Can a small team run a CIS RAM IG1 risk assessment without a consultant?
Often yes, at least for the assessment itself. CIS RAM v2.1 for IG1 is free for any organization to use for a cyber risk assessment, and CIS aims the document at enterprises with limited security expertise that want to justify investments in the CIS Controls, define an acceptable level of risk or show due care after a breach. A team that can read a workbook, gather its asset and data facts and hold a disciplined discussion can complete the work in-house. The harder question is whether the result will carry the weight the customer, contract or board expects. Four factors change that answer: the number of systems in scope, whether sensitive customer or financial data sits inside the boundary, how the results will be used, and whether a customer or regulator expects an independent party to review the work. A small set of laptops and one SaaS tool is a different exercise from a multi-site estate with payment or health data.
Before deciding, check three things. First, confirm with the requesting party exactly what they will accept as evidence, since CIS RAM is one method and CIS notes it does not have to be the only one a company uses. Second, decide who owns the risk decisions. The organization must accept, mitigate, transfer or avoid each risk and record why, and no workbook or consultant can make those decisions on its behalf. Third, decide whether an independent review is needed. CIS does not certify organizations or issue reports, and a CIS Controls Accreditation listing covers CIS SecureSuite member services, not the outcome of any individual assessment. Ask any outside party what they will prepare, such as an asset list, a risk register and a remediation plan, and what they will explicitly not do.
An implementation partner can help with the parts that take the most time for an inexperienced team: preparing system inventories, setting up records of the decisions made and collecting the configuration and account evidence that supports the answers in the workbook. That work is scoped in writing before it starts. The partner does not issue an assessment report or attestation, and it does not decide the organization's risk appetite. If the assessment will be reviewed by a customer, a regulator or a court, the organization should plan for that review as a separate engagement, with the independent party confirmed before the work begins.
How CIS RAM Core, the IG1 document and the IG2 and IG3 documents relate
The CIS RAM family has one foundation and three profile-specific documents. Core sets out the principles and practices, and each Implementation Group document applies them to an enterprise of a given size and maturity. Read Core first if you are new to risk assessment, then pick the document that matches your enterprise.
CIS RAM Core
Core is the bare-essentials version of CIS RAM. It covers the principles and practices of a CIS RAM risk assessment and is the foundation for the other documents in the family. Read it before the IG1 workbook so you understand why the workbook asks what it asks. Core does not replace the profile-specific workbook. Check that your team has the Core guide and the IG1 guide from the same CIS RAM version (v2.1) before you start.
CIS RAM v2.1 for IG1
The IG1 document targets small to medium enterprises with limited IT and cybersecurity expertise, low tolerance for downtime and mostly employee and financial data to protect. Each document includes a workbook with a guide, examples, templates and exercises. For a small security program, this is the document most teams should start with. Confirm that your enterprise matches the IG1 profile before you use it, because a team with more complex operations or sensitive data will get more from IG2.
CIS RAM v2.1 for IG2
The IG2 document targets enterprises with more operational complexity that often hold sensitive information. IG2 adds Safeguards to the IG1 baseline, so its risk assessment covers a wider set of systems, data and processes. Choose IG2 if your organization has grown beyond the IG1 profile, has multiple business units or handles data that a regulator or customer treats as sensitive. A team that adopts IG2 should still use Core as its method reference.
The IG3 document
CIS described the IG3 document as under development when it released CIS RAM v2.1. IG3 targets enterprises with security specialists and regulated, sensitive assets facing sophisticated, targeted attacks. Do not plan an assessment around the IG3 document until you have confirmed its current status on cisecurity.org. If it is not yet published, a team in the IG3 profile can use Core with the IG2 document as an interim reference, and should document that choice.
How a small team runs the IG1 assessment, step by step
This sequence takes a small team from a defined scope to a documented risk register and treatment plan, using the CIS RAM IG1 workbook and guide in the order they are meant to be read and applied.
