Are the CIS Controls a legal standard of reasonable security?
When a customer, board or regulator asks whether your security is reasonable, the CIS Controls are one of the baselines they will point to. The California Attorney General's February 2016 Data Breach Report stated that the 20 controls then in the CIS Critical Security Controls identify a minimum level of information security that organizations collecting personal information should meet, and that failing to implement all applicable Controls constitutes a lack of reasonable security. Ohio, Utah, Connecticut and Iowa have named the Controls in state cybersecurity safe harbor statutes. No regulator certifies compliance with the CIS Controls, though, and the organization owns its controls, its evidence and its legal position. A safe harbor is a defense to be argued, not a certificate to be issued.
Whether the Controls settle the question depends on the jurisdiction, the sector and the data you hold. A safe harbor statute applies only in the states that enacted it, and each statute sets its own conditions for qualifying. Sector regulators, such as banking supervisors or health regulators, may require specific controls that the CIS Controls do not address, and CIS itself states that the Controls do not replace regulatory, compliance or authorization schemes. The 2016 California report also noted that larger entities and those holding highly sensitive data are expected to implement more sub-controls. Ask counsel to confirm which statutes apply to your data subjects and which sector rules add obligations, then record that answer in the risk file.
Your practical task is to show that your program is proportionate to your risk. Document which Implementation Group you selected and why, which Safeguards you have implemented and which you have accepted or deferred, and the reasoning behind each decision. CIS RAM is designed to support that reasoning in the way regulators define reasonable risk, weighing the harm incidents could cause others against the burden of the safeguards. An implementation partner can prepare the systems, configuration records and evidence, but the decisions and their legal consequences remain with your organization and its counsel.
Which state safe harbor laws list the CIS Controls
CIS states that the CIS Controls appear in cybersecurity safe harbor statutes in Ohio, Utah, Connecticut and Iowa. Each card covers one state and what to verify before relying on that statute, because a safe harbor is a legal defense that only counsel can assess for a specific incident.
Ohio safe harbor statute
CIS states that Ohio is one of four states whose cybersecurity safe harbor statutes include the CIS Controls. Such a statute generally offers a potential defense against tort claims when a business that suffers a data breach can show it maintained a written cybersecurity program that conforms to a recognized framework. Ask counsel whether the program must be documented before an incident, how the statute defines a qualifying framework, and whether the CIS Controls are named directly or through a broader reference.
Utah safe harbor statute
CIS states that Utah's cybersecurity safe harbor statute also lists the CIS Controls. The practical question for a Utah business is whether its program covers the scope the statute expects, including the systems that hold personal information. Confirm the statute text directly, check which entities it applies to, and ask counsel whether the defense depends on the program being in place at the time of the breach rather than adopted afterward.
Connecticut safe harbor statute
CIS announced in 2021 that Connecticut became the third state to incentivize cybersecurity best practices, and CIS states that the CIS Controls are included in its statute. Organizations operating in Connecticut should confirm the statute text, its effective terms and any conditions on how the program is documented. Keep evidence of the program that maps to the Safeguards you claim, since counsel will ask what the business actually did.
Iowa Code section 554G.3
Iowa Code section 554G.3 lists the CIS Critical Security Controls alongside the NIST cybersecurity framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP security assessment framework and the ISO/IEC 27000 family as qualifying frameworks. An organization can therefore point to any of these, not only the CIS Controls. Read the chapter text, since it defines the conditions under which a program qualifies.
How CIS RAM supports a due care argument
CIS RAM is the method CIS offers for analyzing risk in the way regulators define as reasonable. According to CIS, it weighs the harm that an incident may cause to others against the burden of the safeguards that would prevent or reduce it. That balance is the core of how regulators, litigators and judges reason about due care and the reasonable person, which is why CIS presents the method as a way to support those concepts. For a CISO or general counsel, the practical value is that the organization can show a documented, repeatable decision process rather than an unexplained statement that its security was adequate. The first step is to confirm which RAM documents match your scope, since the method is published as a family of documents, and to read the CIS RAM FAQ before relying on any of its wording.
