How the CIS Controls metrics decide whether a Safeguard passes
When a customer, contract or regulator asks for CIS Controls evidence, the first question is how the Safeguard will be measured. The *CIS Controls Assessment Specification* (CAS) defines, for each Safeguard, the inputs, operations, measures and metrics used to verify that it is implemented. It says what to measure, not how to measure it, so the specification sets the test while your own systems and records supply the answer. The result is not one universal pass mark. It depends on the Safeguard, the state of your inventories and records, and the Implementation Group in scope.
The thresholds are often where organizations get caught. Under the CAS for v8.1, Safeguard 1.1 fails with a score of zero if no asset inventory exists or it was last updated more than six months ago. Safeguard 5.1 fails if no account inventory exists or it was last updated more than three months ago, and Safeguard 7.2 fails if no remediation process exists or it was last reviewed more than 30 days ago. Safeguard 12.1 is measured at zero if more than thirty days have passed since the last review of network infrastructure. Before you promise a date to anyone, pull the last-updated and last-reviewed dates for each of these records. A stale file can fail a Safeguard that is otherwise working.
Your organization owns its controls and the decisions about how to meet them. An implementation partner can prepare systems, inventories and evidence so the measures can be produced on a regular cycle, but the partner does not decide whether a Safeguard passes. Only an independent assessor issues a report on the result. Ask your assessor early which evidence they will accept for each Safeguard in scope, how they will check accuracy and completeness against discovered assets, and whether they will use CIS-Hosted CSAT records. Confirm those expectations with the assessor and the CIS documentation directly, since the specification may be updated.
Where the failure thresholds bite: inventories, accounts, remediation and network reviews
Safeguard 1.1 asks the enterprise to establish and maintain a detailed asset inventory. Under the Assessment Specification, the Safeguard scores zero and fails when no inventory is provided or when the inventory was last updated more than six months ago. If an inventory is current, the assessor reports an accuracy score against discovered assets, a completeness score for detailed records, and a manual review of the procedures that keep the inventory up to date.
- Dated inventory: the record must show a last-updated date that falls within six months of the assessment.
- Accuracy against discovery: compare the inventory with what discovery tools actually find on the network, so missing or ghost assets lower the score.
- Completeness of detailed records: owner, location, network address and classification fields should be filled in for each asset.
- Procedure evidence: keep the written process for adding, changing and removing assets, along with the record of who performed each review.
- Stale record example (illustrative): an inventory exported in an earlier year, with discovery finding devices that never appear in it.
Confirm the exact fields and cadence your assessor expects with the assessment specification and your auditor before building the workflow.
Safeguard 5.1 asks the enterprise to establish and maintain an inventory of accounts. The Assessment Specification scores it as failing when no account inventory exists or when it was last updated more than three months ago. The metrics are the completeness and accuracy of the inventory, so an assessor will compare the list against the accounts that the identity systems and platforms actually hold.
- Three-month refresh: the shorter window means account reviews must run on a recurring calendar, not once a year.
- Completeness: the inventory should cover user, administrator and service accounts across directories and applications.
- Accuracy: each entry should match a live account, with disabled or departed users removed.
- Evidence to keep: exports from identity providers, the review sign-off and the change log showing additions and removals.
- Stale record example (illustrative): an account list still showing contractors whose access ended several months earlier.
Ask your identity team which systems feed the inventory and whether exports can be generated automatically on the required schedule.
Safeguard 7.2 asks the enterprise to establish and maintain a remediation process for vulnerabilities. The Assessment Specification fails the Safeguard when no remediation process exists or when the process was last reviewed more than 30 days ago. The key evidence is therefore a documented process with a visible review date, not only a record that patches were applied.
- Written process: the document should set out how findings are prioritized, assigned, tracked and closed.
- Thirty-day review: a named owner should re-confirm the process at least every 30 days and record the date.
- Linked records: tickets from scanning findings should reference the process steps they followed.
- Exception handling: accepted risks need an approver and an end date.
- Stale record example (illustrative): a remediation procedure whose revision history ends several months before the assessment, while scanners keep generating findings with no assigned owner.
