CIS Controls IG1 for small businesses: cost and scope

How a small business starts CIS Controls IG1 with limited staff

A small or mid-sized business is asked by a customer or in a contract to show it follows the CIS Controls, and it has one or two people who run IT and no dedicated security team. For that business, CIS Controls IG1 for small business means the 56-Safeguard essential cyber hygiene baseline, and the Controls, policy templates and tools CIS publishes can be used by any organization to improve its own security at no licence cost. CIS's cost guidance estimates that the commercially supported tools needed for IG1 should cost less than 20% of the IT budget for any size enterprise, so the main budget question is which paid tools, if any, close gaps the free material leaves open. The organization owns its controls. It decides which Safeguards apply, who is accountable for each, and what gets written down. A partner can help prepare systems, configuration and evidence, but it does not decide that the business is compliant.

A practical first step is to confirm the scope the customer or contract actually requires, then map the 56 IG1 Safeguards to the systems that hold that data. Start with the processes that must exist in writing before tools can prove anything, such as asset inventory, account management and incident reporting. CIS's free IG1 policy templates cover those written processes, and the RAM v2.1 IG1 workbook can help record risk decisions. Ask the requester whether they expect a self-assessment, a customer questionnaire or an independent report, because the answer changes the evidence you keep. Where an independent assessor is needed, only that assessor issues a report or certificate. Before engaging anyone, ask for a written scope, a list of deliverables and a timeline, and confirm which tasks you will do yourself so that a quote reflects only the work you need.

Expect costs in three groups: staff time to write and maintain policies and review evidence, any paid tools, and external help for system preparation or assessment. Tool costs recur through licences and renewals, while policy writing and initial configuration are largely one-time, though reviews must repeat each year. Cost drops when one tool covers several Safeguards. CIS notes, for example, that a single enterprise and software asset inventory tool can address Safeguards 1.1, 1.2, 2.1, 2.2, 2.3, 9.1 and 12.1. Ask any provider for a quote that lists each Safeguard it will prepare, the evidence it will produce, the tools it will install or license, and which items the business must maintain itself afterward.

What IG1 costs and who is paid for each part

This table separates the cost of an IG1 program by who is paid and whether the cost is one-time or recurring. Read it as a checklist for building a budget, then use the quote column to confirm what each partner will and will not cover. The main takeaway is that the CIS Controls and templates are free, so most of the spend goes to tools, people and time.

Cost component	Who is paid	One-time or recurring	What to request or confirm
CIS Controls and IG1 policy templates	No one (free for own use under CIS terms)	Not applicable	Confirm the license terms apply to your use and that you are not reselling the content
Commercially supported security tools	Tool vendors or resellers	Usually recurring (subscriptions or support)	Ask which Safeguards each tool covers and whether one inventory tool covers several IG1 Safeguards
SecureSuite membership (optional)	CIS, by employee count	Recurring annual fee; 2,400 US dollars a year up to 99 employees and 5,500 for 100 to 499 (CIS End User pricing, subject to change)	Confirm the current fee for your headcount on the CIS pricing page before budgeting
Internal staff time	Your own payroll	Initial setup and recurring reviews	Estimate hours per Safeguard owner and who backs up the owner during absence
Implementation partner fees	The partner you engage	Usually one-time for setup, with optional recurring support	Request a written, fixed scope listing deliverables, responsibilities and handover items
Independent assessment fee (if needed)	An independent assessor or certification body	Typically one-time per assessment, repeated on a cycle	Confirm whether your customer or regulator requires a third-party report, since IG1 self-assessment does not need one

What makes IG1 cheaper or slower for a small team

Two things set the effort for IG1: how many places company data and devices live, and how much of the groundwork already exists. The cards below cover the drivers a small team can measure before asking for a quote, and each one changes how many hours and how many tools the work takes.

Device and location count

Every laptop, server, phone and network device must appear in the asset inventory that Safeguards 1.1 and 1.2 call for. Each additional site, branch or remote worker adds devices that need discovery, ownership records and removal steps when someone leaves. Count devices by type and location before scoping, and ask the provider how discovery will reach home offices and shared spaces. A small fleet in one office is usually the cheapest case to inventory.

One tool covering several Safeguards

CIS notes that the 56 IG1 Safeguards do not need 56 tools. A single enterprise and software asset inventory tool can address Safeguards 1.1, 1.2, 2.1, 2.2, 2.3, 9.1 and 12.1. Choosing that kind of tool early lowers both licensing and integration effort, because the same records feed several Safeguards. Ask any proposed tool which Safeguards it covers in writing before accepting it into scope.