A risk assessment documents reasoning. It does not prove reasonableness. A completed workbook can show who was involved, which assets and threats were considered, how the likelihood and impact of harm were estimated, which safeguards were judged necessary, and why others were deferred. Those records are valuable if they are current, signed off by the right owners and tied to real controls. They are weak if the assessment is dated, the scope omits systems that hold sensitive data, or the recorded safeguards are not in place. Before the assessment is used in any dispute or regulatory discussion, confirm that each safeguard it cites can be shown operating, for example through the evidence described in the CIS Controls metrics material.
Whether and how the assessment is used is a legal decision, not a technical one. Counsel decides whether the document is privileged, how it is described to a regulator or court, and whether it should be commissioned under counsel's direction. Security teams should ask counsel these questions early: who will own the assessment, how it will be version controlled, how decisions to accept residual risk will be approved, and what the organization will say if an incident occurs between assessment cycles. An implementation partner can help prepare systems and evidence, but the organization owns its risk decisions and any conclusion about whether its security was reasonable is for counsel and the courts to reach.
Who owns the baseline, who documents it and who attests
The organization owns its security controls, makes the risk decisions and keeps the records that show how it reached them. No outside party can accept risk on the organization's behalf, and a regulator, court or customer will ask the organization, not its vendors, what it decided and why. The CIS Controls are free to use for an organization's own cybersecurity, so the organization can apply them directly with its own staff.
- Control ownership: Named owners for each Safeguard in scope, with authority to change configurations, access and processes.
- Risk acceptance: Written decisions, signed by an accountable executive, for any Safeguard that is not fully implemented and the reasons for accepting the gap.
- Records: Policies, asset inventories, access reviews, change records and exception logs kept in a form that can be produced on request.
- Method choice: Selection of the risk method, such as CIS RAM, and the scope it covers.
- Governance: Board or committee review of the baseline on a regular cycle.
Check that every in-scope Safeguard has a named owner and that the risk acceptance records are signed by someone with authority to accept the risk.
An implementation partner such as DeployOpen works inside the scope the organization agrees in writing. It can prepare systems, configurations and evidence, and it can help run a CIS RAM assessment within that scope. The partner does not own the controls, does not decide what risk is acceptable and does not issue audit reports, attestations or certifications. Those outputs belong to the organization and to independent parties.
- System preparation: Hardening, logging, access configuration and backup设置 on self-hosted open-source platforms in the client's own environment.
- Evidence preparation: Exports, configuration snapshots and procedure documents that show how a Safeguard operates.
- Assessment support: Facilitation and documentation for a CIS RAM assessment, where the scope and deliverables are fixed in advance.
- Gap work: Remediation of technical gaps the organization has chosen to close.
- Handover: Documentation the organization's staff can run after the engagement ends.
Confirm the written scope, the named deliverables and who signs each output before work starts, and confirm that the partner will not be the party presenting the baseline to a regulator as independent evidence.
Two kinds of independent party matter here. Legal counsel advises on whether the organization's baseline supports a safe harbor or due care argument in a specific jurisdiction and dispute. An independent auditor, assessor or certification body examines the evidence and issues any report that a customer or regulator requires. Neither role can be filled by the implementation partner, and hiring a partner does not guarantee a legal outcome.
- Legal counsel: Advice on state safe harbor statutes that name the CIS Controls, such as those in Ohio, Utah, Connecticut and Iowa, and on how a court may weigh a due care argument.
- Independent assessor: Testing of the organization's implementation against an agreed method, with findings and a report.
- Certification bodies: Where a certificate is required, issuance by a body that is independent of the implementation work.
- Litigation support: Expert testimony, which must come from a party with no conflict in the engagement.
- Scope limits: Clarity on which framework or statute the independent work measures against.
Ask counsel which statute applies to your organization and ask any assessor whether it is accredited for the work it will perform.
Building a due care file the organization can defend
This sequence turns the Controls from a checklist into a dated record showing which Safeguards apply, how the organization weighed the risk, what it built, and how it keeps that position current. The result is a file that a regulator, customer or court can examine and follow.
Define the systems and data in scope
The organization, usually through its security lead with input from IT operations and the data owners, lists the systems, cloud accounts, business units, and data sets the due care argument will cover. It records which of them hold personal or other sensitive information, which support critical processes, and which connect to third parties. The output is a dated scope statement with an asset list and a short note on any exclusions and the reason for each. The step is complete when the data owners have signed off on the boundary.