Confirm with your assessor how they expect the review to be shown, such as a dated approval or a change history.
Safeguard 12.1 asks the enterprise to ensure network infrastructure is kept up to date. The Assessment Specification measures it at zero and fails it when more than thirty days have passed since the last review of network infrastructure. Because the threshold is short, the evidence must show recent, repeatable review rather than a single annual exercise.
- Recent review record: keep the date and scope of the last review of each network device class, such as firewalls, switches and routers.
- Version currency: record the firmware or software version on each device and the vendor support status.
- Supported devices: flag devices that have reached end of support, since a current review should surface them.
- Review ownership: name who performs the review and who signs off on follow-up actions.
- Stale record example (illustrative): a network review dated several months earlier, with firmware on edge devices no longer matching the vendor's current release notes.
Ask your network team to set a recurring review that falls well inside the thirty-day window and to confirm the evidence format with your assessor.
How to get a Safeguard metric from failing to passing
This sequence takes a Safeguard from an undocumented state to a dated, measurable result that the Assessment Specification can score. Each step produces a record that an independent assessor can trace back to its source.
Confirm the Safeguard and its Implementation Group
Start by reading the Safeguard in the CIS Controls v8.1 text and its entry in the Assessment Specification, so the team knows exactly which inputs, measures and metrics apply. Record the Safeguard number, its asset class, its security function and the Implementation Groups it belongs to. Confirm that the Safeguard is in scope for your organization's IG. The output is a scoping note that names the Safeguard, the owner and the metric the assessor will use.
Identify the source system for the record
Name the system or process that holds the evidence the metric depends on, such as an asset discovery tool, a directory, a configuration management database, a network diagram repository or a ticketing system. The owner should be able to export the record in a form that shows its own last-updated date. Where no system exists, the team writes the record by hand and stores it in a controlled location. The output is a documented source of truth for each input.
Set a review cadence within the stated age limit
Using the age limits in the Assessment Specification for the Safeguard, set a recurring review that completes before the last review would exceed the limit. For example, Safeguard 1.1 fails when the inventory is older than six months, Safeguard 5.1 when the account inventory is older than three months, Safeguard 7.2 when the remediation process has not been reviewed within 30 days, and Safeguard 12.1 when network infrastructure has not been reviewed within thirty days. Assign a named owner and a calendar entry. The output is a review schedule that the owner has accepted in writing.
Collect the metric inputs
Run the review against the source system and capture the inputs the Safeguard requires, such as the list of assets, accounts, remediation steps or network devices with their attributes. Export the data with a timestamp and the identity of the person or job that produced it. Keep the raw export unchanged so it can be re-checked later. The output is a dated input set for the review period.
Check accuracy and completeness
Compare the inputs against an independent view of the environment, such as a network scan for inventory, the identity provider for accounts or a sample of change records for remediation. Calculate the accuracy and completeness results the metric requires, and document any gaps with the reason for each. Where the metric includes a manual review of procedures, have a second person read the procedure and sign off. The output is a measured result with the discrepancies listed and assigned to an owner.
Retain dated evidence for the review period
Store the inputs, the comparison results, the reviewer's sign-off and the approved procedure in a repository with version control and access logging. Label each item with the Safeguard number and the review date, so an assessor can match the metric to the period it covers. Keep the record of any corrective action that followed a gap. The output is a complete evidence package that can be retrieved without rebuilding it from memory.
Have an independent assessor test the result
Ask an independent auditor or assessor to test the metric, the evidence and the review process. The implementation partner or internal team prepares the systems and records, but only the independent party issues any opinion or report on the result. Confirm the assessor's scope, the period covered and the Safeguards included before testing begins. The output is the assessor's own finding, which the organization then uses to decide what to correct.
