its own owner for Safeguards such as the asset inventory and secure configuration. Phase the rollout by department, starting with the one that holds the most sensitive data, and ask the sponsor to name one accountable owner per environment before scoping begins.
Legacy systems that cannot be patched
Some line-of-business applications, older field devices or records systems cannot take current operating system or application updates without breaking the vendor's support terms. Under Control 7 these systems still need a documented exception, compensating controls and a retirement date. Inventory them early, record the reason each one cannot be patched, and isolate them on a segment so the exception stays narrow.
Shared services with counties and the state
Many cities, school districts and counties depend on services run by a county data center or a state agency, such as identity, email, backups or network links. Responsibility for those Safeguards may sit outside the entity being assessed, so the work includes agreeing in writing which party owns each control. Map each shared service in Control 15 terms, and confirm the service owner's evidence before counting a Safeguard as met locally.
CJIS and other regulatory scope
Systems that access criminal justice information fall under the FBI CJIS Security Policy, which adds requirements on top of IG1 and can pull in every device and user with access to that data. Scope the CJIS enclave first, with its own asset inventory, access lists and logging, instead of expanding the whole environment at once. Use the CIS Controls Navigator to map the CJIS Security Policy to the Safeguards you already plan to implement.
Volunteer and part-time IT staff
Many small municipalities and special districts have no dedicated security staff, and the person who manages backups may also run the phones and the website. Safeguards that need recurring review, such as log checks, access reviews and recovery tests, are the first to lapse. Schedule these reviews on a calendar with named backups, and choose tools with alerts and reporting so the work stays small enough for part-time staff to keep up.
Procurement cycles for tools
Public purchasing rules often require competitive bids, board approval or budget cycles that run for months before a tool is bought. Delays here push back every Safeguard that depends on the tool, such as backups, endpoint protection or logging. Ask whether the open-source components can be deployed without a purchase, identify which paid licenses need a bid, and start those procurements in parallel with scoping rather than after it.
Questions state and local IT leaders ask before engaging help
Do state and local governments pay for CIS SecureSuite membership?
No. CIS SecureSuite membership is free for US state, local, tribal and territorial (SLTT) government entities and for US public academic institutions. Eligibility attaches to the entity, so confirm with CIS that your agency or jurisdiction qualifies and that the membership is held in the entity's name. Free membership does not make the work free. Your budget still carries staff time, any tooling you choose to buy, and fees for an implementation partner or assessor. When you request quotes, ask partners to price their services separately from membership so you can see what the engagement costs. Check the current eligibility rules on the CIS pricing page before you rely on them in a procurement file.
Does MS-ISAC still provide free services to local governments?
No, not in the way many agencies remember. CIS notes that the MS-ISAC introduced a fee-based membership as of June 23, 2025, so references to no-cost MS-ISAC services no longer apply. Treat any budget line built on older guidance as out of date. Ask MS-ISAC directly which membership tier fits your entity, what each tier includes, whether fees recur annually, and how payment works for your government structure. Compare that recurring cost with the services you already pay for in monitoring and reporting, because the two may overlap. Keep the answers in writing, since budget officers and auditors will ask where the figure came from.
Is IG1 enough to meet CJIS Security Policy requirements?
Not by itself. CIS states that the Controls do not replace regulatory, compliance or authorization schemes, and CJIS requirements belong to that category. The CIS Controls Navigator maps the Controls to CJIS Security Policy v5.9.5 and v6, which is a useful starting point for seeing where IG1 addresses a requirement and where it leaves gaps. A mapping is not a determination of compliance, however. Confirm with your state's CJIS Systems Agency or CJIS Systems Officer which policy version applies, how your environment is reviewed, and what evidence they accept. IG1 safeguards such as asset inventory, account management and audit logging form a sound base, but expect additional CJIS-specific controls, documentation and approvals.
Can our agency implement IG1 without outside help?
Often yes, because CIS designed the Controls for internal use. CIS says the Controls are free for any organization to use to improve its own cybersecurity, and CIS-hosted CSAT is free for non-commercial use to assess your own implementation. The main cost then becomes staff capacity and commercially supported tools. CIS estimates that obtaining and deploying those tools for IG1 should cost less than 20% of the IT budget for any size enterprise. Staff can usually handle inventory, configuration and policy work if they have time and clear owners. Outside help is most often justified for technical gaps, evidence preparation, or when the team is already committed to operations. Base that decision on a written gap assessment.
What work does IG1 require from our IT and security staff?
IG1 needs named owners who can make decisions and keep records more than it needs specialist depth. Start with the areas that generate the most evidence: asset inventory (Control 1), software inventory (Control 2), account management (Control 5), access control (Control 6), vulnerability management and patching (Control 7), audit logs (Control 8), tested backups (Control 11), security awareness training (Control 14) and incident response (Control 17). Each area needs a documented process, a repeatable way to show it runs, and a reviewer who checks the output. Plan time for staff in procurement, HR and program offices too, because onboarding, offboarding and vendor contracts depend on them. Confirm your staffing plan in any partner's written scope.