Select Safeguards by implementation group
Using the CIS Controls Implementation Groups, the team maps the in-scope environment to a baseline. IG1 is the minimum for every enterprise, so all 56 IG1 Safeguards are recorded as applicable unless a documented reason says otherwise. The team then decides whether IG2 or IG3 Safeguards are required, based on the sensitivity of the data, the complexity of operations and the threats the business faces. The output is a Safeguard applicability register listing each Safeguard, its implementation group, whether it applies, and the justification for any that do not.
Run the CIS RAM assessment
The risk owner works through CIS RAM to analyze the risk to the scoped systems and data, weighing the harm an incident could cause to others against the burden of each safeguard. The team records the threats considered, the likelihood and impact reasoning, and the risk treatment chosen for each finding, whether that is mitigate, accept, transfer or avoid. The output is a signed risk assessment and a risk decision log. The step is complete when every high-impact finding has an owner and a recorded treatment decision.
Implement and document each safeguard
Engineering and operations teams put the selected Safeguards into effect and write down how each one works in the organization's own environment. Written policies and procedures are approved and version controlled. The output is an implementation record for each Safeguard that names the system, the control owner and the configuration in place. Confirm with the CIS Controls Assessment Specification which inputs, operations and measures it expects for each Safeguard, so the record can be tested against them.
Collect evidence against the assessment specification
For each Safeguard, the team gathers the artifacts the Assessment Specification names as inputs and runs the operations it describes, such as exporting asset inventories, account lists, scan results, log samples and change tickets. Evidence is stored with the date of collection, the system it came from and the name of the person who collected it. Open-source tools such as scanners, inventory exporters and log platforms can produce much of this material, but each tool's output must be verified against the environment it describes. The output is an evidence index that maps each artifact to its Safeguard.
Review gaps and record remediation decisions
The team compares the evidence to the Safeguard measures and the risk decisions from the assessment. Where a measure fails, the team opens a remediation item, assigns an owner and records whether the gap is closed, accepted with approval, or transferred. Management reviews the accepted risks and signs them off. The output is a gap register with dated status changes and signed acceptance records. An independent assessor or auditor can test this register, but the organization owns the decisions.
Schedule reviews and retain dated records
The organization sets a review schedule that suits its risk profile and triggers an earlier review after significant changes, such as a new system, a material incident or a change in data sensitivity. Each review repeats the scope check, re-tests the Safeguard measures and updates the risk assessment. The output is a versioned due care file where every decision, artifact and approval carries a date. Confirm retention periods with legal counsel, since the file is the record the organization will rely on if its diligence is questioned.
What the CIS Controls do not establish
Adopting the CIS Controls does not, by itself, satisfy any regulatory, compliance or authorization scheme. CIS says so directly in its FAQ: the Controls do not replace those schemes. A reasonable security baseline is a defensible starting point for a due care argument, but it is not a certificate, an audit opinion or a legal exemption. The organization still owns the decision about which requirements apply to it and must show, with its own evidence, that it meets them. Before relying on the Controls in a contract, a regulator's inquiry or a court filing, confirm with counsel and the relevant supervisor exactly which obligations apply to your entity and sector.
Sector regulators frequently ask for more than a general baseline. A bank supervised under DORA, an essential or important entity under NIS2, or a healthcare organization handling protected health information may face specific technical, reporting, testing or third-party requirements that the Controls do not address in full. CIS maintains mappings from the Controls to frameworks such as NIST CSF 2.0, ISO/IEC 27001:2022 and PCI DSS v4.0, available through the CIS Controls Navigator. Use these mappings as a starting point to check each regulatory requirement against your current Safeguards, then confirm the mapping against the framework text and your regulator's guidance. Treat any gap as a finding to plan for, not as covered by the mapping.
Licensing also limits how you can use the Controls. CIS content is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, and commercial use requires CIS's prior approval. CIS states the Controls are free for any organization to use to improve its own cybersecurity, so an internal program is generally straightforward. However, a consultancy that packages the Controls into a paid service, or a vendor that embeds them in a commercial product, should confirm its use with CIS before work begins. Ask any implementation partner to state in writing how it will use CIS material in your engagement.
Questions buyers ask about reasonable security and the CIS Controls
Does a regulator certify CIS Controls compliance?