Confirm the scope and the business systems
Agree in writing which part of the enterprise the assessment covers, which business services and locations are included, and which systems and data sets matter most to operations. The owner is the executive sponsor, with input from whoever runs IT day to day. The output is a short scope statement that names the included systems, excluded systems and the reason for each exclusion. The step is complete when the sponsor has signed off the statement and the team can point to it when a question about boundaries comes up later.
Read the guide and work through the examples
Before touching the workbook, the team reads the IG1 guide from start to finish and works through its examples, templates and exercises. The goal is to understand the vocabulary, the scoring approach and the reasoning behind each column, so that later entries are consistent rather than improvised. Assign one person to keep a short glossary of terms the team finds unclear. The output is a shared understanding recorded in that glossary, and a note of any guidance the team cannot interpret for its own environment, to raise with an outside party if one is involved.
Identify assets and the information they hold
Using the scope statement, list the enterprise assets in scope, including devices, software, cloud accounts, accounts and the data types each one stores or processes. IG1 is written for mostly employee and financial data, so start there and add anything else the business handles. Staff who administer the systems should review the list, because they usually know what exists that the documentation does not. The output is an asset and information inventory with an owner recorded against each entry. The step is done when every in-scope system appears once and has a named owner.
List threats and the consequences that matter
For each asset group, the team names the threats it could realistically face, such as credential theft, ransomware, misdirected payments or accidental deletion, and describes the consequence to the business in plain terms: downtime, loss of customer data, missed payroll, regulatory exposure. Consequences should be written in the language managers use, because the impact scoring that follows depends on them. The output is a threat and consequence list tied to the asset inventory. The step is complete when each asset group has at least one threat and one consequence recorded and a manager has reviewed them.
Record likelihood and impact with the guide's method
Score each threat for likelihood and for impact using the scales and worksheets defined in the IG1 guide, not a scale invented by the team. Record the reasoning next to each score so a reviewer can see why it was chosen and can challenge it later. Where the team lacks evidence, such as incident history, mark the score as an estimate and note what would confirm or change it. The output is a scored risk register that links each risk to its asset, threat and consequence. The step is complete when every risk has both scores, a rationale and an evidence note.
Decide which risks to treat and in what order
Use the scores to decide, for each risk, whether to reduce it, accept it, transfer it or avoid it, and then rank the risks that will be reduced. The guide's examples show how the IG1 Safeguards map to common treatments, which helps the team decide where a Safeguard is the right response. Management should approve any risk that is accepted, and the approver's name goes in the register. The output is a treatment plan with the chosen option and sequence for each risk. The step is complete when every risk has a decision and every accepted risk has a named approver.
Document decisions and assign an owner to each action
Record every treatment action with an owner, the Safeguard or control it relates to, and the evidence that will show it is done, such as a configured setting, a signed policy or a test result. Store the scope statement, register and plan together so an auditor, customer or regulator can follow the chain from asset to decision. Ask any outside party to confirm in writing what they will review and how long their work will take, because timelines depend on the team's own availability and the size of the environment. The output is a complete assessment record, reviewed and approved by the sponsor, with dates for the next review set by the team.
Run the workbook in-house or bring in outside help: which fits
This table compares three ways to complete the CIS RAM IG1 workbook: fully in-house, in-house with an outside review, and led by an outside consultant or implementation partner. Read each row against your team's skills, system count, customer expectations and deadline, then check what the organization must still own under each option.
