Essential Eight vs CIS Controls

Essential Eight vs CIS Controls: which to pursue first

Start with the Essential Eight if your customers or regulators are in Australia or you supply Australian government, because that is the baseline they will ask you to measure against. Start with CIS Controls Implementation Group 1 if you are outside Australia, have no mandate to report maturity, and need a free, self-directed hygiene baseline. Holding both on the shortlist is reasonable when the two overlap in your environment, since the Essential Eight is assessed by maturity level against ASD's model and produces no ASD certificate, while the CIS Controls are free for your own use and organized into Implementation Groups you choose yourself. Neither produces a certificate you can display as proof, so the question is which evidence your buyers will accept.

Confirm the requirement before you pick. Ask the Australian buyer or contracting officer which Essential Eight maturity level they expect and how they want it evidenced. Ask a non-Australian customer whether they want a CIS Controls implementation statement, a mapping to a framework they already use, or nothing at all. CIS states that the Controls do not replace any regulatory or compliance scheme, so a CIS-aligned program will not satisfy an obligation that names a different framework. For the CIS side, CIS says every enterprise should start with IG1, which covers 56 foundational safeguards, and CIS-Hosted CSAT is a free tool for assessing and tracking progress against them. Check the current CIS Controls Navigator before relying on any mapping, because the mappings are CIS's own and their scope is not an endorsement of equivalence.

Doing both is worthwhile when one program can serve two audiences. The ASD Essential Eight profiles of the ISM and CIS IG1 both emphasize asset discovery, vulnerability management and privileged access, so a single asset inventory and patch process can produce evidence for each. Keep the Essential Eight evidence tied to ISM control IDs and the CIS evidence tied to Safeguard IDs, so an assessor can trace each claim. DeployOpen plans, implements and documents this kind of evidence inside your own environment, but it does not assess, certify or attest to either framework; an independent assessor or your own governance process makes that call.

How the Essential Eight and CIS Controls differ on scope, structure and cost

This table compares how ASD's Essential Eight and CIS's Controls are published, licensed, assessed and paid for. Read each row as a question you will ask a vendor, assessor or internal team before choosing a baseline or budgeting its work.

Dimension	Essential Eight (ASD)	CIS Critical Security Controls v8.1
Structure	Eight mitigation strategies, each assessed at Maturity Levels One to Three	18 Controls with 153 Safeguards, grouped into Implementation Groups IG1 (56), IG2 (74 more) and IG3 (23 more)
Publisher and license	Australian Signals Directorate via cyber.gov.au; no license fee stated in supplied facts, confirm reuse terms with ASD	Center for Internet Security, a US nonprofit; Creative Commons BY-NC-ND 4.0, free to use internally, commercial use needs CIS approval
Who requires it	Mainly Australian government and entities that must meet ASD expectations; suppliers to Australian government should confirm contract terms	No regulator mandates the Controls; CIS states they do not replace any regulatory or compliance scheme
Proof produced	No certificate; maturity is evidenced by assessing each strategy's implementation and effectiveness	No certificate; evidence is whatever your assessment against the Controls Assessment Specification produces
Machine-readable profiles	ISM OSCAL with ML1, ML2 and ML3 baseline profiles (46, 87 and 123 controls in v2026.09.4)	Navigator maps v8.1 to 30 frameworks and versions; confirm the export format you need before buying tooling
Assessment guidance	Assessment evidence guide for enterprise IT (v2026.10.15) published in OSCAL alongside the ISM	Controls Assessment Specification defines inputs, operations, measures and metrics for each Safeguard; it covers what to measure, not how
Free tooling	Assessment guidance and OSCAL files are published by ASD at no charge; confirm current access terms	CIS-Hosted CSAT is a free web application for assessing and tracking Controls implementation
Paid accreditation and services	No ASD accreditation scheme is named in supplied facts; budget for internal staff time or a provider	CIS Controls Accreditation, run with CREST, lists application fees of $1,500 for CREST members and $2,500 for non-members (CIS)
Recurring vs one-time cost	Recurring: patch cycles, scanning cadence, evidence refresh; one-time: initial baseline and gap work	Recurring: Safeguard operation and re-assessment; one-time: initial scoping, IG selection and tooling setup

How Maturity Level One compares with Implementation Group 1

Maturity Level One (ML1) and Implementation Group 1 (IG1) both sit at the entry point of their frameworks, but they answer different questions. ML1 of the Essential Eight sets requirements for all eight mitigation strategies, from patch applications and multi-factor authentication to regular backups. IG1 is CIS's essential cyber hygiene set: 56 foundational Safeguards that CIS says every enterprise should start with, aimed at guarding against the most common attacks. Because ML1 is scored per strategy against a maturity model and IG1 is scored per Safeguard against CIS's assessment specification, the two cannot be swapped. Passing one does not give you the other.