Which metric applies to which Safeguard and what it needs
This table compares four Safeguards the assessment specification measures with age-based failure conditions: 1.1, 5.1, 7.2 and 12.1. Read each row to see what the metric tests, when the Safeguard fails regardless of its content, and what evidence keeps it passing. The main takeaway is that several of these measures fail on staleness alone, so the review cadence matters as much as the process itself.
| Safeguard | What the metric tests | Failure condition | Evidence that passes |
|---|---|---|---|
| 1.1 Detailed enterprise asset inventory | Accuracy of the inventory against discovered assets, completeness of detailed records, and a manual review of inventory procedures | No inventory is provided, or it was last updated more than six months ago | A current asset inventory with detailed records, a recent update date, and documented inventory procedures |
| 5.1 Account inventory | Completeness and accuracy of the account inventory | No account inventory exists, or it was last updated more than three months ago | A current account inventory that matches the accounts found in systems, with a recent update date |
| 7.2 Remediation process | Whether a documented remediation process exists and is kept under review | No remediation process exists, or it was last reviewed more than 30 days ago | A written remediation process with a recent review date and records showing it is followed |
| 12.1 Network infrastructure review | Whether network infrastructure is reviewed and kept up to date | More than thirty days have passed since the last review, and the Safeguard is measured at zero | A dated network infrastructure review within the last thirty days, with records of the review outcome |
Why Safeguards fail even when the controls exist
A Safeguard can have a working control and still fail the assessment specification. The failures below share one pattern: the measure is time-bound or evidence-bound, and the record lapses or does not show the process in operation. Check each measure against the dates and records your environment actually produces.
Stale asset inventories
Safeguard 1.1 is scored as failing when no inventory is provided or when it was last updated more than six months ago. Even a complete inventory fails once it ages past that limit, so the asset list needs a scheduled refresh tied to discovery output. Before an assessment, confirm the last-updated date on the inventory itself, not the date the document was drafted.
Account lists that miss service accounts
Safeguard 5.1 measures the completeness and accuracy of the account inventory and fails when no inventory exists or when it was last updated more than three months ago. Teams often list human users and omit service accounts, API identities and dormant administrator accounts, which leaves completeness scores low. Reconcile the account list against directory and platform exports each quarter.
Remediation processes not reviewed
Safeguard 7.2 fails when no remediation process exists or when it was last reviewed more than 30 days ago. A written process that sits unchanged after tooling, ownership or scanning cadence changes will not pass, even if remediation work is happening. Set a recurring review with a named owner and record each review date in the process document.
Network reviews that slip
Safeguard 12.1 is measured at zero and fails when more than thirty days pass since the last review of network infrastructure. Network reviews are easily displaced by change work and are rarely calendared as a control activity. Put the review on a fixed schedule, keep the signed output with the date, and treat a missed window as a finding to close rather than a quiet gap.
Process documented but not operating
A policy or procedure that describes a process does not show that the process runs. The assessment looks for operating evidence, such as completed review records, tickets and outputs from the tools the process names. Before an assessment, pick a recent sample of each process and confirm that the records exist, match the documented steps and cover the same period.
How CSAT records implementation for each Safeguard
CIS-Hosted CSAT tracks four dimensions for each CIS Control and Safeguard: documentation, implementation, automation and reporting. For a metric such as the Safeguard 1.1 asset inventory, documentation records whether the process for keeping the inventory exists in writing, implementation records whether the inventory is actually in place, automation records whether discovery and updates run without manual effort, and reporting records whether results reach the people who need them. The split matters because a metric can pass on paper while the underlying process has stopped. An inventory last updated more than six months ago fails the assessment specification's test regardless of how well the document describes it, so a status view that separates these dimensions helps a team see where maintenance has lapsed. Read the CIS Controls Assessment Specification first to understand which measures each dimension should feed.
Before you plan around CSAT, confirm access, licensing and the features available to your organization directly with CIS. Ask what CSAT includes, who can hold accounts, how many users are covered, and how records are exported for auditors. Those terms are not something this page can state for you, and they can change, so get them in writing as part of any quote or onboarding discussion.
CSAT records status. It does not replace testing. An independent assessor still needs to check the underlying evidence, such as the inventory export, account listings, remediation tickets and network review records, against the thresholds in the specification. Treat a CSAT entry of implemented as a claim to be verified, not a conclusion. Organizations that keep their evidence current and link each status entry to the artifact behind it usually find assessor questions easier to answer.
