Which CIS Controls implementation group should an organization target first?
Every enterprise starts with IG1, the group CIS describes as essential cyber hygiene and a minimum standard for all organizations. IG1 holds 56 foundational Safeguards, IG2 adds 74 for a total of 130, and IG3 adds the remaining 23 for all 153 Safeguards in CIS Controls v8.1. Whatever a customer, contract or regulator asks for, the first working target is IG1, and the question that follows is whether to extend the program to IG2 or IG3. That decision belongs to the organization, not to CIS, to an implementation partner or to an assessor. The organization owns its controls, its risk acceptance and the evidence it keeps.
CIS frames the choice around an enterprise's risk profile and the resources it has. Ask how large the IT estate is, how many departments operate with different risk profiles, how much sensitive client or regulated data the enterprise holds, whether it employs security specialists in areas such as risk management, penetration testing or application security, and how exposed it is to targeted attacks. CIS describes IG1 as suited to small and medium enterprises with limited expertise, IG2 as enterprises with staff who manage IT infrastructure and sensitive data, and IG3 as enterprises with specialists and regulated assets facing sophisticated adversaries. Note that these descriptions are a starting point. Document the reasoning and the people who approved it, because an assessor or customer will ask how the group was chosen.
Two points belong in the same conversation. First, the CIS Controls cannot be certified. No organization can receive a CIS Controls certificate, so any report or attestation a customer receives must come from an independent assessor, not from DeployOpen. DeployOpen can prepare systems, configuration and evidence for the chosen group, but it does not issue reports. Second, confirm with the requesting party which group they expect. A contract may name IG2 while a regulator names only the framework, and the answer changes the scope and the effort. Put the target group, the Safeguards in scope and the evidence owner in writing before any implementation work starts.
What kind of enterprise does each implementation group describe?
CIS describes IG1 as essential cyber hygiene and the minimum standard for every enterprise. It contains 56 foundational Safeguards that guard against the most common attacks. CIS describes a typical IG1 enterprise as small to medium-sized, with limited IT and cybersecurity expertise, low tolerance for downtime, and mostly employee and financial data to protect. CIS states that IG1 Safeguards should be workable with limited expertise and with small or home office commercial hardware and software.
- Size and staffing: Often a small team, sometimes one generalist who also runs IT, with no dedicated security staff.
- Data profile: Mainly employee records and financial information, rather than large volumes of client or regulated data.
- Downtime tolerance: Low, so changes such as patching and configuration hardening must be scheduled with care.
- Technology: Commercial off-the-shelf endpoints, small networks and software-as-a-service applications.
- Starting point: CIS says every enterprise should start here, so IG1 is the baseline for any larger group.
To check fit, confirm that your headcount, data types and technology match this description, and that your IT function can carry the 56 Safeguards without a dedicated security engineering team.
CIS adds 74 Safeguards to the 56 in IG1, for 130 in total at this level. CIS describes an IG2 enterprise as one with staff responsible for managing and protecting IT infrastructure, multiple departments with different risk profiles, and sensitive client or enterprise data. Some IG2 Safeguards need enterprise-grade technology and specialized expertise, which a general IT team may not hold.
- Staffing: A dedicated IT or security function that manages infrastructure, not only end-user support.
- Departments: Several business units whose data and risk differ, so segmentation and differentiated access matter.
- Client data: Sensitive information belonging to customers or the enterprise itself, which raises the cost of loss or misuse.
- Tooling: Enterprise-grade capabilities such as centralized logging, identity management and vulnerability scanning.
- Skills gap: Some Safeguards may require specialist knowledge that must be hired, trained or contracted.
To check fit, list your business units, the sensitive data each holds and whether your team can run centralized tooling. An organization that meets most of these points usually plans its roadmap around IG2.
CIS adds 23 Safeguards to IG2, bringing the total to 153, which is all Safeguards in CIS Controls v8.1. CIS describes an IG3 enterprise as one that employs security specialists, for example in risk management, penetration testing or application security. Such an enterprise holds data under regulatory oversight and needs Safeguards that address targeted attacks from sophisticated adversaries and reduce the impact of zero-day attacks.
- Specialists: Named roles for risk management, penetration testing and application security, not shared responsibilities.
- Regulatory oversight: Data subject to external regulators, which shapes evidence requirements and audit scope.
