CIS Controls IG1 checklist: 56 Safeguards by Control

What are the 56 CIS Controls IG1 checklist Safeguards?

If a customer, contract or regulator has asked for CIS Controls IG1, the first thing to know is that IG1 is 56 foundational Safeguards that the Center for Internet Security defines as essential cyber hygiene and the minimum standard for every enterprise. Meeting IG1 means showing that each of those 56 Safeguards is implemented in your environment, not that you have adopted the Controls in general. The Safeguards are spread across the 18 Controls. Control 1 contributes 2 IG1 Safeguards, Control 3 contributes 6, Control 4 contributes 7, Control 5 contributes 4, Control 6 contributes 5 and Control 7 contributes 4. The remaining IG1 Safeguards sit in Controls 9 through 18, and some Controls contribute none at IG1 at all, so the checklist is uneven by design.

The work behind each Safeguard depends on your assets, your installed software and the policies you already have. A small estate with a clear asset register and written access rules needs far less preparation than one where devices, cloud accounts and service providers are poorly known. Ownership matters here. Your organization owns its controls and makes the decisions about them. An implementation partner, such as DeployOpen, can help prepare systems, configurations and the records that show them. Only an independent assessor or certification body issues a report or certificate. Before you engage anyone, ask the customer or regulator which version and Implementation Group they expect, and whether they want a self-attestation or an independent assessment.

Confirm three things with the requester first: the exact IG1 Safeguard list for the version they reference (v8.1 is the current version on cisecurity.org), the evidence format they will accept, and the scope of enterprise assets and software it covers. Those answers determine which of the 56 Safeguards need new work and which already have evidence. The sections that follow walk through each Control, the processes that must be written down before the technical work can be measured, and the tools that cover several Safeguards at once.

How many IG1 Safeguards each Control contributes

This table lists how many IG1 Safeguards each CIS Control contributes, or which IG1 Safeguard IDs apply where the counts are given by Safeguard ID. Counts for Controls 1, 3, 4, 5, 6 and 7 come from the Assessment Specification, while Controls 10 to 17 list specific IDs. Confirm the full IG1 set for every Control in the CIS Controls Navigator before you build a plan.

Control	IG1 Safeguards	What to confirm or note
Control 1: Inventory and control of enterprise assets	2 of 5 Safeguards	Asset inventory supports several other Controls, so start here
Control 3: Data protection	6 of 14 Safeguards	Confirm which data management Safeguards are IG1 in the Navigator
Control 4: Secure configuration of enterprise assets and software	7 of 12 Safeguards	Largest IG1 count among the Controls listed in this table
Control 5: Account management	4 of 6 Safeguards	Confirm the IG1 account inventory and administrator account Safeguards
Control 6: Access control management	5 of 8 Safeguards	Confirm which MFA and access granting Safeguards apply at IG1
Control 7: Continuous vulnerability management	4 of 7 Safeguards	Confirm which scanning and patching Safeguards apply at IG1
Controls 10, 11 and 12	10.1 to 10.3, 11.1 to 11.4 and 12.1	Malware defenses, data recovery and network infrastructure management
Controls 14, 15 and 17	14.1 to 14.8, 15.1 and 17.1 to 17.3	Awareness training, service provider inventory and incident response
Controls 2, 8, 9, 13, 16 and 18	Covered in their own topics	Confirm each Control's IG1 Safeguards in the Navigator before planning

Which IG1 Safeguards sit in each Control

Which IG1 Safeguards does Control 1 require for asset inventory?

Control 1 contributes 2 IG1 Safeguards. Safeguard 1.1 asks for a detailed inventory of enterprise assets, and Safeguard 1.2 asks for a documented process to address unauthorized assets when they are found.

An assessor looks for an inventory with the fields the assessment specification for Control 1 calls for, such as owner, location and network address, plus evidence that the record is kept current. For 1.2, they want the written procedure, a sample of recent cases where an unknown device was removed or authorized, and the dated decision record.

Typical evidence is an export from a configuration database, discovery logs from active scanning, DHCP or passive monitoring, and the procedure itself. DeployOpen can set up discovery and prepare the inventory and evidence exports inside your own infrastructure. Your organization still owns the inventory and the decisions on what to remove. Confirm the exact field list against the specification before you build the template.

