What is CIS RAM and does your organization need it?
A customer, board or counsel is asking for a documented, reasonable risk assessment tied to the CIS Controls. CIS RAM (the CIS Risk Assessment Method) is the method the Center for Internet Security published for designing and evaluating an implementation of the CIS Controls, and CIS describes it as free to use. The question for your organization is whether a CIS RAM assessment gives you the documented reasoning your stakeholders expect, or whether another method already in use covers the same ground. CIS states that CIS RAM does not have to be the only method you use to assess information security risk, so it can sit alongside your existing risk program rather than replace it.
Plan the cost as internal staff time first. Your team will gather asset and threat information, decide how much harm each scenario could cause, weigh the burden of each safeguard, and record the acceptable level of risk. Those decisions belong to your organization, and so does the sign-off. Outside help is optional. An implementation partner can help configure the workbooks, prepare the supporting inventories and draft the records, but it cannot make the risk decisions or certify the result. Ask any partner to put in writing which tasks it performs, which decisions remain with your staff and whether it will produce anything that a regulator or auditor would rely on. Confirm with CIS which CIS RAM documents match your Implementation Group before you size the work.
Which CIS RAM document fits your organization
The CIS RAM family starts with a core method and adds Implementation Group documents for different levels of security maturity. Choose the document that matches your program's size and complexity, then confirm what each one assumes before you begin the assessment.
CIS RAM Core as the foundation
CIS RAM Core sets out the principles and practices of a CIS RAM risk assessment and underpins every other document in the family. It suits teams that already run risk assessments and want to understand the method before choosing an Implementation Group workbook. It assumes you can define assets, threats and the harm an incident would cause, and that you can document how you reached each judgment. Check whether your risk owners will accept its reasoning before you adopt it for a regulator or litigation file.
CIS RAM v2.1 for IG1
The IG1 document applies CIS RAM to the essential cyber hygiene Safeguards that CIS defines as a minimum standard for every enterprise. It suits small security programs and organizations with little security expertise that need a structured first risk assessment. It assumes the organization has basic asset knowledge and can name its critical systems and data. Confirm with your team that the IG1 Safeguards match the systems you actually run before relying on the results.
CIS RAM v2.1 for IG2
The IG2 document extends the method to the additional Safeguards that suit enterprises with more operational complexity, often holding sensitive information. It suits organizations that already operate the IG1 Safeguards and have dedicated IT or security staff managing several business units or cloud environments. It assumes the organization can maintain inventories and documented processes across those units. Expect the assessment to require more interviews, evidence collection and risk owner decisions than the IG1 workbook.
IG3 document still under development
CIS describes the CIS RAM v2.1 document for IG3 as under development, so it is not a finished option at the time of writing. IG3 targets enterprises with security specialists and regulated, sensitive assets facing sophisticated, targeted attacks. Until CIS publishes it, organizations in that category can use CIS RAM Core and the IG2 document as a base, and should confirm the current status on the CIS site. Ask any assessor or consultant how they will document differences from the unpublished IG3 guidance.
v2.1 upgrade of the 2021 documents
CIS released CIS RAM v2.1 in 2022, upgrading the v2.0 documents first released in October 2021. Teams that completed a CIS RAM assessment on v2.0 should compare their documents against v2.1 before reusing results. The upgrade affects which document version an assessor will expect to see in your file. Confirm the version number printed on every workbook and report you submit, so the record matches the method you claim to have followed.
What a CIS RAM assessment costs and who gets paid
This table compares the cost components of a CIS RAM assessment, showing who is paid for each, whether the cost is one-time or recurring, and what drives it up or down. The method itself is free to use according to CIS, so most of the spend goes to people, facilitation, remediation and any independent assessment you choose to commission. Request written scope quotes for each row before work starts.