- Adversary profile: Exposure to sophisticated, targeted attacks that call for advanced detection and response.
- Zero-day resilience: Controls that limit impact when a flaw is exploited before a patch exists.
- Scope: Full coverage of all 153 Safeguards across the enterprise.
To check fit, confirm that you have specialist roles and regulated assets, and ask whether a specialist provider can supplement scarce internal skills before committing to the full set.
How the 153 Safeguards divide across IG1, IG2 and IG3
The Implementation Groups are cumulative, so each group contains everything in the group below it. IG1 holds 56 Safeguards, IG2 adds 74 for a total of 130, and IG3 adds the remaining 23 to reach all 153. An enterprise in IG2 is therefore expected to run the IG1 Safeguards as well as its own additions, and an IG3 enterprise carries the full set. Read this way, the groups are a sequence of scope rather than three separate programs, which matters when you plan staffing and budget: the IG1 work does not get thrown away when you move up.
Each v8.1 Safeguard is tagged with one asset class (Devices, Software, Data, Users, Network or Documentation), one security function (Govern, Identify, Protect, Detect, Respond or Recover) and the Implementation Groups it belongs to. The Govern function is the addition that aligns v8.1 with NIST CSF 2.0, and 25 of the 153 Safeguards carry it. Before you commit to a target group, filter the Safeguard list by function and check how many Govern items fall inside your target. Those are often the policy, ownership and oversight tasks that auditors and boards ask about first, and they are easy to underestimate because they produce documents rather than technical change.
The groups are recommended guidance, not a legal tier. CIS bases them on an enterprise's risk profile and available resources, and no regulator or certification body assigns an IG to you. Contracts and regulators may still name a specific Safeguard or a level of coverage, so confirm in writing what your customer or supervisor expects before you pick a group. Ask your implementation partner to map your target group to your asset inventory and existing tooling, and to state which Safeguards will be scoped out and why, so that the scope is documented and defensible.
How to decide which group to target first
Most enterprises start with IG1, because CIS describes it as the minimum standard for every enterprise. The factors below help you judge whether your organization needs IG2 or IG3 safeguards sooner, and CIS's own Implementation Group descriptions are the reference for each answer.
Data sensitivity and regulatory oversight
Start by listing what data you hold and who oversees it. CIS describes IG1 enterprises as mostly holding employee and financial data, IG2 enterprises as holding sensitive client or enterprise data, and IG3 enterprises as holding data under regulatory oversight. If a regulator, contract or card scheme examines your handling of data, expect to need IG2 safeguards at minimum, and check the Control 3 Safeguards against what that oversight asks. Confirm the exact scope with your compliance lead, since CIS states the Controls do not replace any regulatory scheme.
Presence of dedicated security staff
Count the people whose job is managing and protecting IT infrastructure. CIS describes IG1 as suited to limited IT and cybersecurity expertise, IG2 as an enterprise with staff responsible for managing and protecting infrastructure, and IG3 as one that employs security specialists in areas such as risk management, penetration testing or application security. If no one can run vulnerability management or threat modeling, treat the IG2 and IG3 safeguards that depend on those skills as a staffing or partner decision before a technical one.
Number of departments and sites
Map how many departments, business units, sites and subsidiaries operate separate IT and carry different risk. CIS describes IG2 enterprises as having multiple departments with different risk profiles, and enterprise-grade technology needs grow with that spread. A single office running one identity system can often finish IG1 before expanding. A group with separate networks, acquired companies or several data centers should plan IG2 work for asset inventory, centralized account management and network segmentation from the start.
Customer and contract requirements
Review your largest customer contracts, security questionnaires and partner requirements. Customers that ask you to show CIS Controls conformance may name a specific Implementation Group, and that request sets your target more than a general sense of risk does. Ask the customer which Safeguards they expect to see and in what form. CIS does not offer certification, so the evidence you provide is the record of your own assessment, not a badge.
Exposure to targeted attacks
Consider whether attackers have a reason to target you specifically, such as a valuable data set, a critical role in a supply chain or past incidents. CIS describes IG3 as the group that addresses targeted attacks from sophisticated adversaries and reduces the impact of zero-day attacks. Ordinary opportunistic threats are the focus of IG1. Your threat intelligence team or incident history is the best source for this answer, and it should be reviewed each year as your exposure changes.