Existing written policies

Several IG1 Safeguards expect a documented process, not only a working setting. If the company has no written policies for account management, data handling or incident reporting, someone must draft them and staff must agree to them. CIS publishes free IG1 policy templates, so drafting time is often lower than many teams expect. The main cost is review time from owners who can approve the decisions the policy records, such as who may grant access.

Current backup state

Control 11 asks whether recovery data is automated, protected and tested. A team with backups that run but have never been restored starts with a verification job, not a purchase. Check where backups are stored, whether one copy is isolated from the network that ransomware would reach, and when a restore was last tested. Recovery testing is the most often skipped step, and it determines whether the backup is evidence at all.

MFA and admin account coverage

Identity work is faster when the company already uses a single sign-on or directory service and most accounts already support multi-factor authentication. Gaps usually sit in shared administrator logins, dormant accounts left after staff departures and software used outside the main identity system. Inventory the accounts and privileged roles first, then count how many systems still rely on local passwords. Each system outside the central directory adds configuration and testing work.

Cloud versus office footprint

A company that runs most workloads in a cloud account has configuration, identity and logging controls to set in that account, while an office network needs physical device hardening and network management. Mixed footprints need both, which raises effort. Ask the provider to split the scope between cloud and on-premises assets and to name which Safeguards each part touches. Confirm which cloud and network logs the company can already retain before estimating effort.

Free CIS tools and templates small businesses can use first

CIS publishes policy templates developed by a CIS working group. They align with CIS Controls v8 and v8.1 and are written to cover only the IG1 Safeguards. They do not address IG2 or IG3 Safeguards, so an organization that later moves up a group will need to write those policies itself. The templates give a small team a starting structure for the documented processes that many IG1 Safeguards expect to exist before controls are measured.

Starting point, not finished policy: Each template needs to be edited to reflect your systems, roles, approval chain and review cycle.
IG1 scope only: Coverage stops at IG1 Safeguards, so expect gaps for logging, network monitoring and application security if those apply to you.
Ownership stays internal: Leadership must approve and enforce the policies. Adopting a template does not transfer accountability.
Assessment reads the process: The Assessment Specification checks whether a documented process exists and is followed, so keep dated versions and records of review.

Before relying on the templates, confirm with your own legal, HR and operations contacts which policies your contracts or regulators require in a specific form.

What attack coverage IG1 buys, and what it does not

CIS's Community Defense Model v3.0, published in September 2026, reports that implementing IG1 covers 89% of the System Intrusion techniques it studied, 86% of Social Engineering, 88% of Basic Web Application Attack, 84% of Privilege Misuse and 88% of Denial of Service. For a small business with one or two people responsible for IT, those figures are the strongest argument for starting with IG1: the 56 Safeguards target the attack paths most likely to reach a small organization first. These are CIS-reported results for the techniques it modeled, not a guarantee that a given business will be breached less often or that a given attack will be stopped. Ask whether the model's technique list matches the threats your sector actually sees, and read the CIS Community Defense Model announcement before quoting the percentages to a board or customer.

The gaps matter as much as the coverage. IG1 is designed as a baseline, so it does not address the targeted, sophisticated attacks that IG2 and IG3 are built for. Those levels add Safeguards for areas such as more detailed audit logging, network monitoring, application security and penetration testing, and at IG3 intrusion prevention and threat modeling. A business that handles sensitive regulated data, runs its own customer-facing applications or has been named as a target by a specific threat actor should plan for those additions instead of assuming IG1 is enough. Coverage also depends on execution: a Safeguard that exists only as a written policy does not stop a phishing email or a stale administrator account.

Before relying on the coverage figures, the business should run three checks. First, confirm that its written policies, multifactor authentication for remote and administrative access, backup restores and security awareness training are actually operating and produce records. Second, decide which of the threats in its own risk assessment fall outside IG1 and record who accepts that residual risk. Third, schedule a review when the business changes, such as adding cloud services, a new payment process or a new office, because the attack surface changes with it. A regulator, customer or auditor will ask for that evidence, not for the percentages.

How a small business moves through IG1 in order

The sequence turns IG1 from a list of Safeguards into a documented, tested and evidenced baseline that the business owns, with outside help limited to the steps where it adds value. Each phase produces an artifact that the next phase depends on.