Who owns the metric, who prepares evidence and who tests it
A Safeguard metric is only as credible as the people behind it. The organization owns the control and its records, a partner prepares the systems and evidence, an accredited assessor may test against the specification, and an independent auditor or assessor issues any report. DeployOpen sits in the preparation role and does not issue reports, attestations or certificates.
The organization owns the Safeguard
The organization is accountable for each Safeguard, its inventories, its review dates and its remediation records. The assessment specification scores these artifacts directly, so a stale inventory or an overdue review fails the metric regardless of who installed the tooling. Name a documented owner for every Safeguard, set review cadences that match the specification's thresholds, and confirm that someone inside the organization signs off on each record.
Implementation partner prepares evidence
An implementation partner such as DeployOpen can build the inventories, configure discovery and logging, set up review workflows and export the records the specification measures. This work is fixed in a written scope before it starts. The partner does not decide whether a Safeguard passes, and it does not sign off on the organization's own measurements. Ask which records the partner will produce, where they are stored and who keeps them after handover.
CIS SecureSuite or accredited assessor
Where an organization uses a CIS SecureSuite member or an accredited assessor, that party may run the assessment against the specification and record results. CIS Controls Accreditation covers organizations providing implementation, auditing or assessment services. Confirm the accreditation status of any firm you hire, the scope of its engagement and how its findings are delivered to you, because accreditation of a provider is separate from any formal attestation of your environment.
Independent auditor issues the report
An independent auditor or assessor tests the metrics, samples the records and issues any report or certificate that a customer or regulator relies on. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme, so an auditor's scope may differ from the CIS measures. Agree the auditor, the scope and the evidence format before implementation begins, so the records you prepare match what the auditor will test.
Questions buyers ask about CIS Controls metrics
Are the CIS Controls Assessment Specification metrics pass or fail?
For several Safeguards, yes. The Assessment Specification scores certain checks as failing outright when a required record is missing or out of date. For Safeguard 1.1, the score is zero when no asset inventory exists or it was last updated more than six months ago; otherwise the specification reports an accuracy score against discovered assets, a completeness score for detailed records and a manual review of inventory procedures. Other Safeguards use the same pattern with their own thresholds. Read each Safeguard's measures in the specification directly, since the pass conditions differ by Safeguard and the specification focuses on Level 1 checks of whether a Safeguard is implemented, not how well it performs.
How often must an inventory be updated under the CIS thresholds?
The thresholds are set per Safeguard, and the specification fails a Safeguard once its record ages past the limit. For Safeguard 1.1 (the enterprise asset inventory), the limit is six months. For Safeguard 5.1 (the account inventory), it is three months. For Safeguard 7.2 (the remediation process), the review limit is 30 days, and for Safeguard 12.1 (network infrastructure review), the limit is also thirty days. Confirm each limit against the current specification for your Safeguards, because the thresholds are part of the measurement and an update cycle that looks reasonable on paper can still fail.
Can our own team run the CIS Controls metrics without outside help?
Usually yes, for organizations with staff who understand their asset, account and network records. The specification says what to measure but leaves the how to tool developers and implementers, so your team needs to choose data sources, produce the inventories and records, and collect the evidence. Common in-house gaps are missing automated discovery, unclear ownership of each record and no dated review history. Outside help is most useful when you want an independent view of whether your measurements meet the specification, or when the scope spans many systems. Confirm your own tooling and staffing before deciding.
How much internal staff effort do the metrics require?
The effort depends on how many assets, accounts and network devices are in scope, how much of their data is already collected automatically and how many people must review and sign off each record. The recurring work is the important part: inventories, account reviews, remediation process reviews and network reviews must be refreshed inside their thresholds, so the work repeats on a short cycle. Ask any partner to estimate effort by Safeguard, by system and by recurring review, and to state which tasks they would perform and which would stay with your staff. No effort figure is given here because none has been researched for this topic.
