Lesson 2.69: CIS Controls v8: an IG1 self-assessment
NIST CSF says what outcomes to achieve; the CIS Critical Security Controls say concretely what to do. Version 8 has 18 controls broken into 153 safeguards, grouped into three implementation groups. IG1, about 56 safeguards, is what CIS calls essential cyber hygiene: the minimum every organisation should have. In the lab you score Northwind's IG1 self-assessment, list the safeguards it doesn't meet, check that claims have evidence, and turn the gaps into a plan.
16 min
You will learn to
- Explain CIS Controls, safeguards and implementation groups
- Score a self-assessment
- List unmet safeguards
- Check claims against evidence
- Turn gaps into a plan
Key terms
- CIS Controls
- A prioritised set of security actions from the Center for Internet Security; v8 has 18 controls.
- Safeguard
- One specific action inside a control, such as 6.4 'Require MFA for remote network access'.
- Implementation group (IG)
- IG1, IG2, IG3: increasing sets of safeguards matched to an organisation's resources and risk.
- Essential cyber hygiene
- CIS's name for IG1, the minimum safeguards every organisation should have.
- Evidence
- A document, export or record that shows a control actually operates.
← Reading security advisories: CVE, CVSS and known exploitation · All lessons · Governing the use of AI tools →