Confirm scope and build the asset inventory
Start by deciding which devices, accounts, cloud services, data stores and software are inside the boundary of the assessment. The owner or the most senior technical person signs off the scope, and whoever runs IT builds the first asset inventory, covering hardware, software and data locations. Many IG1 Safeguards in Controls 1, 2 and 3 depend on this list, so it should be complete before anything else is configured. The step is done when the scope statement is signed and the inventory can be reconciled against the network, cloud consoles and identity provider without unexplained gaps.
Write IG1 policies from the CIS templates
Adapt the CIS policy templates, which cover IG1 Safeguards only, to the way the business actually operates. Name an owner for each policy, add the processes it requires, such as access granting and revoking, patching and incident reporting, and remove text the business will not follow. Leadership approves the policies and staff are told where to find them. The output is a set of approved, dated documents that describe real processes. Confirm with the templates' own documentation which Safeguards each policy supports, since the templates do not address IG2 or IG3 Safeguards.
Implement technical Safeguards by Control
Work through the IG1 Safeguards one Control at a time, starting with the foundations: asset and software inventory, account management, multifactor authentication, secure configuration, backups and email protections. A single inventory tool or identity platform can satisfy several Safeguards at once, so map tools to Safeguards before buying anything. Whoever administers the systems makes the change, records the configuration and keeps a short note of why each setting was chosen. The step is complete for a Control when every IG1 Safeguard in it has a configured setting that can be shown on a screen or in a config file.
Test backups and recovery before self-assessment
Before assessing, restore a sample of backed-up data to a separate location and confirm the restored files open and match what was protected. Record the date, the scope of the test, who ran it and the result, including any failures and their fixes. Recovery testing is one of the places where a small business most often has a policy but no proof, so this run produces the evidence that is hardest to reconstruct later. The output is a dated restore test record attached to the Control 11 evidence set.
Self-assess against the CIS Assessment Specification
Use the CIS Controls Assessment Specification for v8.1 to read what each IG1 Safeguard requires you to measure, then check your environment against those measures. The specification says what to measure but not how, so the person doing the check decides the method, such as an exported report, a screenshot or a query. CIS-hosted CSAT is free for non-commercial self-assessment and is a practical place to record results. Record each Safeguard as implemented, partially implemented or not implemented, with the gap and an owner for each open item. The step is done when every IG1 Safeguard has a recorded status and a named owner for any gap.
Collect and index evidence for each Safeguard
For each Safeguard, gather the artifact that shows it is operating: an inventory export, a configuration screenshot, an access review sign-off, a patch report, a training completion list or an incident log. Store them in one folder with a simple index that maps each file to a Safeguard number and a date. Evidence should show the control running over time, not only on the day you set it up, so schedule recurring reviews and keep the outputs. The output is an evidence index that someone outside the team could follow without a briefing.
Decide whether independent assessment is required
Check the customer contract, the regulator or the procurement questionnaire for any requirement to show CIS Controls conformance through an outside party. Self-assessment is enough for internal improvement and many buyers accept it, but a contract may ask for an independent assessment or a named assessor. Ask the requesting party exactly what they will accept, what form the output must take and who must perform the work. If an outside assessor is needed, obtain the assessor's scope and terms in writing before engaging them, and remember that an implementation partner prepares the evidence while only the independent assessor issues the result.

What must be in place before a customer or assessor reviews IG1

A customer questionnaire or assessor reviewing IG1 will usually ask for written processes before they ask for tool screenshots. The five cards below cover the processes and records that IG1 Safeguards depend on, and each one ends with a simple sample test the business can run this week.

Asset inventory process and current list

Start with a written process that says who keeps the list of devices and software, how often it is reviewed, and how a new or unknown device gets added or removed. Under CIS Control 1 and Control 2, the list itself is the evidence. Pick five devices at random from your network or cloud console and check that each one appears in the inventory with an owner and a purpose. Any device you cannot find in the list is the first gap to close, and an unknown device is an incident to investigate, not a line item to tidy up.

Access granting and revoking procedure

Write down how a new hire receives accounts, who approves elevated rights, and what happens on departure. Auditors look for a request, an approval and a removal record for each change. Sample your most recent leaver and confirm that every account, including shared or cloud logins, was disabled on the last working day. If the leaver's account is still active, the process is not working regardless of how well it reads on paper.

Backup schedule and restore test

A backup that has never been restored is an assumption, not evidence. Document what is backed up, where copies are stored, how many copies exist, and who may delete them. Then run one restore of a file set or a small system to a separate location and record the time it took and whether the data opened correctly. Keep the restore record with the date and the name of the person who ran it. Confirm that at least one copy is stored where ransomware on the main network cannot reach it.