What do the six IG1 data protection Safeguards in Control 3 ask for?

Control 3 contributes 6 IG1 Safeguards, numbered 3.1 to 3.6:

3.1: a documented data management process covering handling, retention and disposal
3.2: an inventory of sensitive data and where it is stored
3.3: access control lists on data stores
3.4: data retention rules that are enforced
3.5: secure disposal of data that has reached end of life
3.6: encryption of data on end-user devices

An assessor typically asks for the written process, a data inventory with owners, screenshots or exports of access control settings, retention schedules with proof that they run, disposal records, and disk encryption reports from managed endpoints. The Control 3 assessment specification describes the measures for each item.

DeployOpen can configure encryption and access settings in your environment and prepare the evidence. Classification decisions and retention periods come from your legal and business owners, so have them agreed before implementation starts.

What are the seven IG1 secure configuration Safeguards in Control 4?

Control 4 contributes 7 IG1 Safeguards. They cover a documented secure configuration process for enterprise assets and software (4.1), automatic session locking on enterprise assets (4.3), and management of default accounts, including changing or disabling them (4.7). The other IG1 items in this Control cover the rest of the baseline work, such as configuration for managed hosts and the handling of software and services that are not needed.

An assessor looks for a written configuration standard, a record of how it is applied to each asset class, and proof that it is reviewed. For session locking, they usually check a configuration export or a policy report. For default accounts, they want a list of accounts found on each system and the steps taken to disable or rename them.

DeployOpen can harden systems to a documented baseline and collect configuration evidence from them. The baseline itself should reflect your own risk decisions. Confirm the Safeguard-by-Safeguard measures in the Control 4 assessment specification before you choose tooling.

Which account management Safeguards must IG1 organizations implement?

Control 5 contributes 4 IG1 Safeguards. Safeguard 5.1 asks for an inventory of accounts, including service accounts. Safeguard 5.2 asks for unique passwords for each account. Safeguard 5.3 asks for dormant accounts to be disabled after a defined period of inactivity. Safeguard 5.4 asks for administrator privileges to be restricted and for administrators to use dedicated accounts separate from their daily ones.

An assessor will ask for the account inventory with an owner and purpose for each entry, a password policy or technical settings that show uniqueness, a report of dormant accounts and the disable actions taken, and a list of administrator accounts with their approval records.

The inventory is the foundation. Without it, dormant and shared accounts are hard to find. DeployOpen can help pull account data from directories and systems into one inventory and produce the reports. Your organization decides the dormancy threshold and who approves administrator rights. The Control 5 assessment specification sets out what the assessor will measure.

How many IG1 access control Safeguards does Control 6 contain?

Control 6 contributes 5 IG1 Safeguards. They cover a documented process for granting access (6.1), a process for revoking access when it is no longer needed (6.2), multi-factor authentication for externally exposed applications (6.3), multi-factor authentication for remote network access (6.4), and multi-factor authentication for administrative access (6.5).

An assessor will expect the written granting and revoking procedures, sample tickets or records showing access was granted and removed on time, and configuration evidence from identity providers and remote access gateways that shows MFA is enforced. For the revocation process, they often compare leaver lists from HR with account disablement records.

DeployOpen can configure MFA on systems you run in your own cloud accounts or data centers and prepare the logs that show enforcement. Confirm which external applications and remote access paths are in scope before configuration starts, because the evidence must cover each one. The Control 6 assessment specification lists the measures.

What vulnerability management Safeguards does Control 7 require at IG1?

Control 7 contributes 4 IG1 Safeguards. They cover a documented vulnerability management process (7.1), a documented remediation process with responsibilities and timelines set by your organization (7.2), automated patching of operating systems (7.3), and automated patching of commonly used applications (7.4).

An assessor looks for the two written processes, a list of the owners for each asset group, patch reports from your management tooling showing the time between release and deployment, and a sample of recent vulnerabilities with the actions taken. They will test whether the process is followed, not only whether it exists.

In practice, teams use open-source patch management and vulnerability scanners to produce these reports. DeployOpen can deploy and configure the tooling in your environment and produce the reports from it. Remediation timelines are a risk decision for your organization. Check the Control 7 assessment specification for the measures before you set them.

