How do you assess CIS Controls implementation?
No organization can be certified against the CIS Controls, so a customer, contract or regulator asking for CIS Controls evidence is really asking for an assessment that can be shown to someone else. Assessment runs through one of three routes: the free CIS-hosted CSAT tool for an organization assessing its own implementation, the CIS SecureSuite Platform for CIS SecureSuite members, or an independent assessment by a service provider that holds CIS Controls Accreditation. The route you choose should follow from who needs to accept the result. Your own leadership and internal audit can work from a self-assessment, but an external customer or a regulator will usually expect a party outside your organization to have performed the review. The roles are easy to blur, so settle them early. Your organization owns its controls and the decisions about them. An implementation partner, such as DeployOpen for self-hosted open-source platforms, can prepare systems, configuration, logging and documentation so that evidence exists to be reviewed. Only the party that performs the assessment issues any report or statement about the result. A partner that configures a platform does not, by doing so, give you an assessment, and you should not accept a document that presents its own work as independent verification.
The CIS Controls Assessment Specification (CAS) is the reference for what gets measured. For each Safeguard it defines the inputs, operations, measures and metrics used to verify that the Safeguard is implemented. CIS states that the CAS covers what to measure, not how, and leaves tool-specific methods to tool developers. Read it as the checklist an assessor will use, then ask your assessor or provider which evidence they will accept for each Safeguard in your scope. The CAS concentrates on whether a Safeguard is implemented; CIS describes checks of how well it is implemented as a goal for future versions, so do not expect a maturity score from the specification alone. The answer varies with three things: the scope of systems and business units covered, the Implementation Group you target (IG1, IG2 or IG3 each add Safeguards to the set you must evidence), and who must accept the result. Confirm those three with your customer or regulator before you buy anything. Ask them which CIS Controls version they reference, whether they accept a self-assessment or require an accredited provider, and what format they expect for evidence. Those answers determine whether CSAT is enough or whether an accredited assessment is worth its cost.
Which assessment option fits which organization?
This table compares the three ways to assess CIS Controls implementation: the free CIS-hosted CSAT, the CIS SecureSuite Platform for members, and an independent assessment through a CREST-backed accredited provider. Read each column for who runs the assessment, what it produces, who can rely on it and when it fits. The main takeaway is that self-assessment produces internal evidence, while only an accredited provider's work carries third-party weight.
| Option | CIS-hosted CSAT | CIS SecureSuite Platform | Accredited service provider assessment |
|---|---|---|---|
| Who runs it | Your own team, using the free CIS-hosted web application | Your SecureSuite member team, using CSAT Pro and CIS-CAT Pro Dashboard | An accredited provider engaged by you, under a written scope |
| Who it is for | Any organization assessing its own non-commercial implementation | Organizations that are CIS SecureSuite Members | Organizations that want an independent view from a qualified third party |
| Output produced | Tracked status across documentation, implementation, automation and reporting, with exports to PowerPoint, Excel and PDF | Posture assessment against the CIS Controls and conformance evidence for the CIS Benchmarks | A report written by the provider; its form depends on the engagement scope and contract |
| Who may rely on it | Internal leadership and planning; it is not an independent attestation | Internal leadership and planning; members should confirm with recipients how they will accept it | Recipients the client chooses, such as customers or regulators, subject to the provider and contract |
| Cost structure | Free for non-commercial use of the tool; staff time to answer and gather evidence is the main cost | Membership fees apply; confirm current pricing with CIS | Accreditation fee of 1,500 US dollars for CREST members and 2,500 US dollars for non-members (CIS Controls Accreditation page), plus the provider's fees for the engagement |
| Eligibility limits | None beyond non-commercial use for assessing your own implementation | Available only to CIS SecureSuite Members | Only CIS SecureSuite Consulting and Services, Controls, and Product Vendor members may apply for accreditation; CREST membership is not required |
| When it fits | Early assessment, baselining and internal tracking before any outside review | Members who want CSAT and CIS-CAT results in one place and a maturity roadmap from IG1 | When a customer, auditor or regulator expects independent work, or the organization lacks internal assessors |
| What to ask for or confirm | Which owners answer each question and how evidence is stored and reviewed | Current membership terms and whether the Cybersecurity Journey feature covers your Implementation Group | The provider's accreditation status on the CIS website, the assessment scope in writing and the form of report you will receive |
What the CSAT self-assessment tracks for each safeguard
CIS-hosted CSAT (the Controls Self Assessment Tool) tracks four dimensions for each CIS Control and each safeguard: documentation, implementation, automation and reporting. Documentation asks whether the process or procedure behind a safeguard is written down. Implementation asks whether it is actually running across the environment. Automation asks whether the work is performed by tooling rather than by hand, and reporting asks whether results are measured and communicated. Keeping these four separate matters because a safeguard can be written into policy yet applied inconsistently, or applied by hand in a way that no one can show to an assessor. Before the first assessment, confirm with your team which Implementation Group and safeguards are in scope, since the tool records answers at that level of detail.