Patching routine with dated records

Describe which systems get updates, how critical fixes are prioritized, and the window in which they must be applied. Assessors look for records, so export the patch status report from your management tool or from the update service on a sample of machines. Check whether the most recent operating system and browser updates are installed on your laptops and servers. Record any system you cannot patch, the reason it cannot be patched, and what compensates for that gap.

Incident contacts and reporting path

Keep a short, dated contact list that names who is called first when an account is compromised, who decides whether to notify customers or regulators, and who speaks to your insurer or outside help. The list should include a backup for each role and at least one contact who is reachable outside office hours. Test it by calling the first two numbers on a weekday and noting the response time. Missing or outdated contacts are a common reason a small incident becomes a larger one.

Who owns IG1, who helps, and who signs off

Your organization owns every IG1 Safeguard. That means the people accountable for security decide which assets, accounts and data are in scope, accept the risk where a Safeguard is not met, and approve the written processes that the CIS Controls expect to be documented. In a small business, this is often one IT generalist or an owner with a part-time security role, so the decisions still need a named person and a named backup.

Decisions and risk acceptance: Someone with authority records which Safeguards are met, which are deferred, and who accepted any gap.
Policy approval: Leadership signs the policies you adopt, including any CIS policy templates you tailor, and sets a review date.
Daily operation: Staff run account reviews, patching, backups and alert follow-up, and they keep the records those tasks produce.
Asset knowledge: Only your team can confirm which devices, cloud accounts and vendor systems really belong to the business.
Training and reporting: Your team delivers awareness training and makes sure staff know how to report suspicious email.

Check that each decision and approval has a name, a date and a record you could show an assessor.

How to choose a consultant for a small IG1 project

A small IG1 project is easy to scope loosely and hard to finish well. The cards below cover the checks that separate a useful implementation partner from one that sells tools and leaves the evidence to you. Each one is something to confirm in writing before work begins.

Fixed written scope

Ask for a scope that names the IG1 Safeguards in play, the systems covered, the people who must act and the evidence each Safeguard will produce. A vague statement such as "CIS Controls readiness" cannot be tested at the end. Confirm that scope, deliverables and timelines are agreed in writing before any work starts. If the quote cannot be traced back to that scope, ask why.

Experience with small organizations

IG1 is designed for organizations with limited IT and security staff and commercial hardware and software. A partner used to large enterprise programs may propose processes, tooling or governance meetings that a team of a few people cannot run. Ask how many organizations of your size they have worked with, what their typical environment looked like, and which parts they expect your own staff to operate after handover.

Clear deliverables and handover

Ask for a list of concrete outputs: configured tools, written processes, completed inventories, the Safeguard-by-Safeguard evidence set and a short runbook for ongoing upkeep. Check who holds the administrator credentials, the licenses and the documents when the project ends. Deliverables you cannot open, edit or reproduce without the partner leave you dependent on them.

Evidence handover

The partner prepares systems and evidence. Your organization owns its controls, and an independent assessor or certification body issues any report. Ask how evidence will be stored, named and dated, and which records (inventories, configuration exports, access reviews, training logs) you will be able to produce on request. Confirm that the evidence stays in your environment and under your control.

Accreditation relationship

CIS Controls Accreditation, run with CREST, covers CIS SecureSuite member organizations that provide CIS Controls implementation, auditing or assessment services. CIS lists an application fee of 1,500 US dollars for CREST members and 2,500 for non-members. Ask whether a firm holds this accreditation and whether it is applying for it. Accreditation is a relationship to verify, not a guarantee of quality. Ask for the accreditation status in writing and check it with CIS directly.

What the partner will not do

Ask directly which tasks are outside the engagement. A responsible partner will say it does not issue audit reports, certifications or attestations, does not decide which controls your organization accepts as risk, and does not operate your security tools after handover unless you have contracted for it. Also ask whether they will sell you tools they resell, and how that affects the quote. The answers show where your responsibility starts.

Questions small businesses ask before starting IG1

Can a small business implement IG1 without outside help?

Yes, a small team can work through IG1 internally if it has someone who owns the work and enough time to write processes, inventory assets and check results. CIS states that IG1 safeguards are meant to work with limited expertise and small or home office commercial hardware and software. The difficulty usually lies in the documentation and verification, not in the tools. Many of the 56 Safeguards depend on written processes, so the first question to answer is who will write them, approve them and review them each year. If nobody in the business can commit that time, an implementation partner can prepare systems and evidence under a written scope, but the organization still owns its controls. Decide early which parts you will do yourselves and which you will delegate.

How much does it cost to implement CIS Controls IG1?