How long does an IG1 implementation take for a state agency?
The research for this topic does not supply a duration, and the answer depends on your environment. Timing is driven by how many assets and accounts you manage, how current your documentation is, how quickly change approvals and procurement move, whether tools are already deployed, and how many business units must sign off. Agencies with mature asset tracking and existing policies usually move faster than those starting from spreadsheets. Ask any implementation partner for a written scope that lists phases, deliverables, milestones, dependencies and the responsibilities that fall to your staff. Most DeployOpen engagements are fixed-scope, agreed in writing before work starts, so your timeline should come from that document rather than a general estimate.
How to check a consultant or implementation partner for a government project
A state, local, tribal or territorial agency buying CIS Controls work has to defend the choice to its own oversight bodies. The cards below cover the checks that matter most before signing, from references and CJIS handling to independence and written scope.
Ask for public-sector references
Ask for references from state, local, tribal or territorial agencies or public academic institutions that the partner can share, and ask what was delivered, against which Safeguards, and how long it ran. Ask whether the references can be contacted directly and whether the partner has permission to name them. A partner that offers only private-sector examples may still be capable, but the agency should confirm it understands public procurement, public records rules and board-level reporting. Treat any reference the partner cannot verify as unconfirmed.
Confirm CJIS handling commitments
If the project touches systems that process criminal justice information, ask in writing whether the partner will work within the agency's CJIS obligations, including background screening of personnel, security awareness training and access limited to approved staff. Ask who on the partner's team would have access, where any data would be stored and whether any work would happen outside the United States. The partner should accept the agency's requirements in its contract rather than argue for its own terms.
State independence from assessments
If the partner will both implement CIS Controls safeguards and later assess or report on them, ask it to state in writing where that line sits. An implementation partner prepares systems, policies and evidence, while an independent assessor or auditor tests them and issues any report. Ask whether the partner would be willing to step aside from the assessment role on the same project, and whether the agency's own assessor will be permitted to review the partner's work.
Verify CIS Controls Accreditation directly
CIS Controls Accreditation, run with CREST, applies to CIS SecureSuite member organizations that deliver CIS Controls implementation, auditing or assessment services. Accreditation is not a general credential for every consultant, so do not accept it as a substitute for checking the partner's scope. Ask the partner which services the accreditation covers, then confirm its status directly with CIS before relying on it in a procurement file.
Require a written fixed scope
Ask for a written scope that lists the Controls and Implementation Group in play, the systems and agencies covered, each deliverable and its acceptance criteria, and the dates on which work starts and finishes. Most engagements are fixed-scope, so the agreed deliverables should be in the contract before work begins. Ask the partner to state which costs are one-time, such as design and deployment, and which recur, such as support, upgrades and testing retainers.
Agree on evidence ownership
Agree in the contract who owns the policies, configuration records, inventories, scan results and logs the partner produces, and where they will be stored. The agency should be able to show its oversight body the evidence for each Safeguard without depending on the partner's continued involvement. Ask how the partner will hand over documentation at the end of the engagement and whether it will support the agency's assessor in a follow-up review.
How an engagement moves from scope to handover
The sequence turns a written scope into systems, IG1 evidence and runbooks that the agency's own staff can operate and show to reviewers. Each phase closes with a named output, and no phase produces an external report.
Agree written scope and deliverables
Before work starts, DeployOpen and the agency agree in writing which systems, departments and CIS Controls Safeguards are in scope, which Implementation Group the work targets, who the agency contacts are, and what each deliverable looks like. Because most engagements are fixed-scope, this document sets the boundaries for the rest of the sequence. The step is complete when both parties have signed the scope and the deliverable list, and any items the agency expects but DeployOpen will not perform, such as an external assessment, are stated explicitly.
Discover assets and current IG1 status
DeployOpen works with the agency's IT staff to build a picture of what exists: devices, software, accounts, data stores, network segments and the service providers that touch them. The team then compares the current state against the IG1 Safeguards, marking each as in place, partly in place or missing, and notes where existing policies or records are absent. The output is a discovery workbook that lists assets, owners, gaps and open questions for the agency to confirm. The step closes when the agency has reviewed and corrected the inventory, so the gap list reflects their environment rather than assumptions.
Prepare systems and configuration
Using the agreed gap list, DeployOpen configures or hardens the in-scope open-source platforms and supporting tools inside the agency's own infrastructure. Work typically covers inventory and logging tools, account and access settings, backup and patch processes, and hardening against published configuration baselines where they apply. Changes are made through the agency's change process and documented as they happen. The step is complete when each change has a record, the agency's staff have been shown how to operate it, and the systems have passed the functional checks agreed in the scope.