The tool is built for division of labor. Teams can delegate questions to the people who own each system, set a deadline per Control, upload evidence against the answer, and record discussion so the reasoning behind a rating survives staff changes. Results export to PowerPoint, Excel and PDF, which lets the same data serve an executive briefing, a working spreadsheet and a file for the audit folder. CSAT also carries cross-mappings to NIST SP 800-53 and PCI DSS and offers anonymous comparison against industry peer groups. Those mappings are useful for planning, but treat them as CIS's mapping work rather than a finding that one assessment satisfies another framework.
Be clear about what this produces. The answers come from your own staff, so the result is a self-assessment that shows your organization's view of its own posture. It is not an independent report, an attestation or a certificate, and no assessor's conclusion sits behind it. Where a customer or regulator asks for independent assurance, the CSAT record can support that work by organizing evidence, but an independent assessor must still perform the testing. Ask your auditor early which CSAT exports and evidence they will accept before you build the record around them.
How the Assessment Specification defines what gets measured
The CIS Controls Assessment Specification defines, for each Safeguard, the inputs, operations, measures and metrics used to verify implementation. The cards below show how to turn that definition into evidence requests and test scripts, and where its limits leave decisions to your team.
Read the inputs before requesting evidence
Each Safeguard entry in the CAS lists the inputs an assessor needs before testing begins, such as asset lists, policies or system configurations. Treat these inputs as the first draft of your evidence request. If a Safeguard calls for an asset inventory, ask the owning team for the exact export, its date and its scope, so the assessor can see what the inventory covers and what it leaves out.
Map operations to test steps
The operations section describes the activities that verify a Safeguard, such as sampling devices, reviewing configurations or checking that a process ran. Convert each operation into a numbered test step with a named owner, a sample size you can defend and an expected result. Steps written this way are repeatable and make it clear which evidence proves each step.
Use measures to set pass criteria
Measures tell you what a passing result looks like for a Safeguard, such as the share of assets covered by a control or whether a required setting is present. Write the pass criteria for each measure before testing starts. Agree with the assessor how partial coverage will be scored, because a Safeguard that is only applied to some systems often fails the measure even when the process exists.
Track metrics over time
Metrics are the figures the CAS uses to show ongoing performance, such as coverage percentages or time to remediate. Ask whether your tooling can produce each metric from source data rather than from manual spreadsheets. Dated, reproducible metric reports are stronger evidence than a single snapshot, and they show whether a control keeps working between assessments.
Separate Level 1 checks from maturity
The CAS concentrates on Level 1 checks: whether a Safeguard is implemented. CIS describes Level 2, how well a Safeguard is implemented, as a goal for future versions. Do not present a Level 1 pass as proof of effective operation. Record the gap in your assessment file, and plan separate testing of quality, timeliness and consistency if your leadership needs that answer now.
Confirm tool choices with the vendor
The CAS says what to measure but not how, and it leaves tool-specific details to tool developers. Your open-source scanners, log platforms or inventory systems will each produce evidence in their own format. Before you commit to a tool, confirm with its maintainers which CAS measures it can generate, which fields it exports and where it needs a manual step, so the evidence package does not depend on undocumented behavior.
