What each CIS Controls Implementation Group contains in practice: the 56 IG1 essential cyber hygiene Safeguards as a checklist, the 74 Safeguards IG2 adds, the 23 IG3 adds, and how small businesses start with IG1.
A Control-by-Control checklist of the 56 IG1 Safeguards: how many each Control contributes, which Controls have none, which processes must be written down first, and the tools that cover several Safeguards at once.
Where the 74 IG2 Safeguards land: the jump in audit logging, network infrastructure and monitoring, application security and penetration testing, the kind of enterprise CIS has in mind, and what IG2 demands in staff and tooling.
The 23 Safeguards only IG3 enterprises are expected to implement: intrusion prevention and advanced network defense, service provider assessment and monitoring, threat modeling and code-level checks, internal penetration tests, and who IG3 is for.
How a small or mid-sized business with little security staff approaches IG1: CIS's profile of an IG1 enterprise, published cost guidance, free tools and templates, SecureSuite pricing for small headcounts and the attack coverage IG1 buys.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.