Budget and downtime tolerance
Estimate how much unplanned downtime your operations can absorb and what budget and staff time are available for change. CIS describes IG1 as suited to low tolerance for downtime and small or home office hardware, which favors starting with simpler safeguards. Where downtime is costly, plan IG2 and IG3 changes such as enterprise-grade tooling in maintenance windows. Ask any quote to separate one-time setup costs from recurring licensing, staff and testing costs, so the budget matches the group you target.
What the Community Defense Model says about IG1 coverage
The CIS Community Defense Model v3.0, released in September 2026, gives the clearest published answer to the question most buyers ask first: how much protection does IG1 buy? According to CIS's press release of 21 September 2026, implementing the IG1 Safeguards covers 89% of System Intrusion, 86% of Social Engineering, 88% of Basic Web Application Attack, 84% of Privilege Misuse and 88% of Denial of Service techniques studied. The same analysis found that implementing all CIS Controls Safeguards defends against 99% to 100% of techniques across the five attack categories. Read the CIS press release for the full methodology before quoting these figures in a board paper.
These numbers describe CIS's analysis of attack techniques. They are not a guarantee that a given environment will be protected by a given percentage of safeguards, and they do not measure how well any individual safeguard is implemented. A technique counted as covered assumes the safeguard is deployed, configured and maintained as CIS describes. A CISO should therefore treat the percentages as a prioritization input, not as a measured outcome for their own estate. Confirm with your team which safeguards map to the techniques that matter most to your sector, and which of those depend on tooling or processes that do not yet exist.
The practical decision is where the remaining gap sits. If the IG1 coverage figures are the baseline, the 11% to 16% of techniques outside IG1 coverage in the analysis point toward the IG2 and IG3 Safeguards that address them. Ask your implementation partner or internal assessor to produce a list of uncovered techniques by category, then check each against your threat model and your regulatory scope. The output should show which gaps you accept, which you close in the next phase and which need named owners and dates.
How an organization moves from IG1 to IG2 and IG3
The sequence turns IG1 from a starting checklist into evidence that an organization can use to decide, with a written rationale, whether IG2 or IG3 safeguards apply next. Each phase produces a named artifact that the next phase depends on.
Confirm IG1 scope across all enterprise assets
The organization's IT and security leads define the enterprise boundary, then confirm that the IG1 safeguards apply to every in-scope device, software product, data store, user group and network segment, including cloud accounts and any service providers that hold data. CIS describes IG1 as a minimum standard for every enterprise, so the scope should not be narrowed to the systems that are easiest to measure. The output is an asset inventory and a scope statement that names what is in and out of scope and why. The step is done when a named owner signs off that no in-scope asset class is missing from the inventory.
Assess current state against the 56 IG1 safeguards
Staff test each of the 56 IG1 safeguards against the current environment, comparing what is documented, what is configured and what is actually operating. Where the CIS Controls Assessment Specification defines inputs, measures and metrics for a safeguard, the assessor uses those as the test basis, since the specification describes what to measure but not how to measure it. The output is a gap register that lists each safeguard, its status, the evidence reviewed, the owner and the remediation action. The step is done when every IG1 safeguard has a recorded status, with no safeguard marked as implemented without evidence.
Close IG1 gaps and document each safeguard
Owners remediate the gaps in the register, whether through configuration changes, tooling, written process or training, and record the change in the same register. Documentation is part of the work because a safeguard that operates but cannot be shown to an assessor is still an open gap. Many organizations use CIS's free IG1 policy templates as a starting point for the written processes, adapted to their own practices. Internal staff usually perform this work, and an implementation partner may help with configuration, tooling and documentation under a written scope. The output is an updated gap register and a controlled set of procedures. The step is done when each IG1 gap is closed, accepted as a documented risk with an owner, or scheduled in writing.
Build the IG1 evidence pack
The team collects the evidence that shows each IG1 safeguard operates, organized by safeguard so that a reviewer can trace a claim to its proof. Typical items include inventory exports, configuration baselines, access review records, patch and scan reports, log samples, backup restore test records and training completion records. Evidence should show the control working over time, not only on the day it was collected. The output is an evidence pack indexed to the 56 safeguards. The step is done when an internal reviewer who did not perform the work can locate the evidence for every IG1 safeguard without help from the owner.