Who owns the assessment, who prepares it, and who issues the result
The organization owns its CIS Controls program, its Safeguard decisions and every answer recorded in a self-assessment. No one else can declare a Safeguard implemented on its behalf. The CIS Controls are free for any organization to use to improve its own cybersecurity, and CIS-hosted CSAT is free for non-commercial use in assessing an organization's own implementation, so the self-assessment is an internal management activity that the organization signs off and defends. The organization also decides which Implementation Group it targets, accepts residual risk and approves the written policies that support the Safeguards.
- Control ownership: Named owners for each Control, accountable for the documentation, implementation, automation and reporting dimensions that CSAT tracks.
- Self-assessment answers: Responses entered in CSAT or the CIS SecureSuite Platform, including the reasoning behind each answer and the evidence attached to it.
- Policy approval: Executive approval of the written processes that Safeguards depend on, such as asset inventory and access review procedures.
- Scope decisions: Which systems, business units and providers fall inside the assessed environment.
- Remediation accountability: Owners and deadlines for every gap the self-assessment exposes.
Before relying on any self-assessment figure, confirm that a named individual inside the organization can explain and stand behind each recorded answer.
An implementation partner such as DeployOpen prepares the systems, documentation and evidence that the organization's answers point to. Typical work includes deploying and configuring self-hosted open-source tooling for asset inventory, logging, vulnerability scanning and backups, writing or tailoring procedures, and organizing evidence so that a reviewer can trace each Safeguard to a record. Security testing, such as application, cloud and infrastructure testing or penetration testing, can produce findings that feed the evidence trail. The partner does not decide whether a Safeguard is met, does not sign CSAT answers on the organization's behalf unless the organization directs it to and does not issue reports or certificates.
- System preparation: Configuring tooling inside the client's own cloud accounts, data centers or air-gapped networks.
- Documentation support: Drafting procedures for the organization to review, adopt and approve.
- Evidence organization: Collecting and labeling exports, configurations and logs against the measures in the CIS Controls Assessment Specification.
- Testing inputs: Running security tests whose results the organization can use as evidence and remediation input.
- Boundary limits: No authority to issue an assessment result, attestation, accreditation or certificate.
Check the partner's written scope for the exact deliverables, and confirm that the engagement ends with the organization holding its own evidence and its own assessment answers.
An independent assessor or accredited provider performs the outside examination and issues the findings. For CIS Controls, no organization can be certified. The recognized route for outside credibility is CIS Controls Accreditation, run with CREST, which accredits CIS SecureSuite members that provide CIS Controls implementation, auditing or assessment services. Accreditation is an organization-level stamp for the provider, and accredited providers are listed on the CIS website. The assessor tests implementation against the measures in the CIS Controls Assessment Specification, which describes what to measure but not how, so the assessor's method and sampling choices must be documented in its own report.
- Accredited providers: Confirm the firm is listed as CIS Controls Accredited on the CIS website before engaging it.
- Eligibility route: Accreditation applicants must be CIS SecureSuite Consulting and Services, Controls, or Product Vendor members. CREST membership is not required.
- Independence: The assessor should not have designed or operated the controls it tests.
- Output: Findings and reports come from the assessor, not from the tooling or the partner.
- Scope agreement: The assessed scope and sampling approach should be written into the engagement letter.
Ask the assessor for its accreditation status in writing and confirm which Implementation Group and Safeguards its report covers.
The independence boundary runs between the people who build and operate controls and the people who judge them. An organization that asks a partner to prepare evidence and then treats the partner's work as an independent opinion has misread the roles. Preparing evidence is valuable, but it is not assurance. Only the independent assessor's findings carry that weight, and only the organization can make representations to its customers, regulators or insurers about its own posture.
- Preparer: Builds systems, drafts documentation and organizes evidence.
- Owner: Decides, approves, attests in its own voice and remediates.
- Assessor: Tests independently and issues the findings.
- Customer or regulator: Relies on the owner's statements and the assessor's findings, not on the preparer's work product.
- Documented handoff: Each party's deliverables should be listed in writing, with no party issuing another party's conclusions.
