CIS Controls v8 Field Reference

anchor@anchor-cyber:~$ man cis-controls-v8

$ cis --implementation-groups

Implementation Groups / 153 safeguards total

IG1

Essential cyber hygiene

Limited IT/security expertise, mostly off-the-shelf commercial hardware/software. Guards against the most common attacks.

safeguards 56

IG2

Multiple departments, more risk

Some dedicated IT/security staff, manages more complex operational risk across business units.

adds +74 (130 cumulative)

IG3

Sophisticated attacker resistance

Dedicated security staff managing sensitive/confidential data, defending against skilled, targeted attacks.

adds +23 (153 cumulative)

$ cis --controls -l

The 18 Controls

1	Inventory and Control of Enterprise Assets
2	Inventory and Control of Software Assets
3	Data Protection
4	Secure Configuration of Enterprise Assets and Software
5	Account Management
6	Access Control Management
7	Continuous Vulnerability Management
8	Audit Log Management
9	Email and Web Browser Protections
10	Malware Defenses
11	Data Recovery
12	Network Infrastructure Management
13	Network Monitoring and Defense
14	Security Awareness and Skills Training
15	Service Provider Management
16	Application Software Security — where an ASVS-based, secure-coding-first AppSec program actually lives in the CIS structure
17	Incident Response Management
18	Penetration Testing

$ cis --vs csf

When to Reach for This Instead of CSF

CSF is outcome-based and framework-agnostic — good for governance conversations and gap analysis at the leadership level. CIS Controls are concrete and prescriptive — good for "what do we actually configure" conversations with the engineers who have to implement it. Same client engagement often uses both: CSF for the Profile and roadmap, CIS Controls IG1 as the literal punch list for a small business that has nothing in place yet.

CIS Controls v8 — Field Reference

Implementation Groups / 153 safeguards total

The 18 Controls

When to Reach for This Instead of CSF