Run an assessment against the specification
An assessor compares the evidence pack with the measures in the CIS Controls Assessment Specification for each IG1 safeguard and records whether the evidence meets each measure. This can be done by an internal team using the free CIS self-assessment tooling, or by an independent reviewer if the organization wants a second opinion. CIS does not certify organizations against the Controls, so the result is an internal or customer-facing assessment, not a certificate. The output is an assessment record that lists each safeguard, the measures tested, the result and any residual gaps. The step is done when every IG1 safeguard has a documented result that the organization's leadership has reviewed.
Identify the enterprise risk profile
Leadership examines the organization's profile against the CIS descriptions of IG1, IG2 and IG3. The questions include whether the enterprise has staff who manage and protect IT infrastructure, whether it holds sensitive client or enterprise data, whether it operates under regulatory oversight, whether it employs security specialists in areas such as penetration testing or application security, and whether it faces targeted or sophisticated attackers. The CIS Community Defense Model is a useful reference for linking safeguards to observed attack techniques. The output is a risk profile worksheet with a written answer for each question and the evidence behind it. The step is done when the profile has been reviewed by the people accountable for risk, not only by the security team.
Decide whether IG2 or IG3 applies
Using the risk profile and the assessment results, leadership decides whether to adopt the 74 safeguards IG2 adds, the 23 safeguards IG3 adds, or both in sequence. The decision memo records the chosen group, the reasoning, the safeguards in scope for the next phase, the resources and owners assigned, and the conditions that would trigger a reassessment. Because IG3 contains all 153 safeguards, an organization that adopts IG3 is also adopting IG2 and IG1. The output is a signed decision memo. The step is done when leadership has approved the memo and it is linked from the gap register so that future reviewers can see why the scope was chosen.
Where an implementation partner fits and where it does not
The organization owns its CIS Controls program, including the decision to target IG1, IG2 or IG3, the risk acceptances behind each Safeguard it defers, and the written policies that govern them. An implementation partner does not choose the group or decide which Safeguards are sufficient for the enterprise's risk profile. Under a fixed written scope, DeployOpen can prepare the systems and tooling that the chosen group requires: hardening the assets in scope against the CIS Benchmarks, configuring centralized logging, building the asset and software inventories that Controls 1 and 2 depend on, and organizing the resulting configuration exports, tickets and logs into an evidence set. All of this runs inside the client's own cloud accounts, data centers or air-gapped networks, and the client keeps administrative control of the environment after handover.
Before the work starts, the scope should state which Safeguards are in and out, which assets and business units are covered, what the client team must do (approvals, change windows, access for named staff), and what the deliverables are. A useful check is to ask the partner to map each in-scope Safeguard to the artifact that will prove it, then ask the client's internal or external reviewer whether that artifact would satisfy the assessment specification's measures. The CIS Controls Assessment Specification defines what to measure but not how, so that interpretation belongs to the organization and its assessor.
Only an independent assessor or an accreditation body issues reports, attestations or conformance statements. CIS Controls cannot be certified, and a partner's readiness work does not produce a CIS certificate or any third-party opinion. CIS offers CIS Controls Accreditation, run with CREST, but that program applies to service providers that deliver CIS Controls implementation, auditing or assessment services, not to the organizations those providers serve. Before signing, confirm with the partner in writing which statements its deliverables support and which must come from a party outside the engagement, and check how the organization plans to present its conformance to customers or regulators.
Common questions about CIS Controls implementation groups
Can a small business skip IG1 and start with IG2?
No, CIS says every enterprise should start with IG1. It defines IG1 as essential cyber hygiene and a minimum standard, with 56 foundational Safeguards that guard against the most common attacks. CIS describes a typical IG1 enterprise as small to medium-sized, with limited IT and cybersecurity expertise and low tolerance for downtime. IG1 Safeguards are meant to work with limited expertise and small or home office commercial hardware and software. A small business that adds IG2 Safeguards before finishing IG1 usually has gaps in basics such as asset inventory and account management, which the later groups assume are already in place. Start with IG1, then decide whether your data, staffing or regulatory exposure justifies moving up.
Is IG2 required for regulated firms?