| Cost component | Who is paid | One-time or recurring | What drives it |
|---|---|---|---|
| CIS RAM method | Nobody; CIS states the method is free to use for improving your own cybersecurity posture | Not applicable | Free per CIS; confirm the current license terms on the CIS RAM FAQ before reuse in a commercial context |
| Internal staff time | Your own employees, through salary and time allocation | One-time per cycle, recurring when repeated each year | Number of business units, asset classes in scope and how many people must review the workbook answers |
| Outside facilitator or consultant | Facilitator or consulting firm under a written scope | One-time per engagement, sometimes repeated | Size of the enterprise, how many stakeholders must be interviewed and whether the team has prior risk analysis experience |
| Implementation partner work on remediation | Partner engaged to fix gaps the assessment identifies | One-time for each remediation project, plus any ongoing support retainer | Number and complexity of gaps, existing platform maturity and whether systems must be rebuilt or only configured |
| Independent assessment | Independent auditor or assessor, only if a customer or regulator requires one | One-time per assessment, recurring if the requirement repeats | Scope of the assessment, evidence volume and the assessor's own fee schedule; ask for a written quote |
| Tooling and documentation | Software vendors or internal teams, depending on the tools chosen | Recurring licenses, plus one-time setup | Whether you reuse existing risk registers, ticketing systems and open-source tools already in place |
Run CIS RAM in-house, with a consultant, or with an independent assessor
Running CIS RAM in-house means your own staff use the free CIS RAM documents to analyze risk, document decisions and set the acceptable level of risk. This fits organizations with someone who understands risk analysis and can keep the work moving. CIS describes CIS RAM as free for anyone looking to improve their own cybersecurity posture, so the main costs are staff time and the review meetings needed to reach agreement.
- What you keep: full ownership of the risk register, the reasoning behind each rating and the decisions on which safeguards to fund.
- Who is paid: your staff, plus any tools you choose. Nobody outside the organization is paid to run the method.
- Independence boundary: none. Internal results are management's own analysis and do not carry third-party weight.
- Recurring work: repeating the assessment when systems, threats or the Controls change, and keeping the documentation current.
- Typical gap: teams often lack an impartial facilitator, so ask whether a reviewer outside the risk owners will challenge the scoring.
Before starting, confirm which CIS RAM document matches your Implementation Group with the CIS RAM FAQ and the current v2.1 release notes.
A consultant facilitates the assessment, guiding your team through scoping, the workshop sessions and the write-up, while the organization makes the final risk decisions. This fits organizations that have the will but not the method experience, or that need an outside facilitator to keep discussions objective. The consultant brings method knowledge, and you keep the decisions.
- What you keep: ownership of the risk statements, acceptable risk levels and the investment decisions that follow.
- Who is paid: the consultant, for scoping and facilitation, under a written scope that sets deliverables and timelines before work starts.
- Independence boundary: the consultant helps you analyze risk but does not certify your results. Their report is advice to management, not an attestation.
- Quote items to request: named facilitator experience with CIS RAM, which document versions they will use, the number of workshops, and who writes the final report.
- Knowledge transfer: ask whether your staff will do the scoring themselves so the method stays in-house after the engagement.
Check that the consultant's credentials are their own and not claimed as CIS accreditation unless that accreditation is confirmed through CIS Controls Accreditation records.
An independent assessor or certification body is needed when a regulator, customer, contract or court expects a third party to attest to your risk assessment or to the controls behind it. The assessor tests your work against the stated method and issues the only opinion that carries third-party weight. CIS RAM itself does not require this step, so bring in an assessor only when an outside party has asked for one.
- What you keep: the systems, records and decisions being assessed, which remain your responsibility throughout.
- Who is paid: the assessor, for independent testing and the attestation. Implementation help from a partner is a separate engagement.
- Independence boundary: the assessor must not design or score the risk assessment they then evaluate. A consultant who prepared the work usually cannot also attest to it.
- Confirm with the requesting party: which assessor types they accept, which report or letter they expect, and the period it must cover.
- Timing: engage the assessor early enough to review scope and evidence before the final report is needed.
Verify that any certification body or accreditation claim is confirmed by the relevant body, because only independent assessors and certification bodies issue reports or certificates.
How a CIS RAM assessment runs from scoping to documented decisions
CIS RAM moves from a defined scope to recorded risk decisions in a fixed order, so each phase builds on the evidence the one before it produced. The sequence ends with a remediation plan and a reassessment trigger that the organization can keep current as its environment and the Controls change.
Define scope and select the right document
Leadership and the designated risk owner set the systems, business units, data and third parties in scope, then choose the CIS RAM document that fits the organization. CIS RAM Core supplies the principles, and the Implementation Group documents apply them to IG1 and IG2 environments. CIS described the IG3 document as under development when it released v2.1, so confirm its current status before planning around it. Output: a written scope statement that names the assets, the Implementation Group and the people accountable for each decision.