When a customer asks for proof of conformance, confirm which of these three roles produced the document being shown.
How a CIS Controls assessment runs from scoping to evidence
The sequence turns a CIS Controls program into a defensible record: a scoped Implementation Group, each Safeguard tested against the CIS Assessment Specification, and an evidence package that customers, auditors or regulators can review. Each phase produces a named output that feeds the next.
Confirm scope and target Implementation Group
The organization, usually its security lead with input from IT and business owners, defines which systems, business units, data sets and third parties fall inside the assessment boundary. It then selects the Implementation Group it is targeting (IG1, IG2 or IG3), which determines how many of the 153 Safeguards apply. The output is a signed scope statement listing the boundary, the target group and the named owner for each Control. The step is done when leadership has approved that statement in writing.
Map in-scope Safeguards to assessment measures
For each in-scope Safeguard, the assessor or internal team reads the matching entry in the CIS Controls Assessment Specification, which lists the inputs, operations, measures and metrics used to verify implementation. The Specification says what to measure but not how, so the team records the tool, report or procedure it will use for each measure. The output is a traceability matrix linking every in-scope Safeguard to its measures and the data source for each. The step is complete when no in-scope Safeguard is left without a named measure.
Run the CSAT self-assessment and record answers
Control owners answer the questions for each Control and Safeguard in CIS-Hosted CSAT, which is free for non-commercial use. The tool tracks documentation, implementation, automation and reporting for each item, so the team can see where a Safeguard is written down but not yet operating. Owners can be assigned questions, given deadlines per Control and asked to record discussion notes. The output is a completed self-assessment with a status and a reviewer for each item. The step is done when every in-scope item has an answer that a second person has reviewed.
Collect and tag supporting evidence
For each answer, the team gathers the artifact that proves it: a policy, an exported asset inventory, a configuration baseline, a scan report, an access review, or a ticket trail. Each file is tagged with the Safeguard, the Control, the assessment measure it supports, the system it came from and the date it was produced. Evidence is kept unedited so that it can be reproduced. The output is an evidence register that maps every answer to at least one artifact. The step is complete when a reviewer can follow any answer to its source without asking the owner.
Close gaps and retest
The team ranks each gap by the risk it leaves open and by the Implementation Group that requires it, then assigns an owner and a remediation action. Where a fix changes a system, the owner records the change and reruns the relevant measure so the evidence reflects the new state rather than the old one. The output is a remediation log with each gap marked as closed, accepted with a documented reason, or still open. The step is done when every open gap has either a verified fix or a signed risk acceptance.
Obtain independent assessment where required
If a contract, regulator or customer requires an external view, the organization engages an independent assessor. The assessor examines the scope, the traceability matrix and the evidence register, and tests a sample of Safeguards against the Specification. Implementation partners can prepare the systems and evidence, but only the independent assessor issues an opinion on the result. The output is the assessor's written findings, which the organization must address before the report is final. The step is done when the assessor has issued its report, and the organization has no open findings it has not responded to.
Retain the evidence package for customers and regulators
The organization assembles the scope statement, traceability matrix, self-assessment export, evidence register, remediation log and any independent report into a versioned package. Access is controlled, retention periods follow the organization's own records policy and any legal obligations, and the package is refreshed when systems or the CIS Controls version change. The output is a retained, indexed package that can answer a customer questionnaire or a regulator request. The step is complete when someone other than the original author can locate and explain each item in the package.
What CIS Controls Accreditation does and does not prove
CIS Controls Accreditation accredits the service provider, not the environment of any customer it serves. CIS and CREST launched the program on June 28, 2023, so that qualifying service providers can offer CIS Controls implementation, auditing and assessment backed by CREST accreditation. CIS describes it as an organization-level stamp of approval. Accredited organizations are listed on the CIS website and may use the CIS Controls Accredited badge. Only CIS SecureSuite Consulting and Services, Controls, and Product Vendor members can apply, and CREST membership is not required. Before relying on a provider, confirm that its listing is current and that the accreditation covers the service line you are buying, such as implementation or assessment.