CIS describes a typical IG1 enterprise as small to medium-sized, with limited IT and cybersecurity expertise, low tolerance for downtime and mostly employee and financial data to protect. CIS also says IG1 Safeguards should work with limited expertise and with small or home office commercial hardware and software. That suits a team without a dedicated security function, but a larger estate with specialist staff, regulated data or ASD-style patching deadlines may find IG1 too thin on its own. Read the Safeguard text rather than assuming that a Safeguard covers the same depth as the matching ML1 control. (Illustrative: a 40-person firm with one IT generalist may find IG1 a realistic first target, while a government supplier with classified-adjacent data would likely need ML2 or IG2 scope.)

Before you accept a scope statement from a vendor or assessor, ask which ML1 controls and which IG1 Safeguards they will test, and whether the list is the full profile or a subset. Ask which ISM ML1 profile version they used, since the profiles are published in OSCAL and track ISM releases. Ask how they will evidence patch timing for internet-facing systems and whether their scanning cadence meets the ML1 frequencies. For IG1, ask how they will apply the Assessment Specification measures to each Safeguard in your environment, and whether any Safeguard is marked not applicable and why.

Where the Essential Eight and CIS Controls overlap

The two baselines address many of the same technical problems, so one control environment can often serve both. Overlap is clearest in asset visibility, patching, privileged access and recovery. Confirm each mapping against the source documents before you claim it to a customer or assessor.

Asset inventory and discovery

Essential Eight ML1 requires automated asset discovery at least fortnightly, and CIS Controls put asset inventory at the start of the stack. Each CIS Safeguard carries one asset class: Devices, Software, Data, Users, Network or Documentation. Map your discovery output to those classes so one inventory supports both assessments. Check that the tool records the fields each assessment will ask for, such as owner, operating system and business function.

Patching and vulnerability scanning

Both baselines expect structured vulnerability management, but they state their expectations differently. Essential Eight ML1 sets patch deadlines, including 48 hours for vendor-critical or exploited vulnerabilities in online services and internet-facing systems, and daily scanning for those systems. The CIS Controls define the measures used to verify each Safeguard, so confirm any timing against the Safeguard text before you adopt ML1 deadlines as a CIS commitment.

Administrative privilege control

Essential Eight ML1 includes restricting administrative privileges, and CIS Controls cover account and access management across the same systems. Keep privileged accounts in their own list, separate from standard user accounts, so you can show who holds administrative rights and when each grant was last reviewed. Check that this list lines up with the Users asset class in your CIS mapping. Treat one privileged account register as the evidence source for both assessments.

Backups and recovery testing

Essential Eight includes regular backups, and CIS Controls v8.1 place recovery under the Recover security function. Each Safeguard maps to one security function, and 25 of the 153 Safeguards carry the Govern function, so recovery evidence will sit alongside governance evidence. Verify that backup scope covers the Data asset class and that restores are tested as well as scheduled. Ask your backup platform which features support the ML level you are targeting.

Limits of a mapping

CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. The CIS Controls Navigator for v8.1 maps to 30 frameworks and versions, and NIST's CSF 2.0 reference export lists CIS Controls v8.1 among its informative references. NIST does not check the correctness of non-NIST mappings, so confirm any Essential Eight to CIS mapping in the ASD and CIS source material before you present it to an assessor.

What ML1 patching and asset discovery expect from your team

At Maturity Level One, the Essential Eight expects patch deadlines that are measured in hours and days, not in quarterly cycles. For vendor-critical or exploited vulnerabilities in online services and internet-facing systems, the deadline is 48 hours. Other vulnerabilities in those systems and in common user applications have a two-week deadline, and workstation and internal server operating systems have one month. Before you commit, confirm who owns each class of asset, who approves an emergency change outside business hours, and whether your change process can meet 48 hours without a standing exception. These are the questions your team has to answer, because the deadline is set by the baseline, not by your release calendar.

