# CIS Controls v8
The Center for Internet Security (CIS) Critical Security Controls version 8 represents a prioritized set of 18 cybersecurity safeguards designed to mitigate the most prevalent and dangerous cyber attacks. These controls provide specific, actionable guidance for establishing essential cyber hygiene practices, focusing on high-impact defensive measures that deliver maximum risk reduction for the investment of time and resources.
Version 8, released in 2021, fundamentally reorganized the control structure from the previous version's 20 controls, consolidating overlapping areas while expanding coverage of cloud computing, mobile devices, and operational technology environments. The framework distills decades of real-world incident analysis, threat intelligence, and defensive best practices into concrete implementation guidance that organizations can follow regardless of their size, industry, or technical sophistication.
The CIS Controls exist because most successful cyber attacks exploit fundamental security weaknesses rather than sophisticated zero-day vulnerabilities. Attackers consistently succeed through basic techniques: exploiting unpatched systems, compromising weak credentials, moving laterally through poorly segmented networks, and persisting through inadequate logging and monitoring. The controls directly address these attack patterns by establishing defensive foundations that make opportunistic attacks significantly more difficult and targeted attacks more detectable.
Unlike broad security frameworks that provide high-level guidance, the CIS Controls specify measurable implementation steps. Each control includes detailed safeguards with clear implementation guidance, measurement metrics, and technology examples. This specificity transforms abstract security concepts into operational requirements that security teams can implement systematically and measure objectively.
The framework's strength lies in its prioritization methodology. The controls are ordered by their effectiveness in preventing known attack techniques, their feasibility for organizations to implement, and their ability to provide immediate risk reduction. This approach ensures that organizations achieve meaningful security improvements quickly, building momentum for comprehensive security programs.
The CIS Controls v8 framework operates through a hierarchical structure of 18 controls, each containing multiple safeguards that address specific defensive capabilities. The 18 controls are organized into three logical groupings: Basic CIS Controls (1-6) that establish fundamental security hygiene, Foundational CIS Controls (7-12) that build robust defensive capabilities, and Organizational CIS Controls (13-18) that address governance, training, and incident response.
The Basic Controls focus on asset management and configuration control. Control 1 requires organizations to maintain accurate inventories of authorized and unauthorized devices, while Control 2 extends this requirement to software assets. Control 3 addresses data protection by classifying and handling sensitive information appropriately. Control 4 establishes secure configuration management for enterprise assets and software. Control 5 focuses on account management, ensuring only authorized users can access systems. Control 6 implements access control management, restricting user privileges to necessary business functions.
Foundational Controls build upon these basics to create layered defenses. Control 7 establishes continuous vulnerability management programs. Control 8 addresses audit log management, ensuring security events are captured and retained. Control 9 implements email and web browser protections against common attack vectors. Control 10 focuses on malware defenses through endpoint protection and network filtering. Control 11 establishes data recovery capabilities through backup and restoration procedures. Control 12 implements network infrastructure management and monitoring.
Organizational Controls address human and process elements. Control 13 establishes network monitoring and defense capabilities. Control 14 focuses on security awareness and skills training for personnel. Control 15 implements service provider management to address third-party risks. Control 16 establishes application software security through secure development and deployment practices. Control 17 creates incident response management capabilities. Control 18 addresses penetration testing to validate defensive effectiveness.
Each control contains specific safeguards that provide implementation guidance. For example, Control 7 (Continuous Vulnerability Management) includes safeguards for establishing vulnerability scanning programs, prioritizing remediation efforts based on risk, and addressing vulnerabilities in a timely manner. Safeguard 7.1 requires organizations to establish and maintain a vulnerability management process, while 7.2 focuses on establishing a remediation process, and 7.3 addresses automated vulnerability scanning.
The Implementation Group (IG) structure provides scalable adoption paths. IG1 includes 56 safeguards that represent essential cyber hygiene practices suitable for all organizations. These safeguards focus on basic asset management, secure configurations, controlled access, and continuous monitoring. IG2 adds 74 additional safeguards for organizations with dedicated security resources, including advanced threat protection, network segmentation, and enhanced monitoring capabilities. IG3 includes 23 expert-level safeguards for organizations facing sophisticated threats, such as advanced persistent threat (APT) actors.
Version 8 introduced significant cloud-focused guidance throughout the controls. Rather than treating cloud security as a separate domain, the updated controls integrate cloud considerations into each applicable area. For example, asset inventory controls specifically address cloud resource discovery and management, while access control guidance covers cloud identity and access management platforms. This integration reflects the reality that most organizations operate hybrid environments spanning traditional infrastructure and multiple cloud platforms.
The controls also expanded coverage of operational technology (OT) and industrial control systems. Manufacturing, energy, and infrastructure organizations can apply the framework to their specialized environments while addressing unique OT security considerations such as safety requirements, legacy system constraints, and specialized protocols.
The CIS Controls v8 framework addresses a critical challenge facing organizations across all sectors: the overwhelming complexity of modern cybersecurity. With thousands of security products, standards, and recommendations available, security leaders often struggle to prioritize investments and focus efforts on activities that provide meaningful risk reduction. The controls cut through this complexity by identifying the specific defensive measures that actually prevent successful attacks.
Real-world attack analysis consistently demonstrates that most breaches succeed because organizations lack basic security fundamentals rather than sophisticated defenses. The 2022 Verizon Data Breach Investigations Report found that 82% of breaches involved human elements, including social attacks, errors, and misuse. External attackers caused 83% of breaches, but succeeded primarily through compromised credentials, phishing, and exploitation of known vulnerabilities rather than advanced techniques. The CIS Controls directly address these common attack patterns through prioritized implementation guidance.