| Factor | Fully in-house with free CIS materials | In-house with outside review before sign-off | Outside lead for assessment and evidence |
|---|---|---|---|
| When it fits | Small estate, someone with general IT knowledge can read the guide, no customer requires independent review | Team can do the work but wants a second view on scope and risk ratings before management approves | Team lacks time or risk expertise, a customer or contract expects outside input, or the deadline is tight |
| Staff time | Highest internal time, since the team learns the method while completing it | Moderate internal time, with extra effort to prepare the scope and risk register for review | Lower internal time, but staff must still supply asset knowledge, interviews and decisions |
| Fees | No consultant fees, though the CIS materials are free to use | Limited review fee, scoped to the scope and risk register rather than the full assessment | Fixed-scope fee for the assessment and evidence preparation, agreed in writing before work starts |
| Who owns the risk decisions | Management, based on the team's analysis | Management, after considering the outside review | Management still accepts the risk and sets tolerance. The partner advises but does not own the decisions |
| Who owns the evidence | Internal team, kept with the workbook | Internal team, with the reviewer's comments recorded | Organization owns the evidence files and must be able to explain them to customers or auditors |
| What to confirm before choosing | Whether the team can name its assets, data and critical services without help | Which parts the reviewer will check, and whether comments must be answered in writing | Exact scope, deliverables, the staff hours expected from your side and the terms for handover |
| Limit to remember | No independent check on the results, which may matter for a customer or litigation | The reviewer does not validate the whole assessment or certify the outcome | Outside help does not replace the organization's own accountability for its risk |
What your team owns, what a partner prepares and what an independent party issues
Your organization owns the risk assessment. CIS RAM is a method you apply to your own environment, so the people accountable for the business should make the judgments that drive it. That includes deciding which assets and data matter most, how likely and how damaging each risk is, and how much residual risk leadership is prepared to accept. Those decisions belong to named individuals, not to a consultant or a workbook.
- Risk decisions: Agree the scope, the assets in it, the threats you consider and the impact ratings you assign to downtime and data loss.
- Risk acceptance: Record which risks you will accept, with the reason and the person who accepted them.
- Treatment owners: Name one accountable owner for each treatment, with a due date and a budget line.
- Sign-off: Have an executive approve the final assessment and the treatment plan, and keep the approved version with its date.
- Review: Set the trigger for revisiting the assessment, such as a major system change or an incident.
Before you engage anyone, confirm that the named decision makers can explain the risks in their own words.
An implementation partner such as DeployOpen prepares the systems, records and draft material that your team reviews. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so it can help produce the inventories and configuration records that feed an IG1 assessment. DeployOpen prepares systems and evidence. It does not issue audit reports, attestations or certifications, and it does not make your risk decisions.
- Systems preparation: Stand up or harden the platforms that the workbook questions point to, under your change control.
- Inventories and records: Compile asset lists, account lists and configuration records from the environment as it is.
- Workbook drafts: Prepare draft answers to the IG1 workbook questions from evidence, marked clearly as drafts for your review.
- Evidence packaging: Organize the screenshots, exports and logs that support each answer, with dates and sources.
- Handover: Document how the records are produced so your staff can repeat the process.
Ask the partner to state in the written scope which deliverables are drafts, who approves them and that no report or certificate is part of the work.
CIS RAM is a method your organization applies to itself. It is not a certification, and nothing in the method requires an outside assessor. You only need an independent party when a customer, contract or regulator asks for one. In that case, the independent party tests your work and issues whatever report or certificate the request calls for. No other party in this engagement can issue one.
- Only the independent party issues reports: An auditor, assessor or certification body is the sole source of any report, attestation or certificate.
- Engagement trigger: Bring in an outside assessor only if a specific customer or regulator requires it, and confirm the exact deliverable they expect.
- Independence of the tester: The assessor should not design the controls it tests or prepare the evidence it reviews as its own work.
- Scope agreement: Agree in writing which Safeguards, systems and time period the independent party will examine.
- Cost ownership: Assessor fees are paid by your organization directly to the assessor, and they are separate from any implementation fees.
Confirm with the requesting customer or regulator which party they accept, since some will only recognize an assessor they have approved.
Where small programs get stuck in an IG1 risk assessment
Small programs rarely fail the CIS RAM IG1 workbook because the questions are hard. They stall on scope, missing inventories, unexplained scores, unowned decisions, stale results and confusion about what a self-run assessment proves. The cards below name each problem and the step that keeps the assessment useful.