What do the IG1 data recovery Safeguards in Control 11 require?

Control 11 contributes 4 IG1 Safeguards. Safeguard 11.1 asks for a documented data recovery process. Safeguard 11.2 asks for automated backups of in-scope assets. Safeguard 11.3 asks for backup data to be protected, including from unauthorized changes and deletion. Safeguard 11.4 asks for at least one backup copy to be isolated from the main network.

An assessor will ask for the recovery procedure, backup job reports for a sample period, evidence of how backup data is protected and access controlled, and the location or configuration that shows isolation. A recovery test record is the strongest proof that the backups can restore data, so ask for one.

DeployOpen can implement backup and isolation in your own infrastructure and run restore tests with you. Recovery time and recovery point targets are business decisions, so agree them first. The backup retention and restore test schedule should be written down and kept with the evidence. Review the Control 11 assessment specification as a starting point, and confirm the current version before use.

Which security awareness training topics does IG1 expect organizations to cover?

Control 14 contributes 8 IG1 Safeguards, numbered 14.1 to 14.8. They require a security awareness program and training on a set of topics: social engineering, authentication practices, data handling, unintentional data exposure, reporting incidents, missing software updates, insecure networks, and the skills specific to particular roles.

An assessor looks for the training program, the course content for each topic, completion records for the workforce, and evidence that training is refreshed. For role-specific skills, they will check whether people who handle higher-risk tasks received training for those tasks.

Learning platforms, phishing simulation tools and learning management systems can produce the completion records. DeployOpen can deploy open-source learning and phishing simulation tooling in your environment and provide training on request. Course content should reflect your own environment and policies, so check each topic against the Control 14 assessment specification and your own risk assessment.

Which processes must be written down first

Several IG1 Safeguards require a documented process before the technical controls can be verified. Working through these processes in a fixed order lets each document reference the inventories and roles built before it, and the result is an approved set of process documents that an assessor can read against the evidence.

Write the asset inventory process
Start with Control 1, because every later process refers to the devices and addresses it covers. Assign an owner, define how assets are discovered and recorded, and state how unauthorized assets are found and handled. The output is an approved process document and a first detailed asset inventory that the owner can export for review. Confirm that the process names the environments in scope, including cloud accounts and remote endpoints, before moving on.
Define the data management process
Control 3 comes next, because the data management process decides which assets hold sensitive information and who may reach it. Record the data types the enterprise handles, where they reside, who owns them, and the handling rules for each category. The output is an approved data management process and a data inventory that maps back to the asset inventory from the first step. An assessor will check that the two documents agree.
Document account management and the account inventory
Set out how accounts are created, reviewed, disabled and removed, covering user accounts and service accounts alike. Build an account inventory from the identity sources and systems identified in the asset inventory, then record a named owner or documented service purpose for each account. The output is an account management process and a current account list. Check that no account in the list lacks an owner, since orphaned accounts are a common finding.
Write access granting and revoking processes
With accounts inventoried, define how access is requested, approved, granted, changed and withdrawn under Control 6. Name the approver for each class of access and set the trigger events that require access to be removed, such as departure or a change of role. The output is two linked processes and an approval record format. Test the process by tracing one leaver through the documented steps and confirming that the access was removed as written.
Establish the vulnerability management process
Under Control 7, define how vulnerabilities are identified, prioritized, assigned and tracked to remediation. Use the asset inventory to set the scanning scope and name the role that can accept residual risk. The output is a vulnerability management process and a remediation record format that shows who fixed what and when. Confirm that the process covers both operating systems and applications, since the Control 7 Safeguards address both.
Write the incident response plan
Under Control 17, name the personnel responsible for managing incident handling, record contact details for internal staff and external parties, and set out the response process itself. Describe how workforce members report suspected incidents and how those reports reach the response team. The output is an incident response plan with named roles and a current contact list. Test that the contact list reaches the people it names before treating the plan as complete.
Launch the security awareness training program
Create the training program that delivers the Control 14 topics to the workforce, including social engineering, authentication, data handling, unintentional exposure and incident reporting. Set the audience and the frequency of training in the program document, then track who completes each module. The output is a program document and completion records for each person. Assessors look for evidence that training was delivered, not only that it was planned.
Check drafts against CIS IG1 policy templates
CIS publishes policy templates aligned with v8 and v8.1 that cover IG1 Safeguards only, and they do not address IG2 or IG3 Safeguards. Use them as a checklist to confirm that each process from the previous steps covers every IG1 requirement it should. The output is a gap list for each document, closed before approval. Tailor the wording to your environment, because a template copied without local detail will not satisfy an assessor on its own.