The discovery and scanning cadence is the part most teams underestimate. ML1 requires automated asset discovery at least fortnightly, daily vulnerability scanning for online services and internet-facing operating systems, weekly scanning for common user applications, and fortnightly scanning for workstation operating systems. Your tooling must therefore produce a current inventory it can trust, which means it needs credentials and network reach to every segment, including cloud accounts and laptops that are not always on the corporate network. CIS expresses this differently. Its asset inventory and vulnerability management Safeguards are written as outcomes to be achieved and verified through the CIS Controls Assessment Specification, not as fixed scan frequencies, so the same inventory can satisfy CIS while still falling short of an ML1 cadence. Confirm which scanner, asset source and ticketing system will carry the evidence, and who reviews the exceptions.

Which suits an organization outside Australia or a supplier to Australian government

If your organization operates outside Australia and has no Australian government customers, the CIS Controls are usually the more natural starting point. CIS states that the Controls are free for any organization to use to improve its own cybersecurity, and the content is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0. Commercial use requires CIS's prior approval, so read the license terms before you reproduce Controls text in client-facing material. The condition that matters here is self-directed improvement: you choose the Implementation Group, measure your own progress and decide how far to go.

Mappings to frameworks you already report against: The CIS Controls Navigator for v8.1 offers mappings to 30 frameworks and versions as of October 2026, including NIST CSF 2.0, ISO/IEC 27001:2022, SOC 2 and PCI DSS v4.0. This helps when your auditors ask how controls map to a framework you already use.
No certificate is produced: CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. Use them to drive your program, not as proof to a regulator.
Free self-assessment tooling: CIS-Hosted CSAT is a free web application for assessing, tracking and prioritizing implementation of the CIS Controls.
Accreditation is a separate question: CIS Controls Accreditation, run with CREST, covers service providers. Ask any implementation partner to show their accreditation status rather than assuming it.

Before you commit, confirm with your regulator or sector body whether they name a specific framework, since CIS mappings do not establish compliance on their behalf.

Who assesses each framework, what it issues and how often

This table compares who evaluates Essential Eight maturity and CIS Controls implementation, what each produces, and how often the work recurs. Read it to match the proof your customers or regulator expect with the assessor you can actually engage.

Question	Essential Eight	CIS Controls
Who assesses it	Assessors evaluate each of the eight strategies against the maturity model. ASD does not certify organizations, so the assessor is your internal team, an independent reviewer or a contracted provider.	No certification body is named in the supplied facts. Implementation is verified against the Controls Assessment Specification, and organizations use internal staff or a provider they select.
What it issues	No ASD certificate exists. Output is an internal or third-party assessment record showing the maturity level reached for each strategy and the evidence behind it.	No certificate is issued by CIS. Output is a self-assessment or independent assessment report, typically tracked in CIS-Hosted CSAT or a GRC tool.
Accreditation of assessors	Not applicable. Confirm with any provider which ASD guidance their method follows and how they document evidence against each strategy.	CIS Controls Accreditation, run with CREST, covers SecureSuite member organizations offering implementation, auditing or assessment services. Application fees are $1,500 for CREST members and $2,500 for non-members (CIS).
How often it recurs	Set by your customer, contract or internal policy. Maturity is reassessed when controls change, so confirm the cycle in writing with the assessor.	Set by your own governance cycle. CIS does not prescribe an assessment interval, so confirm the frequency your customers or auditors expect.
Questions to confirm with the assessor	Which maturity level scope applies to your environment, how evidence for each strategy is sampled, and whether the report can be shared with suppliers or government buyers.	Whether the accreditation covers the specific Safeguards in scope, how the report maps to CAS measures, and what rights you have to use the output with customers.
Who pays and what recurs	You pay the assessor for each assessment. Scope size and the number of systems drive effort, and reassessment recurs.	The accreditation application is one-time. Assessment fees, tooling and internal time recur with each assessment cycle.

Free tools and machine-readable profiles for each framework

Both frameworks publish free material that turns a list of controls into something a team can measure and track. The four items below cover what CIS and ASD provide, what each tool measures, and where the work of judging your own environment still sits with you.

CIS-Hosted CSAT self-assessment

CIS-Hosted CSAT is a free web application from CIS for assessing, tracking and prioritizing your implementation of the CIS Controls. It helps a team record which Safeguards are in place and where the gaps are, and it suits an organization that wants a structured inventory before buying tooling. It does not verify anything on its own: the scores reflect what your staff report, so independent evidence still has to be collected. Confirm the hosting and data handling terms with CIS before you enter sensitive information.

CIS Controls Assessment Specification

The CAS defines, for each Safeguard, the inputs, operations, measures and metrics used to verify that it is implemented. Use it to design your evidence collection, such as which configuration exports or logs to pull for an asset management Safeguard. CIS states that the specification covers what to measure, not how, so your team or assessor must choose the tooling and procedures. Read the terms of use before you reproduce any CAS text in internal or client documents.