Scope drawn too broadly or narrowly
Teams either try to assess the whole company at once or pick only the server they already trust. Start with the systems that hold employee and financial data, the ones IG1 describes as typical for a small enterprise, and write down what is in and out of scope. Record the reason for each exclusion so a reviewer can see the boundary was a decision, not an oversight.
No inventory to analyze
A risk assessment cannot rank risks to assets nobody has listed. Before scoring, build a basic list of devices, software and accounts, using the IG1 Safeguards for enterprise asset and software inventory and account management as the checklist. Mark which items are unknown rather than leaving them out. Gaps in this list are themselves a finding to carry into the risk register.
Risk scores with no stated basis
A rating of high or medium means little unless the reader can see how it was reached. For each risk, write the likelihood reasoning, the impact on the business and the evidence used, such as a missing multifactor setting or an unpatched system. Keep the rating method in one place so two people scoring the same risk reach comparable results.
Treatment decisions without an owner
A workbook can list a planned fix that no one is responsible for delivering. Assign each risk treatment a named person, a decision (reduce, accept, transfer or avoid) and a review date. If the owner is an outside provider, record that provider and what it is responsible for. Unowned treatments are the most common reason an assessment produces no change.
Workbook completed once and never revisited
A new hire, a new cloud account or a retired laptop changes the risk picture within weeks. Set a recurring point, tied to the assets and accounts reviews the IG1 Safeguards already call for, to update the scope, inventory and scores. Note the date of each revision so the current version is never confused with an earlier one.
Self-run assessment mistaken for attestation
A completed CIS RAM workbook is an internal risk analysis. CIS states that CIS RAM does not have to be the only method a company uses, and it does not produce a certificate or report that a customer will accept as proof of compliance. If a contract or regulator asks for independent evidence, confirm with the requester which form is required before treating the workbook as sufficient, and budget for an independent assessor if it is.
Using the IG1 risk register to pick Safeguards and show progress
The risk register from the IG1 workbook is the bridge between a risk decision and the work that reduces it. Each high-priority risk should be linked to the IG1 Safeguards that address it. IG1 contains 56 essential cyber hygiene Safeguards in CIS Controls v8.1, so most small programs will find that a handful of Safeguards answer several risks at once. For each risk, record the Safeguards chosen, a single named owner accountable for delivering them, and the evidence each Safeguard would produce, such as an asset inventory export, a list of active accounts reviewed with a date, or a documented backup restore test. Writing the evidence down before work starts keeps the register honest, because a Safeguard without an agreed artifact is hard to show as done later.
The Assessment Specification is the reference for turning those Safeguards into measurable checks. It defines measures for each Safeguard, but CIS states that it covers what to measure, not how. Your team therefore decides the method, tooling and sampling approach, and should document those choices next to each register entry so an assessor or a successor can repeat the check. Confirm the current measures for each chosen Safeguard in the CIS Controls Assessment Specification before you define the evidence, since the specification is the source of truth for what the measure asks.
Treat the register as support for a risk decision, not as proof of compliance. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. If a customer, regulator or contract asks for a specific framework, use the CIS Controls Navigator to see how CIS maps Safeguards to that framework, and confirm each mapping against the framework text and with your assessor before relying on it. Review the register on a fixed schedule, for example after each change to systems or staff and at least once a year, and record which Safeguards moved from planned to implemented, along with the evidence that supports each change.
Questions small teams ask before running CIS RAM for IG1
Does the CIS RAM IG1 workbook cost anything to use?
No. CIS describes CIS RAM v2.1 as free for any organization to use for a cyber risk assessment, and it is free to use to improve your own cybersecurity posture. The workbook and guide are published by CIS, so the license cost is zero. What you do pay for is the staff time to complete the work and, if you hire help, the consultant's fees. Those depend on how many systems, locations and people are in scope and on how much of the assessment your own team can do. Confirm the current terms on the CIS RAM FAQ before you build a budget.
How long does a CIS RAM IG1 assessment take?