Which tools cover several IG1 Safeguards at once

Many IG1 Safeguards can be met by the same platform, so the question is less how many tools to buy and more which platform owns which evidence. CIS notes that the 56 IG1 Safeguards do not require 56 tools, and the categories below show where one component can serve several Controls.

Enterprise and software asset inventory

CIS gives one example: a single enterprise and software asset inventory tool can address Safeguards 1.1, 1.2, 2.1, 2.2, 2.3, 9.1 and 12.1. The same inventory is the starting point for hardening, patching and monitoring, so an unmaintained inventory weakens several Controls at once. Ask the vendor whether it discovers unmanaged devices, exports software lists with version and support status, and records owners. Do not assume coverage for every Safeguard in the example until the vendor confirms it.

Backup and recovery platforms

Backup software usually covers Control 11 directly, including automated backups, isolated recovery data and recovery testing. It also supports Control 10 when backups are a fallback for ransomware, and it depends on the inventory to know which data sets exist. Confirm that backup copies are stored separately from production credentials, that restores are tested on a schedule, and that the platform keeps its own audit logs for evidence.

Identity and access platforms

A central identity provider with single sign-on and multifactor authentication can address account management in Control 5 and access control in Control 6 in one place. Its user directory is also the record that proves dormant accounts were disabled and administrator accounts are separate. Ask the vendor how it exports account lists, enforces MFA for applications and logs role changes, and whether any of these features are add-ons or plan-dependent.

Endpoint configuration and hardening tools

Configuration management and endpoint security tools can enforce secure settings for Control 4, apply operating system patches for Control 7, and report unsupported software. They also support malware defenses in Control 10 when they include anti-malware and allowlisting features. Check whether the tool reports drift against a documented baseline, whether it covers mobile devices, and whether its reports can serve as assessment evidence without manual rework.

Log collection and central monitoring

A central log platform can collect audit logs under Control 8 and feed alerts used in Control 17 and monitoring work in Control 13. One retention and time-sync setting often governs several Safeguards, so confirm that the platform keeps logs from endpoints, identity systems and the network in one place. Ask about retention periods, time synchronization and whether access to the log store is itself logged.

Email and web gateways

Mail and web filtering gateways can address several Safeguards in Control 9, including DNS and URL filtering, file type blocking and email anti-malware. Some also support the malware defenses in Control 10. Confirm which browsers and email clients the product supports, whether DMARC reporting is included, and whether filtering rules are logged for review. Coverage differs widely between products, so test it before counting it toward a Safeguard.

What drives the effort of IG1 in a small or mid-sized organization

IG1 is not a certification, and nobody sells a single fixed price for it. The CIS Controls are free for any organization to use to improve its own cybersecurity under the Creative Commons license, so the money goes to people and tools rather than to the standard itself. What you pay for is the work of inventorying assets, writing the processes the Safeguards require, configuring systems, and collecting evidence. Your own cost depends mostly on how many assets and systems you run, how many people touch them, and how much of the required documentation already exists. Before asking anyone for a quote, confirm those three facts for your environment.

Asset count is the first driver. Control 1 and Control 2 require a detailed inventory of devices and software, and the effort grows with every laptop, server, cloud account and SaaS subscription that has to be recorded and kept current. Documentation is the second. CIS publishes free IG1 policy templates, but adapting them, approving them and showing that the documented process is followed takes time, and organizations with no written access, backup or incident procedures start from zero. Systems count is the third: each platform needs hardened configuration, account reviews and backup testing, and a sprawling estate multiplies that work. A paid CIS SecureSuite membership or accredited provider is optional. CIS lists accreditation application fees of $1,500 for CREST members and $2,500 for non-members for providers of CIS Controls services, which tells you what accredited providers pay to enter the program, not what an implementation costs you.