The CIS Controls do not make IG2 mandatory, and CIS states the Controls do not replace any regulatory, compliance or authorization scheme. CIS describes an IG2 enterprise as one with staff managing IT infrastructure, several departments with different risk profiles, and sensitive client or enterprise data. Regulated firms often fit that description, so IG2 is a common target. Your regulator, contract or framework decides what you must meet, and that requirement may differ from the IG you choose. Check your obligations with your compliance lead or legal counsel, then map them to the Safeguards you need. CIS maintains mappings to frameworks such as NIST CSF and ISO 27000, which can help with that check.
Does IG3 include the IG1 and IG2 Safeguards?
Yes. CIS structures the groups cumulatively. IG2 adds 74 Safeguards to the 56 in IG1, for 130, and IG3 adds the remaining 23, which covers all 153 Safeguards in CIS Controls v8.1. An IG3 program therefore includes everything in IG1 and IG2. The practical question is effort: IG3 Safeguards assume security specialists in areas such as penetration testing, application security and risk management, and they target sophisticated, targeted attacks and zero-day impact. Before committing to IG3, confirm that your organization has those roles, or plan to contract them, because the additional Safeguards are not usually a small increment on IG2.
Can we implement IG1 ourselves without an outside partner?
Often yes, if you have an IT administrator who can run inventories, patching, account reviews and backups, and someone who owns the written policies. CIS designed IG1 Safeguards to work with limited expertise and commodity hardware and software, and CIS publishes free resources, including the IG1 policy templates and the self-assessment tool CSAT. The work that usually needs outside help is the technical configuration of your environment, the evidence collection your assessor will ask for, and any Safeguard that requires tooling you have not deployed before. Decide what your staff can own, then agree a written scope with any partner before work starts. DeployOpen prepares systems, controls and evidence for assessments, but it does not issue audit reports or certifications.
How much does each Implementation Group cost?
No single figure applies to all organizations, and this page does not give one. Cost depends on your asset count, how much of the environment is already documented and automated, whether you use internal staff or an outside partner, and how much evidence your assessor expects. Moving from IG1 to IG2 generally adds tooling, enterprise-grade technology and specialist time, and IG3 adds specialist security roles and more testing. CIS publishes a Cost of Cyber Defense estimate for IG1 that you can review as a starting point. For the cost components and what to ask for in a quote, read the CIS Controls implementation cost guide. Any partner quote should list the Safeguards in scope, deliverables and timelines in writing.
Does completing an Implementation Group earn a CIS certification?
No. No organization can be certified against the CIS Controls, and completing an Implementation Group does not produce a certificate. CIS states the Controls are free to use to improve your own security, and it offers CREST-backed accreditation only for service providers that deliver CIS Controls services. To show conformance, organizations typically use the CSAT self-assessment, evidence mapped to the Assessment Specification measures, or an independent assessment that issues its own report. DeployOpen prepares systems and evidence for such assessments but does not issue reports or attestations. Ask any firm offering a CIS certificate to name the body that issues it and to show its accreditation.
How DeployOpen scopes an IG1 or IG2 program
DeployOpen is a Chainscore Labs company that plans and implements self-hosted open-source platforms inside the client's own infrastructure. For CIS Controls implementation groups, we start from the Safeguards that apply to your chosen group, then prepare systems, configuration and documentation that help your team and your assessor check them.
How we scope
- Engagements are fixed-scope, with the IG1 or IG2 Safeguards in scope, deliverables and timelines agreed in writing before work starts.
- We map your current environment against the Safeguards of your target group, so the written scope names each Safeguard and the systems it touches.
- Scope documents state what your organization owns, such as policies and risk decisions, and what DeployOpen prepares, such as tooling and configuration.
How we build
- We deploy and configure open-source tooling for asset inventory, logging, vulnerability scanning and access control inside your accounts or data centers.
- Secure configuration follows documented baselines, and we test each change against the measures in the CIS Controls Assessment Specification where they apply.
- Where an IG2 Safeguard needs enterprise-grade technology, we flag it in the scope so cost and effort are visible before the build begins.
How we hand over
- Each Safeguard in scope comes with the configuration, output and records that show it is implemented, organized so an assessor can follow them.
- We provide runbooks and documentation so your staff can operate, review and update the tooling after handover.
- Our work prepares evidence only. Independent auditors and certification bodies issue any reports, and CIS Controls do not have a certification.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after the initial scope is delivered.
- When CIS releases a new version of the Controls, we can scope the changes to your existing program as a separate written engagement.
- Ask us to confirm exactly which Safeguards, systems and support hours a retainer covers before you sign.