No duration is published for this work, so plan it around your own staff and calendar. The effort depends on how complete your asset and account inventories already are, how many business processes you need to review, and how many people must agree on risk decisions. A team that has never inventoried its devices or accounts will spend more time on preparation than on the workbook itself. Ask your leadership to set a review date, schedule working sessions with the people who own systems and data, and treat the first run as a learning exercise you can repeat.
What does the team need before starting the assessment?
Three things matter most. The first is an accurate inventory of devices, software, accounts and data locations, because the workbook asks you to reason about what you actually run. The second is a named sponsor with authority to accept risk and fund fixes. The third is protected time for the people who make risk decisions, since the assessment only produces value when someone decides what to accept, reduce or transfer. Gather the inventory first, even if it is rough, and note its gaps as findings rather than delaying the start.
Can a small team run the CIS RAM IG1 assessment without outside help?
Yes, a small team can complete the assessment itself. CIS designed the IG1 document for enterprises with limited IT and cybersecurity expertise, and the workbook comes with a guide, examples and templates. CIS also states that CIS RAM does not have to be your only method for assessing information security risk. The caveat is expectations. If a customer, auditor or regulator asks for a specific assessment method or independent review, an internal assessment may not satisfy them. Check those requirements before you decide who performs the work.
Does a CIS RAM IG1 assessment count as a compliance audit?
No. A CIS RAM assessment is a risk analysis, not an audit, and it does not issue a report or certificate. CIS states that the CIS Controls do not replace any regulatory, compliance or authorization scheme. If a framework such as ISO/IEC 27001, SOC 2 or a sector regulation applies to you, the assessment can inform that work, but the relevant independent auditor or certification body still performs the formal evaluation. Ask your compliance lead which evidence those bodies will expect before you finish the workbook.
How does CIS RAM IG1 differ from CIS RAM Core?
CIS RAM Core is the bare-essentials document that covers the principles and practices of CIS RAM risk assessments, and it is the foundation for the rest of the CIS RAM family. The IG1 document applies those principles to the Safeguards in Implementation Group 1, with a workbook and guide built for a small enterprise. Start with the IG1 workbook if you are new to risk assessment and your scope is essential cyber hygiene. Read the Core document when you need to understand the method well enough to adapt it, or when your program outgrows IG1 and you move to the IG2 or IG3 documents.
When should we bring in an implementation partner or consultant?
Bring in help when the internal team cannot provide the inventory, risk decisions or evidence that the assessment needs, or when a customer or regulator expects outside involvement. DeployOpen works on self-hosted open-source platforms inside your own infrastructure. It can plan and implement the systems, controls and documentation that support an assessment, and it runs security testing. It does not perform the CIS RAM assessment as an independent review, and it does not issue audit reports or certifications. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that written scope.
How DeployOpen prepares systems and evidence for an IG1 risk assessment
DeployOpen helps organizations prepare the systems, records and evidence that an IG1 risk assessment draws on, inside the client's own infrastructure. The organization owns its risk decisions and its Safeguards, and DeployOpen works to the written scope agreed before any work starts.
How we scope
- Agree in writing which IG1 Safeguards and asset groups the risk assessment will cover before work begins.
- Confirm which systems, cloud accounts and data sets sit inside the assessment boundary and which sit outside it.
- Identify the people who own risk decisions, so the workbook answers reflect accountable owners rather than assumptions.
How we build
- Prepare the inventories of devices, software, accounts and data that the workbook's answers depend on.
- Set up the logging, backup and configuration records that show current state for each IG1 area in scope.
- Test the collected records against the assessment specification's measures to check they are complete and current.
How we hand over
- Deliver the completed workbook, supporting records and a written list of open gaps with owners named by the client.
- Document how each answer was reached, so an internal reviewer or outside assessor can trace it to its source.
- Walk the client's staff through the workbook and guide so they can repeat the assessment on their own schedule.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement closes.
- Re-run the risk assessment on a schedule the client sets, updating records as systems and staff change.
- Confirm with the client and any independent assessor which evidence they will accept before the next review cycle.