When you request a quote, ask the provider to state the asset and system counts it assumed, which Safeguards are in scope, which policies it will draft versus review, and which evidence it will hand over at the end. Ask whether the quote covers one-time setup, recurring reviews, or both, and what changes if your inventory turns out larger than expected. Fixed-scope work of this kind is agreed in writing before it starts, so an unclear scope is the most common reason estimates drift. Your own reading of the CIS Controls v8.1 Navigator can help you check whether the scope matches the Safeguards you need.

What must be in place before an IG1 assessment

An IG1 assessment tests whether the basics are running and provable, not whether they exist on paper. The cards below cover the six areas an assessor is most likely to ask you to show, and each one says what to check before you book an independent review.

Current asset inventory

Controls 1 and 2 expect you to know which devices and software sit in the enterprise, and the inventory must match reality. Pull the inventory from your directory, cloud consoles and endpoint tools, then compare it against a live network scan. Any device or application that appears in the scan but not in the inventory is a gap to close before assessment. Confirm that each entry has an owner and a last-seen date.

Approved written processes

Many IG1 Safeguards require a documented process, not just a working tool. Check that each process names an owner, states its scope, carries an approval date and has been reviewed in the last cycle. CIS publishes policy templates aligned with v8.1 that cover IG1 Safeguards only, so use them as a starting draft and confirm that your own practice matches the words on the page.

Configuration and patching evidence

Control 4 and Control 7 require secure configuration and timely remediation, and an assessor will ask for proof from the systems themselves. Export configuration baselines and patch reports for a sample of endpoints and servers, then check that the sample reflects the whole inventory. Look for systems that are missing from the patch console or have been excluded without a recorded reason.

Account review records

Control 5 and Control 6 expect accounts to be inventoried, reviewed and removed when no longer needed. Run a report of all enabled accounts, including service and administrator accounts, and compare it against current staff and contractor lists. Keep the signed output of each review, because an assessor will want to see the review happened on a schedule, not only that the accounts were clean on the day you checked.

Backup restore test results

Control 11 asks whether backups can return systems to a trusted state, and a backup job log alone does not show that. Choose a representative system, restore it to an isolated environment, and record the time taken, the data verified and who signed off. Keep the restore record with the backup configuration, and confirm that backup copies are protected from the same credentials that run production.

Security training records

Control 14 covers the awareness program and the topics it must include, such as social engineering, authentication and incident reporting. Keep attendance or completion records for every workforce member, with dates and the course version used. Check that new joiners and contractors complete the training before receiving access, since missing records for any group are a common finding.

Who owns the IG1 Safeguards and who prepares the evidence

The organization remains accountable for every IG1 Safeguard, whether it runs the work internally or hires help. Ownership covers the decisions that no partner can make on its behalf: which assets are in scope, which risks are accepted, which policies are approved, and who is accountable when a control fails. Those decisions belong to named leaders, usually the CISO or the head of IT with executive sign-off, and they should be recorded in the organization's own governance records.

Policy approval: Leadership approves the written processes that IG1 requires, such as asset inventory, access granting and revocation, and incident reporting, and sets a review cycle.
Risk decisions: Management decides which residual risks to accept, defer or fund, and records that decision with a date and an owner.
Operating the controls: Staff perform recurring tasks such as reviewing accounts, approving exceptions and responding to alerts.
Asset and data knowledge: Only the organization can confirm which devices, accounts and data stores belong to the enterprise.
Evidence retention: The organization keeps the logs, tickets and approvals an assessor will ask to see.

Before engaging any partner, confirm internally who will sign off each written policy and who will own each recurring control after handover.

Common questions about the IG1 checklist

Is CIS Controls IG1 a certification?

No. IG1 is a set of 56 Safeguards that CIS describes as essential cyber hygiene and a minimum standard for every enterprise. Nothing is certified against it by CIS, and no certificate is issued for passing it. The organization owns its controls and decides how to show they work. If a customer or contract asks for evidence, the usual route is an independent assessment of the Safeguards in scope, which an assessor performs and reports on. DeployOpen prepares systems, documentation and evidence for that assessment but does not issue reports or certificates. CIS also states that the Controls do not replace any regulatory, compliance or authorization scheme, so confirm with the requesting party which framework they actually need.