Eligibility also depends on individual training. CIS lists the GIAC Critical Security Controls Certification (GCCC) from SANS and the CIS Controls Mastery Course from Antisyphon Training as courses tied to eligibility. Those courses show that the people doing the work understand the Controls. They do not show that any particular client's safeguards are in place or working. Ask a provider which named staff hold these credentials, and ask how their work is reviewed, since the accreditation does not describe the quality of an individual engagement.
Do not treat an accredited provider's name as evidence that your organization, or a client, conforms to the CIS Controls. Conformance is established by testing the organization's own systems against the Safeguards and the CIS Controls Assessment Specification, and by keeping the evidence. If a customer or regulator asks for proof, the answer should be your own assessment record and supporting evidence, with an accredited provider's report serving as one input. Plan for that in the statement of work by naming the Safeguards in scope, the evidence each one will produce and who signs off on the results.
How to choose an assessor or consultant for CIS Controls
Because no organization can be certified against the CIS Controls, the people you hire will shape what evidence you can show to customers and regulators. The cards below cover the checks that separate a credible CIS Controls assessor or consultant from one that only sells the framework.
Confirm the membership and accreditation status
Check the provider's CIS SecureSuite membership category on the CIS site. Only SecureSuite Consulting and Services, Controls, and Product Vendor members can apply for CIS Controls Accreditation, and the accreditation runs with CREST. Ask whether the firm is accredited today, not whether it plans to apply, and confirm the status on the CIS website yourself. Accredited status is an organization-level stamp, not a certificate for your environment.
Check independence from the controls team
Ask whether anyone who helped build, maintain or certify the CIS Controls content is on the assessment team, and whether the firm also designs or runs the controls it will then assess. If the same team implements your controls and tests them, the result is a self-review. Ask who in the firm approves findings and whether that person sits outside the delivery team. Write the answer into the engagement letter.
Ask for experience at your Implementation Group
IG1 is essential cyber hygiene, IG2 adds safeguards for more complex enterprises, and IG3 targets regulated, sensitive environments facing sophisticated attacks. A provider experienced with small IG1 deployments may not have tested the IG3 safeguards in depth. Ask for the number of engagements at your target group, the sectors served, and the staff qualifications. Ask them to name the skills they expect your team to have ready.
Confirm which CAS measures get tested
The CIS Controls Assessment Specification defines the inputs, operations, measures and metrics for each safeguard, but it does not say how to measure. Ask which specification measures the assessor will test for each in-scope safeguard, and how they will convert those into findings. Ask for a sample of the test plan before fieldwork starts. Expect the CAS to focus on whether a safeguard is implemented, not how well it performs.
Agree on evidence and who signs the output
Ask what evidence the assessor expects for each safeguard, such as approved policies, configuration exports, access reviews, scan results or tested backups, and who collects it. Then clarify who signs the output. CIS does not issue reports or certificates, so the document your customers receive should state the firm's role, the scope, the date and who is accountable for the conclusions. Get a written statement of what the signed output will and will not claim.
Get scope and deliverables in writing
Before work starts, agree in writing on the Controls and Safeguards in scope, the Implementation Group target, the systems and sites covered, the exclusions, the deliverables and the dates. Ask for a fixed-scope proposal that lists each deliverable and what counts as acceptance. Ask how changes to scope are priced and approved. A written scope protects both sides when a customer or regulator asks what was tested.
CIS Controls assessment questions buyers ask
Can we get CIS Controls certified?
No. No organization can be certified against the CIS Controls. CIS publishes the Controls as a free set of prescriptive practices, and it states that they do not replace any regulatory, compliance or authorization scheme. What exists instead is self-assessment using CIS tools and the Assessment Specification, CREST-backed accreditation for qualifying service providers, and individual training courses. To show conformance to a customer or under a state safe harbor law, you typically document your own assessment and evidence, and an independent assessor can test it if the requirement calls for one. Confirm with the requesting party which form of proof they accept.
Is CSAT really free to use?