Cost depends on the tools you already own, the number of assets, and how much documentation and configuration work is needed, so no single figure applies to every business. CIS estimates that obtaining and deploying commercially supported versions of the tools needed for IG1 should cost less than 20% of the IT budget for any size enterprise, according to its published white paper on IG1 cost. Costs fall into one-time items such as initial policy writing, configuration and inventory setup, and recurring items such as licenses, patching tools, backups and annual review. Ask any provider for a quote that separates labor, software licenses, and hardware, and that states what the recurring portion covers. A fixed-scope written agreement makes these components easier to compare.

How long does it take to reach IG1 coverage?

The timeline depends on how many assets you have, how mature your current processes are, and how much of the work your staff can absorb alongside daily operations. Businesses that already keep an asset list and use managed accounts usually move faster than those starting from scratch. Written policies, approval cycles and changes that may disrupt staff or customers add time. CIS does not publish a single duration for IG1, so treat any date you hear from a vendor as an estimate tied to scope. Ask for milestones that map to specific Safeguards, and confirm what the provider needs from your team in each phase.

Does CIS certify our organization for IG1?

No, CIS does not certify organizations against the CIS Controls or any Implementation Group. The CIS Controls are free for any organization to use to improve its own cybersecurity, and CIS states that they do not replace any regulatory, compliance or authorization scheme. Self-assessment is the usual route, supported by the CIS Controls Assessment Specification, which describes what to measure for each Safeguard. If a customer or regulator asks for independent evidence, an independent assessor must perform that review. DeployOpen prepares systems, controls and evidence for assessments, but does not issue audit reports, attestations or certifications.

Do we need a CIS SecureSuite membership for IG1?

No, you do not need a SecureSuite membership to use the CIS Controls or the IG1 Safeguards. CIS says the Controls are free for any organization to use, and CIS-hosted CSAT is free for non-commercial assessment of your own implementation. A SecureSuite End User membership is a paid option that adds benefits such as CIS policy and tool access. Its fees are set by employee count: 2,400 US dollars a year for up to 99 employees, and 5,500 for 100 to 499 employees, according to CIS's End User pricing page, which states that prices are subject to change. Check the current terms before you budget, and compare the membership cost with what your team would otherwise spend on templates and tools.

Does IG1 cover our customer security requirement?

It depends on what the customer asks for. IG1 covers essential cyber hygiene, and CIS describes it as a minimum standard for every enterprise, but a customer contract may require controls outside IG1 or evidence in a particular format. Start by reading the requirement and mapping each clause to specific Safeguards, which the CIS Controls Navigator supports for several frameworks. CIS states that its mappings are not a substitute for the requirement itself, so confirm the mapping with the customer or an assessor. Where a requirement reaches beyond IG1, the next step is usually a review of IG2 Safeguards.

What attacks does IG1 help block?

IG1 is aimed at the most common attack paths that small organizations face, which is why CIS treats it as a baseline. According to CIS's Community Defense Model v3.0, released in September 2026, implementing IG1 covers 89% of System Intrusion, 86% of Social Engineering, 88% of Basic Web Application Attack, 84% of Privilege Misuse and 88% of Denial of Service techniques studied. These figures describe technique coverage in that study, not a guarantee that an attack cannot succeed in your environment. Use the results to prioritize where to start, such as account management, email protection and backups, and test whether your controls work as described.

How DeployOpen prepares an IG1 environment for assessment

DeployOpen is a Chainscore Labs company that plans and implements self-hosted open-source platforms inside the client's own infrastructure. For CIS Controls IG1, we prepare systems and evidence so the organization can run its own assessment, while the organization keeps ownership of its controls and any independent assessor issues the results.

How we scope

Agree in writing which of the 56 IG1 Safeguards are in scope and which are already met.
Confirm the asset inventory, accounts and systems that the IG1 Safeguards will cover.
Define which written processes the organization must own, approve and keep current.

How we build

Deploy open-source tools for asset inventory, account management, patching, backups and logging, sized for a small team.
Configure controls to match the Safeguards in scope and document each setting as it is applied.
Test each control against the measures in the CIS assessment specification before calling it complete.

How we hand over

Deliver configuration records, runbooks and an evidence map linking each in-scope Safeguard to its proof.
Walk your staff through the tools, the review routine and how to keep evidence current.
Provide a written handover list of open items, owners and dates agreed with your team.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer after handover.
Review tool updates and configuration drift against the agreed IG1 scope on a schedule you approve.
Confirm with your assessor or auditor which evidence they need, since DeployOpen does not issue reports or certificates.