How many tools does IG1 actually need?

Fewer than the Safeguard count suggests. CIS notes that the 56 IG1 Safeguards do not require 56 tools. As one example, a single enterprise and software asset inventory tool can address Safeguards 1.1, 1.2, 2.1, 2.2, 2.3, 9.1 and 12.1. Most organizations need a handful of capabilities: an asset inventory, centralized account and access management, patching and vulnerability scanning, anti-malware, encrypted and tested backups, centralized logging, and a password manager or equivalent. Open-source platforms can cover several of these, but confirm each capability against the specific Safeguard it is meant to satisfy, because a tool that runs a function does not always produce the evidence an assessor expects.

Can a small team implement IG1 without outside help?

Often yes, provided someone owns the work and has time to write the processes first. CIS publishes free policy templates aligned to CIS Controls v8 and v8.1 that cater exclusively to IG1 Safeguards, which removes much of the drafting effort. The harder part is operational: keeping an asset inventory current, enforcing MFA, reviewing accounts, patching on schedule and testing backups. A small team should estimate the ongoing hours these tasks need, not only the initial setup. Outside help is usually most useful for the initial configuration, evidence design and a readiness review before an assessment, and it can be scoped as a fixed-scope engagement with written deliverables.

What does the work need from staff?

It needs a named owner for each Control, someone who can administer identity, endpoints and backups, and people who will follow written processes. Several IG1 Safeguards depend on documented processes, such as the asset inventory, access granting and revoking, and incident reporting, so the owner must be able to approve and maintain those documents. Staff also need security awareness training, which Control 14 covers. Ask any partner to name who on your side signs off on policies, who receives alerts, and who performs recurring reviews. Without these roles, the tooling will produce data that nobody acts on.

How does IG1 differ from IG2?

IG1 is the starting set of 56 Safeguards for every enterprise. IG2 adds 74 Safeguards for enterprises with more operational complexity that often hold sensitive information, bringing the total to 130. The additions typically extend audit logging, network infrastructure and monitoring, application security and penetration testing. Passing IG1 does not mean an organization meets IG2, and IG2 cannot be claimed without implementing its added Safeguards. Your Implementation Group should follow from your environment and risk, which CIS describes in its Implementation Groups guidance, so review that guidance before deciding scope.

What should I confirm with a partner before signing a fixed-scope agreement?

Confirm the Safeguards in scope by number, the systems and locations each one covers, and the written deliverables for each. Ask which processes and policies will be drafted, whether CIS policy templates will be used, and who on your side approves them. Clarify who performs the configuration, who owns the resulting evidence, and what happens to documentation at handover. Ask how the partner will handle items you own, such as HR and physical controls, and what is excluded. Request a written quote derived from that scope, and confirm that no part of the work includes issuing an audit report or certificate, which only an independent assessor can do.

How DeployOpen prepares IG1 systems and evidence

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the systems that produce IG1 evidence are in place before any assessor looks. We prepare systems, controls and evidence for the CIS Controls IG1 checklist, while your organization owns its controls and an independent assessor or auditor issues any report.

How we scope

Every engagement starts with a written scope listing which of the 56 IG1 Safeguards are in or out.
We map each in-scope Safeguard to the asset classes, systems and owners it touches in your environment.
Scope, deliverables and timelines are agreed in writing before any work begins, and quotes follow from that scope.

How we build

We deploy the inventory, configuration, logging and backup platforms inside your cloud accounts, data centers or air-gapped networks.
We configure tools so that one platform can serve several Safeguards, which keeps the number of systems to what the scope needs.
We run security testing against the built systems and record the results against each in-scope Safeguard.

How we hand over

We deliver written procedures for the processes IG1 requires you to document, such as asset inventory and account management.
We provide an evidence index that names, for each Safeguard, the system, report or log that shows it is operating.
Your staff receive documented runbooks so the controls can be operated and reviewed without us on site.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
We can review evidence samples on a schedule you set, so gaps appear before an external assessment.
Confirm with us in the quote which support items are included and which are charged separately.

CIS Controls IG1 checklist: the 56 essential cyber hygiene Safeguards