Identify assets and threats
The team inventories the assets in scope and the data they hold, then lists the threats and harmful events that could affect them. Staff who run the systems, such as IT operations and application owners, should contribute, because a register built on an incomplete inventory leaves risk out before analysis starts. Output: an asset register linked to the threat scenarios the team considers credible for each asset, reviewed and accepted by the risk owner.
Analyze harm and safeguard burden
For each scenario, the team estimates the harm an incident could cause to the organization and to others, then weighs it against the burden of the safeguards that would reduce it. This is the step where CIS RAM applies the reasonable-person framing that regulators and courts use, so the reasoning must be written out, not implied. Output: a documented harm estimate for each scenario, the cost and effort of the candidate Safeguards, and the rationale that links the two.
Document risk decisions and acceptable risk
The risk owner decides how each scenario is handled, whether that means reducing the risk with specific Safeguards, accepting it, transferring it or avoiding the activity. The same record states the level of risk the organization considers acceptable and the basis for that level. The organization owns these decisions, and an outside assessor or consultant prepares the analysis without making them. Output: a signed decision record that a regulator, auditor or court could read without needing the assessment team to explain it.
Plan remediation and schedule reassessment
The team converts each decision to reduce risk into a remediation item with an owner, a set of Safeguards and the evidence that will show the Safeguard is in place. Items are sequenced by the risk they address, and the plan states the conditions that trigger a new assessment, such as a major system change, a new data type or a material incident. Output: a remediation plan tied to the decision record and a reassessment schedule that the risk owner has approved.
What to have in place before the assessment starts
A CIS RAM assessment produces a defensible risk position only when the organization has decided who owns the risk, what it is measuring and what level of risk it will accept. The six items below are the inputs an assessor or internal team needs before scoring begins, and each one can be checked before the work starts.
A named risk owner
CIS RAM results are only useful if one accountable executive can accept the residual risk and fund the decisions that follow. Confirm that this person has written authority over the systems in scope, can approve safeguard investments, and will sign off the final risk statement. If the role is shared or delegated to a committee, record who holds the final decision and how disputes are escalated.
An inventory of assets and data
Risk scenarios in CIS RAM are built around assets, so the assessment cannot be scoped until the organization knows which devices, software, data stores, user groups and network segments exist. Check that the inventory covers both on-premises and cloud resources, names an owner for each asset, and identifies where sensitive data is held. Gaps here usually show up as scenarios that cannot be scored.
Current CIS Controls scope decisions
Before scoring, the team must decide which Implementation Group applies and which Safeguards fall inside the assessed boundary. Confirm that the IG choice is written down with its reasons, that out-of-scope systems are listed with justification, and that any Safeguards marked not applicable have a documented rationale. An assessor will test these decisions before testing the controls themselves.
Documented policies and processes
The CIS Controls expect written processes for areas such as asset management, access and incident response, and the assessment checks whether those processes exist and are followed. Gather the current policies, their approval dates and their owners, and note any that are drafts or missing. Where a policy is absent, record it as a finding rather than assuming it exists in practice.
Access to system owners
Scoring a scenario requires knowing how a system is actually run, which only the people who operate it can explain. Confirm that named system owners, network engineers, HR and business unit leads are available for interviews and can provide configuration evidence during the assessment window. Without this access, the team will score from documents alone, which tends to overstate control effectiveness.
A defined acceptable-risk statement
CIS RAM asks the organization to state how much risk it is willing to accept, because the method compares the harm incidents could cause against the burden of safeguards. Check that the statement is written, approved by the risk owner and expressed in terms the business can apply, such as which impacts are intolerable and which are tolerated. Without it, the assessment can identify risk but cannot say whether the residual position is reasonable.
Where CIS RAM sits next to the CIS Controls and other frameworks
CIS RAM assesses risk against an implementation of the CIS Controls, so it answers a narrower question than a framework audit does. It asks how much risk remains when a chosen set of Safeguards is designed and operated in your environment, and whether that residual risk is reasonable for your business. The Controls themselves are a catalog of Safeguards, not a compliance scheme. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. If a regulator, contract or assessor requires ISO/IEC 27001:2022, SOC 2, PCI DSS or another framework, CIS RAM does not satisfy that requirement on its own. It can, however, give you a documented, risk-based rationale for how your Safeguards were chosen and why they are sized as they are.