No. No regulator issues a CIS Controls certificate, and CIS itself states that the Controls do not replace any regulatory, compliance or authorization scheme. The Controls are a set of prioritized security practices that regulators, courts and contracts can point to as a benchmark. Some regulators have referred to them directly, such as the California Attorney General's 2016 breach report, which said that failing to implement all applicable Controls constitutes a lack of reasonable security. Your obligation is to show that your own program meets the relevant standard, and the evidence you keep is what carries that argument. Ask your regulator or counsel which framework they expect you to measure against.
Is IG1 enough to show reasonable security?
IG1 is the minimum, not the ceiling. CIS defines Implementation Group 1 as essential cyber hygiene and a minimum standard for every enterprise, and it contains 56 of the 153 Safeguards. Whether it is enough depends on the data you hold, the harm an incident could cause and the attacks you face. Organizations holding sensitive information often need the 74 Safeguards IG2 adds, and those with security specialists facing targeted threats may need the IG3 additions. The California report noted that larger entities and those holding highly sensitive data are expected to implement more sub-controls. A CIS RAM assessment helps you document why a given Implementation Group is proportionate to your risk.
What does a CIS RAM assessment need from our team?
It needs people who know your assets, data flows, vendors and current controls, plus someone accountable for the decisions. CIS RAM asks you to analyze risk in the way regulators define as reasonable, weighing the harm incidents may cause others against the burden of safeguards. In practice, your team supplies an asset and data inventory, a list of the systems and business processes in scope, current security practice for each Safeguard, and leadership input on risk tolerance. Expect to record who reviewed each judgment and when. The IG1 workbook is a lighter starting point for small programs. Confirm with CIS which document fits your size before you start.
Can DeployOpen attest to our compliance?
No. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications. Only an independent auditor, assessor or certification body can issue those. Your organization owns its controls and makes the risk decisions. Engagements are normally fixed-scope, with scope and deliverables agreed in writing before work begins, so you can see exactly what is prepared and what your assessor will still need to test.
How do we know if our state's safe harbor lists the Controls?
Read the statute itself and confirm the current text with counsel. CIS reports that the Controls have been included in state cybersecurity safe harbor laws in Ohio, Utah, Connecticut and Iowa. Iowa Code section 554G.3, for example, lists the CIS Critical Security Controls alongside the NIST cybersecurity framework, NIST SP 800-171, NIST SP 800-53, FedRAMP and the ISO/IEC 27000 family as qualifying frameworks. Each statute sets its own conditions, such as how a program must be documented and maintained, and whether it applies to your sector or size. Lists can change, so check the state legislature's published code rather than relying on secondary summaries.
What does preparing this evidence cost and what drives it?
Cost depends mainly on scope, the current state of your evidence and how much work is done in-house. Your costs fall into three groups: internal staff time for inventories, decisions and reviews; any outside help to prepare systems and evidence; and the independent assessment or audit, if one is required, which is paid to the assessor. The main drivers are the number of in-scope systems, the Implementation Group you target, how well your asset inventory and documented processes already exist, and how many open-source platforms you deploy or integrate. Ask any provider for a written scope listing the Safeguards, systems, deliverables and timeline. DeployOpen does not publish a price list, and a quote follows from that written scope.
How DeployOpen prepares CIS Controls evidence
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, so the Safeguards behind your reasonable security position can be shown with evidence. We prepare systems, controls and records for assessment; the organization owns its controls, and only an independent assessor or auditor reaches a conclusion about them.
How we scope
- We agree in writing which CIS Controls and Safeguards, and which Implementation Group, the engagement covers before work starts.
- We map each in-scope Safeguard to the systems, owners and records that show it is implemented in your environment.
- Engagements are fixed-scope, so deliverables and timelines are confirmed in the written scope before any build begins.
How we build
- We implement and harden the open-source platforms that produce inventories, logs, configuration baselines and access records.
- We configure collection so that evidence is generated routinely, not assembled by hand at audit time.
- We test controls against the assessment specification's measures where the scope calls for it, and report gaps we find.
How we hand over
- We document the processes, configurations and evidence locations so your staff can explain each Safeguard to an assessor.
- We provide an evidence index that links each in-scope Safeguard to the records that support it and their owners.
- Your organization retains ownership of the controls, the risk decisions and the final assessment conclusions.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial handover.
- Retainers can keep platforms patched, evidence collection running and documentation current as your environment changes.
- Before you engage, ask us to confirm scope, deliverables and ownership of each record in the written proposal.