Is CIS Controls Accreditation required to measure the Safeguards?
No. The Assessment Specification is published for any organization to use, and CIS Controls content is free for organizations to use to improve their own cybersecurity, with commercial use requiring CIS's prior approval. CIS Controls Accreditation, run with CREST, applies to CIS SecureSuite member organizations that provide CIS Controls implementation, auditing or assessment services. For that accreditation, CIS lists an application fee of $1,500 for CREST members and $2,500 for non-members. Those fees apply to the provider's accreditation, not to your organization's own measurement. Ask any provider whether it holds accreditation and what that covers.
What should we ask a partner before scoping CIS Controls metrics work?
Ask for a written scope that names the Safeguards, systems and records in scope, the measurement method for each, and the deliverables. Ask which metrics will be produced as evidence, how each record will be kept current inside its threshold and who owns each recurring review. Ask what the partner prepares versus what it certifies: DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications, and an independent auditor or certification body does. Also ask how the work will be documented in CIS-Hosted CSAT or another tracking tool, and what happens after the initial scope ends.
How to scope a CIS Controls metrics project
Before you request a quote, decide which Implementation Group the project covers, because that choice sets which Safeguards carry metrics in the assessment specification. IG1 contains 56 Safeguards, IG2 adds 74 for a total of 130, and IG3 adds the remaining 23 to reach 153. An organization that is scoping to IG1 needs a different evidence set from one that is scoping to all 153, and a quote that does not name the Implementation Group is not comparable to another. Ask the partner to list, Safeguard by Safeguard, which items are in the agreed scope and which are excluded with a stated reason. Confirm also whether the project assesses the whole enterprise or a defined business unit, since the assessment specification measures against the assets and accounts that actually exist in that boundary.
Next, establish the state of your existing records, because several measures fail on age alone. The assessment specification scores Safeguard 1.1 as failing when no asset inventory exists or it was last updated more than six months ago, Safeguard 5.1 fails when the account inventory is missing or older than three months, Safeguard 7.2 fails when the remediation process was last reviewed more than 30 days ago, and Safeguard 12.1 fails when network infrastructure has not been reviewed within thirty days. Pull the last-updated dates for each of these records before the kickoff. Where a record is stale, the work plan should include the discovery, reconciliation and review cycles needed to bring it current, and the quote should show that effort separately from the evidence design work.
Finally, ask the assessor and the implementation partner which evidence will be produced, in what format and who signs it off. The partner prepares systems, procedures and evidence, while the organization owns its controls and any independent assessor or certification body issues the formal findings. Request a written deliverables list that names each evidence artifact, the Safeguard it supports, the owner inside your organization and the date the artifact is delivered. Confirm whether the work is fixed-scope, which is how most engagements are agreed, and whether ongoing measurement or retainer support is priced separately. Recurring costs include re-running discovery and refreshing reviews, so ask which items are one-time and which recur on the cadence the specification requires.
How DeployOpen prepares metric evidence for an assessment
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the inventories, account lists, remediation records and network reviews that the CIS Controls Assessment Specification measures can be produced on a schedule. We prepare systems and evidence; the organization owns its controls and any formal assessment is performed by an independent party.
How we scope
- We agree the Safeguards and metrics in scope before any work starts, in a written scope.
- The scope names which systems, inventories and review cycles feed each measured Safeguard.
- Engagements are fixed-scope, with deliverables and timelines confirmed in writing before work begins.
How we build
- We configure discovery and inventory tooling so asset and account records refresh on a defined cycle.
- We set review cadences and record dates so each measure can show its last update or review.
- We test that the evidence exports match the metrics the assessment specification describes for each Safeguard.
How we hand over
- You receive documented procedures, runbooks and evidence collection steps that your staff can operate.
- Records are organized by Safeguard so an assessor can trace each metric to its source data.
- We confirm with you which measures your own environment must still validate before an assessment.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- A retainer can keep inventories current and review cycles on schedule as systems change.
- Your organization decides when to engage an independent assessor, and we do not issue reports or certificates.
