CIS Controls implementation groups
How CIS Implementation Groups IG1, IG2 and IG3 split the 153 safeguards of CIS Controls v8.1, what kind of enterprise each group describes, and how to decide which group to target first.
CIS Controls guides
Buyer guides for organizations asked to adopt or show the CIS Controls: implementation groups, assessment, cost, roadmap, the NIST CSF comparison and state safe harbor laws.
CIS Controls assessment
How organizations assess and demonstrate CIS Controls implementation: the free CIS-hosted CSAT self-assessment, the CIS SecureSuite Platform for members, and the CIS Controls Accreditation program for service providers run with CREST.
CIS Controls implementation cost
What implementing the CIS Controls costs, starting from CIS's own Cost of Cyber Defense estimate for IG1, plus the published fees for CIS SecureSuite membership and the free CIS tools.
CIS Controls implementation roadmap
How to sequence a CIS Controls v8.1 program: start with IG1, use CIS prioritization resources such as the Community Defense Model, know which controls only start at IG2 or IG3, and plan for version updates.
CIS Controls vs NIST CSF
How the prescriptive CIS Controls v8.1 relate to the outcome-based NIST Cybersecurity Framework 2.0, how CIS maps its safeguards to CSF subcategories, and when an organization would use one, the other or both.
CIS Controls and state safe harbor laws
Which US state laws reward a written cybersecurity program that reasonably conforms to the CIS Controls, what defense they offer after a data breach, and the conditions such as updating to new framework versions.
Is there a CIS Controls certification? What exists instead
Why no organization can be certified against the CIS Controls, what exists instead (CREST-backed accreditation for service providers, individual courses, self-assessment with CSAT and the assessment specification) and how to show conformance to customers or under safe harbor laws.
CIS Controls mappings to other frameworks
Which frameworks CIS maps the Controls to in the v8.1 Navigator, from NIST CSF 2.0 and ISO 27001 to HIPAA, CMMC, DORA and NIS2, what a mapping does and does not establish, and how teams use one CIS program to answer several frameworks.
CIS Controls v8 and v8.1: what changed from version 7
What changed when CIS moved from 20 Controls to 18 in v8 and what v8.1 added: Safeguards replacing Sub-Controls, activity-based grouping, the new Service Provider Management Control, cloud and mobile coverage, the Govern function and CSF 2.0 alignment.