CIS publishes the CIS Controls Navigator for v8.1, which lists CIS mappings to 30 frameworks and versions, including NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2 and Rev. 3, ISO/IEC 27001:2022, SOC 2, PCI DSS v4.0, CMMC v2.0, DORA and NIS2. Treat these mappings as CIS's view of overlap, not as proof that one set of evidence satisfies another. Before you reuse a Safeguard as evidence for a control in a second framework, open the Navigator entry, confirm the mapped version matches the version your assessor uses, and ask the assessor whether they accept the mapping. Where the mapping is partial, record the gap in your risk register rather than assuming coverage.
CIS RAM is also a method you can run alongside other frameworks, not one you must choose instead of them. CIS states that it does not require CIS RAM to be the only method an enterprise uses to assess information security risk. Many organizations keep an ISO/IEC 27005 or NIST SP 800-30 style risk process for enterprise governance and use CIS RAM for the Safeguard-level analysis. The practical decision is which risk register is authoritative and how its entries map to each framework's control IDs. Confirm this with your internal audit team and your external assessor before the first assessment cycle, so that one risk finding does not end up with three different owners and three different due dates.
Who owns the risk decisions and who prepares the evidence
The organization owns the risk assessment, the risk decisions and the controls. CIS RAM is a method for analyzing risk, and the people accountable for the enterprise must decide what harm they are willing to accept, which safeguards they fund and how far they go in justifying that choice to a regulator, insurer or court. No consultant can take that accountability away, and CIS RAM itself is free for an organization to use directly.
- Risk acceptance: Senior leaders name the acceptable level of risk and sign off on residual risk.
- Scoping and asset context: Staff identify the systems, data and business processes the assessment covers.
- Control ownership: Named owners run each Safeguard day to day and keep it working after any project ends.
- Funding decisions: Budget holders approve the safeguards that the analysis justifies.
- Records: The organization keeps the assessment, its rationale and its evidence current.
Before engaging anyone, confirm that a named executive has accepted ownership of the risk register and the decisions it contains.
An implementation partner such as DeployOpen prepares systems, documentation and evidence so the organization can run its assessment and show its controls working. Under a written, fixed scope, the partner may configure platforms, write procedures, collect outputs and facilitate workshops. It does not decide what risk is acceptable and it does not issue reports, attestations or certificates. DeployOpen does not issue reports or certifications of any kind.
- System preparation: Configuring self-hosted open-source platforms inside the client's own infrastructure so they generate records that support specific Safeguards.
- Documentation: Drafting procedures, asset lists and assessment worksheets for the organization to review and approve.
- Evidence collection: Setting up repeatable exports, such as configuration snapshots and log samples, that the organization can hand to an assessor.
- Facilitation: Running assessment workshops on request, with the decisions recorded by the organization.
- Handover: Training the client's staff so they can operate and update the evidence without the partner.
Ask the partner to state in writing which deliverables are documents or configurations and which, if any, would require an independent party to validate.
An independent assessor or certification body is the only party that issues a formal report or certificate. Its role is to test the organization's claims against evidence, applying its own method and its own accountability. The assessor's independence is what gives a third party reason to rely on the result, so it must not design the controls it later tests for the same client.
- Independence: The assessor cannot be the party that built the controls it examines.
- Scope agreement: The assessor confirms the boundary and method before testing begins.
- Testing: The assessor samples evidence, interviews owners and checks whether it matches the stated practice.
- Reporting: Only the assessor issues the report, attestation or certificate, under its own name.
- Accreditation: Confirm whether the body holds the accreditation or license that the audience you serve requires.
Before hiring, confirm the assessor's accreditation status and whether its output is an opinion, a report or a certificate.
CIS RAM questions buyers ask before hiring help
Is CIS RAM really free to use?
Yes. CIS states that CIS RAM is free to use for anyone looking to improve their own cybersecurity posture, and CIS describes CIS RAM v2.1 as free for any organization to use for a cyber risk assessment. The method itself costs nothing. Your spending goes to people and time: internal staff hours, and any outside help you choose to hire. Outside help is paid for scoping the assessment, facilitating workshops, documenting results and, if you want it, preparing the systems and evidence behind the risk decisions. Ask any consultant to separate method licensing from their fees so the quote shows exactly what you are paying for.