Essential Eight ML1, ML2 and ML3 profiles

ASD publishes Essential Eight baseline profiles of the Information Security Manual in OSCAL, a machine-readable format that ASD says can be loaded into GRC tooling to track implementation. Each maturity level is a separate profile, so a team can load ML1 first and step up to ML2 or ML3 as it matures. The profiles track ISM controls, not maturity scores, so a loaded profile does not show that a strategy is effectively implemented. Confirm the ISM version your tooling uses matches the one your assessor expects.

ISM OSCAL collection

The ISM is published in OSCAL with the Essential Eight profiles included, so the same machine-readable source covers the controls behind each maturity level. It is the reference to map against when a Safeguard or Essential Eight control needs a clearer technical reading. The collection does not provide an assessment method or a certificate, and it does not map CIS Safeguards for you. Check whether your GRC platform supports the OSCAL version in use before planning an import.

How to do both without duplicating evidence

This sequence lets one asset inventory, one set of evidence and one gap list serve both the Essential Eight maturity assessment and the CIS Controls Implementation Group assessment, so the work is done once and reported twice.

Confirm contractual and regulatory obligations first
Before choosing a level, list every customer contract, government procurement requirement and regulator expectation that names a framework. Legal, compliance and the account owners who hold those contracts do this together. The output is a short written list that states which party requires Essential Eight, which requires CIS Controls, and which accepts either. If a contract names a specific maturity level or Implementation Group, record it exactly as written. Confirm wording with the contract owner, because a supplier to Australian government may face requirements that differ from a commercial customer's.
Build one asset inventory for both scopes
Start ML1 or IG1 scoping against a single asset inventory covering devices, software, data, users, network and documentation. Infrastructure and security teams do this together, and the Essential Eight patching and asset discovery expectations and the CIS asset classes should both be measured from this list. The output is one inventory with an owner for each asset and a record of which assets are internet-facing. Confirm the inventory against your CMDB and cloud accounts, since an inventory that only one team trusts will produce two conflicting scopes.
Map existing evidence to both frameworks
Take the evidence you already hold, such as patch reports, scan results, MFA configuration exports, backup restore tests and access reviews, and tag each item against the relevant Essential Eight strategy and the CIS Safeguard it supports. Security governance leads this with the control owners. The output is one evidence register where each item carries both tags, so a single artifact can answer both assessments. Where official mappings exist, such as CIS Controls Navigator mappings or ASD's evidence mapping collections, use them as the starting point and confirm each row, because a mapping is a reference and not a substitute for checking the evidence.
Assess and close gaps in patching and privileged access
Test the evidence against the ML1 patch deadlines and the vulnerability scanning cadence, then check privileged access against the restrict administrative privileges strategy and the matching CIS Safeguards. Security engineering and system owners carry out the checks, and the head of IT signs off on the gap list. The output is a gap register with an owner and a remediation record for each gap, showing which fixes satisfy both frameworks at once. Confirm the deadlines and cadences against the current ISM profile and the CIS Assessment Specification, because these are the points where the two frameworks are most often assessed differently.
Confirm the evidence holds for both assessors
Review the evidence register with the people who will assess it, using the same samples for each framework. This includes internal audit or an external reviewer if one is engaged. The output is a dated record showing which evidence was accepted under each framework and any items the assessor asked to see in a different form. Ask the assessor, before the review, how they expect each Essential Eight maturity level or CIS Implementation Group to be evidenced, because the two frameworks do not ask for the same proof of the same control.
Move to ML2 or IG2 when the baseline is stable
Once ML1 or IG1 evidence is stable and the gap register is closed or accepted, plan the move to the next level. Security leadership decides the timing with the business owners who carry the added operational load. The output is a written plan that lists the additional ML2 controls or IG2 Safeguards, the owners and the evidence each one will need. Because every ML1 control also appears in ML2 and the ISM profiles are published in machine-readable form, check the plan against the current ISM OSCAL profile and the CIS Safeguard list before work starts.
Refresh the register when frameworks change
Schedule a review of the evidence register each time ASD publishes a new ISM or Essential Eight release, or CIS publishes a new Controls version or Navigator update. The compliance lead runs the review and the control owners update their rows. The output is a version-stamped register showing which framework release each piece of evidence was checked against. Confirm which release your contracts reference, because an assessor will expect evidence to match the version named in the scope.