CIS says the CIS-Hosted CSAT (Controls Self Assessment Tool) is free to every organization for non-commercial use in assessing its own implementation of the CIS Controls. The tool tracks documentation, implementation, automation and reporting for each Control and Safeguard, lets teams delegate questions, set deadlines, upload evidence and export results. The license terms for the Controls content are separate: CIS content is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, and commercial use requires CIS's prior approval. Confirm the terms that apply to your use, especially if a consultant or vendor will run the assessment for you as a commercial service.
Can we run the CIS Controls assessment ourselves?
Yes, for an internal self-assessment. CIS-Hosted CSAT is designed for organizations to assess their own implementation, and the Assessment Specification defines the inputs, operations, measures and metrics used to verify each Safeguard. The Specification focuses on what to measure, not how, so your team must choose the tooling and collect the evidence. Internal teams usually need staff who understand the Safeguards, asset and identity data, and log and configuration sources. Where you lack that depth, or where a customer wants an independent view, an outside party can help prepare the evidence or perform an assessment.
How much effort does a CIS Controls assessment need from our staff?
The effort depends mainly on how far you are into the Controls and how many systems fall in scope. Drivers include the Implementation Group you target, the number of assets, accounts and applications, how much evidence already exists in logs and configuration records, and how many owners must answer questions. Recurring work includes keeping asset inventories current and refreshing evidence before each review. Ask any provider for a written estimate that lists roles, hours by Control, evidence collection tasks and the review cycle. This page does not supply an effort figure, so confirm durations against your own environment before committing.
Do we need an accredited provider to help with CIS Controls?
No. CIS Controls Accreditation is an organization-level stamp of approval for service providers, and your organization can implement and self-assess without one. Accreditation matters when you hire an outside firm to deliver CIS Controls implementation, auditing or assessment and want a recognized credential on that firm. Only CIS SecureSuite Consulting and Services, Controls, and Product Vendor members can apply, and CREST membership is not required. Ask any provider which Controls credential it holds, what it has done under that credential, and who on the team has completed the courses CIS lists.
What does the CIS Controls accreditation fee cover?
The fee covers the application to CIS for accreditation as a service provider. CIS lists an application fee of 1,500 US dollars for CREST members and 2,500 US dollars for non-CREST members on the CIS Controls Accreditation page. The application fee does not pay for your implementation or assessment work, and it does not cover any SecureSuite membership fees, course costs or consulting engagement. Confirm the current fee, renewal conditions and any other charges directly with CIS before budgeting, because published figures can change.
How does a CIS Controls assessment relate to customer or safe harbor requirements?
A self-assessment gives you structured, dated evidence of which Safeguards you have implemented, which is the material you would show a customer or a court. CIS states the Controls do not replace any regulatory or compliance scheme, so they do not automatically satisfy a contract or a law. Some US state safe harbor laws reward a written program that reasonably conforms to the CIS Controls, and those laws set their own conditions, such as keeping the program current with new framework versions. Ask counsel which statute applies to you, which version they require, and what documentation they will accept.
How DeployOpen prepares CIS Controls evidence
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For CIS Controls assessment, we prepare systems, Safeguard evidence and documentation for the organization to review, while the organization owns its controls and its self-assessment results.
How we scope
- We agree a written scope listing the Controls, Safeguards and Implementation Groups the assessment will cover.
- We confirm which systems, cloud accounts and data centers fall inside the self-hosted platforms and evidence sources.
- We record the assessment method, owners, deliverables and timelines before any work starts, since engagements are fixed-scope.
How we build
- We map each in-scope Safeguard to the platform configuration, logging, inventory or process that should evidence it.
- We implement and harden the open-source tooling, then test that each evidence source produces the records an assessor would request.
- We run security testing where it supports a Safeguard, such as penetration testing for Control 18, and record the findings and fixes.
How we hand over
- We deliver written procedures, configuration records and an evidence index keyed to Safeguard identifiers in the assessment specification.
- We walk the organization's assessors through where each piece of evidence lives, how it was produced and how to reproduce it.
- We state the gaps we found and what the organization still needs to decide, assign or remediate before self-assessment is complete.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial handover.
- A retainer can keep evidence current when CIS publishes a new Controls version or when the environment changes.
- Confirm with DeployOpen in the written scope which support terms, response arrangements and review cycles apply to your engagement.