How long does a CIS RAM assessment take?
The duration depends on scope rather than on the method, and no fixed figure is published in the sources we rely on, so confirm the timeline in writing with any provider. The main drivers are the number of business units and systems in scope, how many Implementation Group documents you use (for example IG1 or IG2), how much current documentation already exists, how many stakeholders must agree on risk tolerance, and how much evidence must be gathered to support each rating. An assessment scoped to one environment with ready documentation will move far faster than an enterprise-wide review that starts from scratch. Ask for milestones and the dependencies on your side.
Can our own team run a CIS RAM assessment without outside help?
Often yes, if the team has someone who understands risk analysis and can facilitate discussions with business owners. CIS RAM is designed so an organization can assess its own risk, and CIS says it does not need to be the only method you use. Teams with little security expertise often start with the IG1 documents, which are written for smaller programs. Outside help is most useful when no one has run a formal risk analysis before, when leadership needs an independent view for a regulator or litigation file, or when the team lacks time to collect evidence. Whichever route you take, the organization owns the risk decisions and the record of them.
Does a customer or regulator require a third-party attestation for CIS RAM?
CIS RAM itself does not produce a certificate or attestation, and nothing in the CIS RAM FAQ says that a third party must perform the assessment. Whether a customer, contract or regulator requires independent assurance depends on that party's terms, so read the requirement and ask them directly what evidence they accept. CIS also states that the Controls do not replace any regulatory, compliance or authorization scheme. If an external opinion is required, an independent auditor or assessor issues that opinion. An implementation partner can prepare systems, records and evidence for that review but cannot issue it.
How does CIS RAM differ from a NIST or ISO risk assessment?
CIS RAM is built to design and evaluate an implementation of the CIS Controls, and CIS states that it conforms to and supplements ISO 27005, NIST SP 800-30 and Risk IT. In practice, it is narrower in purpose and more specific about the Safeguards you are judging. It also frames risk around what a reasonable organization would do, weighing the harm an incident could cause others against the burden of the safeguard. An ISO 27005 or NIST SP 800-30 assessment is a broader method that you tailor to your own information security management system. If your audit targets ISO/IEC 27001 or NIST SP 800-53, confirm with the assessor which risk method they expect to see documented.
What should we ask a consultant for in a CIS RAM quote?
Ask for a written scope before any price: which Implementation Group documents apply, which business units, systems and third parties are included, and what the deliverables are. Then ask for each of these in the quote:
- The phases, workshops and review points, with the effort each one needs from your staff.
- Who owns the risk decisions and who signs off the final report.
- The evidence the consultant will collect and what remains your responsibility.
- Whether any hardening, documentation or testing is included, and what is excluded.
- Whether the work is one-time or includes a retainer for reassessment.
- Their experience with the CIS RAM documents, and whether they will name the independent assessor if one is needed later.
DeployOpen works from a fixed written scope, and a quote follows from that scope.
How DeployOpen supports a CIS RAM assessment
DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside your own infrastructure. For a CIS RAM assessment, we prepare the systems, controls and evidence your team needs to run the method, while your organization owns the risk decisions and an independent assessor or auditor reviews the results where that is required.
How we scope
- We agree a written scope covering which CIS RAM documents apply, such as the Core document or an Implementation Group workbook.
- The scope names the systems, business units and Safeguards included in the assessment before any work starts.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing; ask for the written scope before committing.
How we build
- We prepare the inventories, configuration records and platform data your team needs to answer the CIS RAM questions accurately.
- We implement or harden the self-hosted open-source platforms in scope within your cloud accounts, data centers or air-gapped networks.
- We test the resulting controls and record what was checked, how, and what the results showed for each in-scope Safeguard.
How we hand over
- We document the risk assessment inputs, configurations and evidence so your team can reproduce and maintain them.
- Your organization keeps ownership of the risk determinations, acceptable risk levels and the decisions to fund safeguards.
- Reports and any certification or attestation are issued only by an independent auditor, assessor or certification body, not by DeployOpen.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial assessment work is complete.
- Retainers can cover periodic reassessment, so the risk analysis keeps pace with changes to your systems and threats.
- Ask us to confirm in writing which support, testing and update services are included before you sign.