What buyers ask before hiring help with Essential Eight or CIS Controls

Can we reach ML1 or IG1 without outside help?

Often yes, if you have staff who can run asset discovery, patching, vulnerability scanning and backup testing, and who can document evidence. Both baselines are published openly: ASD's Essential Eight maturity model and CIS's IG1 safeguards are written to be applied by internal teams. CIS describes IG1 as designed for organizations with limited IT and cybersecurity expertise. Outside help usually pays off when no one owns the work, the environment is complex, or you need an independent view of whether the controls work. Check your team's capacity against the specific safeguards, not the baseline name.

What drives the cost and effort of an Essential Eight or CIS Controls project?

The main drivers are scope and environment count, followed by asset count, tooling and staff time. Scope decides which systems, business units and cloud accounts are assessed. Asset count affects discovery and patching effort. The number of environments (production, test, air-gapped or multi-cloud) multiplies configuration and evidence work. Existing tooling reduces effort, while missing tools add procurement and integration work. Ask any provider for a written quote that lists these inputs, the staff time each phase assumes, and the tools included or excluded.

Which costs are one-time and which recur?

Readiness work is mostly one-time: gap assessment, configuration hardening, initial policy and evidence set-up, and tool deployment. Recurring costs include running patch cycles, daily or weekly vulnerability scanning reviews, backup testing, staff training, periodic reassessment and any retainer for ongoing support or upgrades. The Essential Eight is maintained as an ongoing practice, and ASD's ISM is updated over time, so budget for review cycles. Ask the provider which items are fixed-scope deliverables and which are retainers, and whether tool licenses are included.

How long does readiness work take?

The answer depends on how far your current controls are from the target. A team that already patches on schedule and tracks assets will move faster than one that has no inventory. Scope, the number of environments and the availability of staff set the pace more than the framework does. No general duration is supplied here, so ask for a timeline in the written scope with milestones for discovery, remediation, evidence collection and internal review, and confirm which dependencies (change windows, vendor patches, procurement) sit outside the provider's control.

What does the work need from our team?

Plan for named owners in identity, endpoint, network, backup and application support, plus someone who can approve change windows and accept risk. Engineers will need access to asset inventories, vulnerability scanner output and admin consoles, and they will need time to test patches and backups. Governance staff must agree the evidence each control produces. Ask any provider which roles it expects from your side, how many hours it assumes per role, and who signs off on remediation decisions.

Does DeployOpen certify our compliance with Essential Eight or CIS Controls?

No. The Essential Eight is a set of mitigations with no ASD certificate, and CIS Controls are not a certification scheme either. DeployOpen plans, implements, documents and supports the controls inside your infrastructure and prepares evidence for assessment. It does not issue audit reports, attestations or certifications. Where an independent assessment is needed, confirm with your customer, regulator or assessor which evidence they accept and who performs the review.

What should we request in a written quote?

Ask for a scope statement that names the systems, environments, asset counts and target maturity level or Implementation Group. Request a deliverables list with evidence formats, a responsibility matrix separating your staff from the provider, the assumed staff effort, the tools included or excluded, and the assumptions behind the schedule. Also ask how changes to scope are priced, whether retainers are offered after handover, and how the provider handles testing and documentation of backups and patches.

How DeployOpen scopes and delivers readiness for both frameworks

DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For Essential Eight vs CIS Controls, we prepare the systems, controls and evidence so your team can assess its own position, and we do not issue certificates or assessment reports.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope names which Essential Eight strategies or CIS Safeguards are in view, and which Implementation Group or maturity level is targeted.
Confirm with us which asset inventory, patching and backup evidence you already hold before any quote is issued.

How we build

We map existing controls to the Essential Eight maturity model and to CIS Safeguards, noting where one source covers both.
We configure patching, asset discovery, vulnerability scanning and MFA inside your own cloud accounts, data centers or air-gapped networks.
We test implemented controls against the relevant measures and document results, including gaps we cannot close within scope.

How we hand over

You receive documented control implementations, evidence records and a mapping between the two frameworks for your own assessors.
Runbooks cover patch cadence, scanning schedules and backup restoration, so your staff can operate the controls after handover.
Ask us to confirm which artifacts are in the deliverable list and which must be produced by your team or an independent assessor.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, billed separately from the initial fixed-scope work.
A retainer can cover re-testing after platform upgrades, changes to the CIS Controls version or updates to ASD's Essential Eight profiles.
Confirm response expectations and service levels in the written retainer terms before you commit to ongoing support.

Essential Eight vs CIS Controls