Build policies and evidence records
DeployOpen drafts the written processes and records that the IG1 Safeguards ask for, using CIS's free IG1 policy templates as a starting point and adapting them to the agency's statutes, existing policies and governance structure. It also sets up the evidence the systems generate, such as inventory exports, configuration reports, patch and backup logs and access reviews, and organizes them by Safeguard. The output is an evidence index that maps each Safeguard to the artifacts that support it. The agency's policy owners must approve the drafts before the step closes.
Run agency review and remediation
The agency's security, legal and operational leaders review the configured systems, drafted policies and evidence index against the scope. Comments are logged, and DeployOpen fixes what falls within the agreed deliverables. Items that need decisions outside the scope, such as new budget, staffing or policy changes requiring board or council approval, are recorded as agency actions with owners. The step is complete when the agency signs off each deliverable or documents why an item remains open.
Hand over evidence packs and runbooks
DeployOpen delivers the evidence packs, configuration documentation and operational runbooks to the agency, and walks its staff through them so they can run the controls without outside help. Each runbook explains routine tasks such as reviewing alerts, rotating credentials, restoring backups and onboarding assets. The handover closes when the agency confirms receipt and the working knowledge transfer is recorded. The step produces the agency's own material, not an audit report, and it does not certify that the agency meets the Controls.
Book any external review separately
No phase in this sequence produces an external report, attestation or certification. If the agency wants an independent view of its implementation, it contracts that review separately with an assessor it selects, who sets its own scope, method and fees. DeployOpen can provide the evidence packs and answer assessor questions about the systems it configured, but the assessor decides what it tests and what it concludes. Agencies should confirm with their state or local authority whether any external review is required by their own rules.
Where government CIS Controls projects stall
The most common stall in state and local government CIS Controls work is a budget assumption that no longer holds. Many agencies still treat MS-ISAC as a no-cost service because it was free for years, but CIS notes that the MS-ISAC introduced a fee-based membership as of June 23, 2025, so references to no-cost MS-ISAC services no longer apply. Confirm the current membership terms and fee before you write MS-ISAC services into a budget or a project plan. Ask the MS-ISAC for the written service list, the fee, the billing period and which services are included, and treat any service that is not in writing as unfunded. Also confirm your own eligibility for free CIS SecureSuite membership, which is available to US state, local, tribal and territorial entities, and check that the account is held by the right agency so the free tier is not lost during a reorganization.
A second delay happens when a team begins with Implementation Group 2 or 3 Safeguards because they look more mature or because a consultant or vendor pitched advanced tooling first. IG1 is CIS's stated starting point for every enterprise, with 56 essential cyber hygiene Safeguards, and the IG2 and IG3 Safeguards build on it. Work that skips IG1 leaves asset inventory, account management and data recovery gaps that the later Safeguards depend on, so the project produces tools that cannot be fully measured. Set IG1 completion as a gate that must be documented before any IG2 work is funded. A practical check is to map each IG1 Safeguard to an owner, an artifact and a date in the CIS Controls Assessment Specification evidence list, and to report only the IG1 items that the assessment specification would accept as complete.
The third delay is the assumption that CIS Controls alignment satisfies CJIS or another mandate. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. The CIS Controls Navigator maps v8.1 to CJIS Security Policy v5.9.5 and v6, which helps staff see where the two overlap, but a mapping is not a determination that a system meets the CJIS Security Policy. Agencies that handle criminal justice information should confirm with their CJIS Systems Agency and the policy version in force what evidence the state will accept before scoping the project. Build that conversation into the first planning phase, so the CIS Controls program and the CJIS requirements are tracked as two separate evidence sets that share artifacts where the mapping supports it.
How DeployOpen helps government teams prepare IG1 evidence
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure so that the IG1 Safeguards your agency selects have working systems and evidence behind them. We prepare the systems and records; your organization owns its controls and decides what it attests to.
How we scope
- We agree a written scope covering which IG1 Safeguards, asset classes and environments are in and out before work starts.
- We confirm with your team which systems hold the agency's data and where your CSAT assessments will be recorded.
- Engagements are fixed-scope, so deliverables and timelines are set in writing before any build begins.
How we build
- We deploy and configure the chosen open-source tooling for asset inventory, logging, backups and access control inside your environment.
- We document the written processes and policy templates your team adopts, mapped to the Safeguards they support.
- We run security testing against the configured systems so gaps are found and recorded before your own assessment.
How we hand over
- We deliver configuration records, procedures and collected evidence in a format your staff and any independent reviewer can read.
- We walk your IT and compliance staff through what each piece of evidence shows and where it is kept.
- Your team receives the systems and documentation to run going forward, with no reliance on DeployOpen for ongoing operation.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement ends.
- Retainers can keep evidence current as IG1 Safeguards, your systems and your assessment cycle change over time.
- Any formal assessment or attestation is issued by your independent auditor or assessor, not by DeployOpen.