Organizations implementing the controls systematically reduce their attack surface while building detection capabilities. Asset inventory controls ensure security teams understand what they're protecting and can identify unauthorized systems or software. Vulnerability management processes address known weaknesses before attackers can exploit them. Access controls limit attacker movement even when initial compromise occurs. Logging and monitoring capabilities provide visibility into attack activities, enabling faster detection and response.
The framework's business impact extends beyond technical risk reduction. Organizations following the CIS Controls often achieve better compliance outcomes with industry regulations and standards. Many regulatory requirements align with CIS Control safeguards, allowing organizations to address multiple compliance obligations through unified implementation efforts. Cyber insurance providers increasingly evaluate CIS Control implementation when assessing risk and determining coverage terms.
A common misconception treats the CIS Controls as merely a compliance checklist rather than a comprehensive security program foundation. Organizations that focus solely on checking boxes miss the framework's emphasis on continuous improvement and measurement. The controls require ongoing assessment, refinement, and adaptation to changing threat conditions and business requirements.
Another misconception assumes that implementing all 153 safeguards is necessary for effective security. The Implementation Group structure specifically addresses this concern by providing scalable adoption paths. Most organizations achieve significant risk reduction by focusing on IG1 safeguards before expanding to higher implementation groups. The prioritization methodology ensures that early implementation efforts address the most critical security gaps.
Organizations that ignore the CIS Controls often repeat common security program failures: implementing expensive security tools without establishing basic hygiene practices, focusing on advanced threats while remaining vulnerable to opportunistic attacks, and building security programs that cannot demonstrate measurable risk reduction to business leaders.
Within CDA's Performance Driven Method (PDM), the CIS Controls v8 framework falls squarely within the Security Posture Hygiene (SPH) domain, representing the foundational practices that establish and maintain baseline defensive capabilities. The controls embody the core SPH principle that consistent execution of fundamental practices provides more effective security than sporadic implementation of advanced techniques.
CDA approaches the CIS Controls through the Autonomous Posture Command (APC) methodology: "Your posture adapts. Your hygiene never sleeps." This philosophy recognizes that while threat conditions and business requirements constantly change, the fundamental hygiene practices captured in the controls must operate continuously and consistently. Organizations cannot take breaks from asset management, vulnerability remediation, or access control without creating opportunities for adversaries.
The APC methodology transforms traditional CIS Control implementation from periodic compliance exercises into continuous operational disciplines. Rather than conducting annual asset inventories, APC establishes automated discovery and tracking systems that maintain real-time visibility into organizational assets. Instead of quarterly vulnerability scans, APC implements continuous assessment and remediation workflows that address new vulnerabilities as they emerge. This approach ensures that security posture improvements compound over time rather than degrading between implementation cycles.
CDA's perspective differs significantly from conventional thinking about security frameworks. Traditional approaches often treat the CIS Controls as external standards to be satisfied through project-based implementation efforts. Organizations implement controls to achieve compliance milestones, then shift focus to other priorities until the next compliance cycle. This approach creates gaps where security posture deteriorates between active implementation periods.
CDA integrates the controls into operational business processes as measurable hygiene disciplines. Asset management becomes an ongoing component of IT service management rather than a separate security project. Vulnerability management integrates with change management and operational maintenance rather than operating as an isolated security function. Access management becomes part of human resources and business process workflows rather than a technical security activity.
The PDM emphasis on measurement and continuous improvement aligns naturally with the CIS Controls' focus on specific, measurable safeguards. Each control provides clear metrics that organizations can track over time to demonstrate improving security posture. CDA extends this measurement focus by establishing operational baselines, tracking performance trends, and correlating control implementation with actual risk reduction outcomes.
This measurement-driven approach enables organizations to optimize their control implementation based on actual effectiveness rather than theoretical compliance. Organizations can identify which safeguards provide the greatest risk reduction in their specific environments and prioritize resources accordingly. The continuous measurement also reveals degradation trends that require attention before they create exploitable weaknesses.
CDA recognizes that successful CIS Control implementation requires integration with broader organizational capabilities rather than isolated security initiatives. The controls work best when they become embedded components of existing operational processes, supported by appropriate technology platforms and measured through regular business reviews.
• The CIS Controls v8 provide a prioritized, measurable approach to cybersecurity that addresses the attack techniques actually used in successful breaches, focusing on fundamental hygiene practices that prevent opportunistic attacks and detect targeted threats.
• The Implementation Group structure enables scalable adoption, with IG1's 56 essential safeguards providing immediate risk reduction for all organizations, while IG2 and IG3 add capabilities appropriate for organizations with more sophisticated security requirements.
• Version 8's integrated cloud and operational technology guidance reflects modern hybrid environments, eliminating the need for separate cloud security frameworks while addressing specialized OT security considerations.
• Successful implementation requires treating the controls as continuous operational disciplines rather than periodic compliance projects, establishing automated processes and continuous measurement to maintain consistent security posture.
• The framework's business value extends beyond technical risk reduction to include improved compliance outcomes, better cyber insurance terms, and measurable security program effectiveness that supports informed business decisions.
• [Change Management for Security] • [Security Operations Center Design] • [Iron Iris Operational Resilience Overview] • [Asset Management and Discovery] • [Vulnerability Management Programs]
• Center for Internet Security. "CIS Controls Version 8." May 2021. https://www.cisecurity.org/controls/v8
• National Institute of Standards and Technology. "Framework for Improving Critical Infrastructure Cybersecurity Version 1.1." NIST Cybersecurity Framework. April 2018.
• MITRE ATT&CK Framework. "Enterprise Tactics and Techniques." https://attack.mitre.org/
• Verizon. "2022 Data Breach Investigations Report." 2022. https://www.verizon.com/business/resources/reports/dbir/
• SANS Institute. "CIS Controls Implementation and Mapping." SANS White Paper. 2021.