CIS Controls.

What the CIS Controls actually are

The CIS Critical Security Controls are an ordered, opinionated answer to a question every defender faces: of all the things you could do, what should you do first? Published and maintained by the Center for Internet Security, they distil real-world attack data into a prioritised set of safeguards grouped into 18 control categories, from inventory of enterprise assets and software through data protection, access control, continuous vulnerability management, audit log management, and incident response. Unlike a framework that tells you to establish a process, the Controls tell you concretely what to implement and roughly in what order, which is why they are often the fastest route from no security programme to a defensible one.

The defining feature is prioritisation. The list is not alphabetical or theoretical; the earlier controls are the ones that block the most common attacks. Knowing what hardware and software you have, configuring it securely, controlling administrative privileges, and patching known vulnerabilities prevent a large share of real incidents before you spend a euro on advanced tooling. That ordering is the value: a small team with limited time can start at the top and work down, confident it is closing the gaps attackers actually exploit.

Implementation Groups: IG1, IG2, IG3

The Controls scale through three Implementation Groups so the same catalogue serves a two-person business and a multinational. IG1 is defined as basic cyber hygiene, the minimum set every organisation should have in place, designed for enterprises with limited expertise and resources protecting against unsophisticated, opportunistic attacks. IG2 adds safeguards for organisations managing more sensitive data and facing more capable adversaries. IG3 is the full set, intended for mature organisations that hold critical assets and must defend against targeted, sophisticated attacks. Each group is cumulative: IG2 includes everything in IG1, and IG3 includes everything in IG1 and IG2.

In practice you self-assess to an Implementation Group, then treat the safeguards in that group as your work plan. Most small and mid-sized organisations should aim squarely at IG1 first and only move to IG2 once it holds. This is what makes the Controls approachable where a full management system can feel out of reach: you are handed a finite, testable checklist sized to your reality.

Where they sit next to ISO 27001 and other frameworks

The CIS Controls are a controls catalogue, not a certifiable management system, and that distinction matters. ISO 27001 certifies that you operate an information security management system with risk assessment, a Statement of Applicability, and continual improvement; CIS gives you a concrete, prioritised set of technical and operational safeguards to implement underneath it. They are complementary rather than competing. CIS publishes mappings from its safeguards to ISO 27001 Annex A and to other references such as NIST frameworks, so the implementation work you do for CIS becomes evidence you can present against an ISO control set. Teams frequently use CIS to drive the hands-on hardening and then map that effort up to whatever framework their auditors or customers require.