Center for Internet Security (CIS) Releases Critical Security Controls Navigator

• The CIS Critical Security Controls (CIS Controls) provide a simplified and prioritized set of best practices to strengthen cybersecurity.
• Implementing CIS Controls helps organizations achieve essential cyber hygiene and comply with industry regulations.
• The CIS Controls are organized into specific actions called Safeguards and tiered Implementation Groups to prioritize cybersecurity efforts.

The CIS Critical Security Controls (CIS Controls) offer a simplified, prioritized set of best practices to enhance an organization’s cybersecurity posture. Developed through a community consensus process involving thousands of cybersecurity practitioners worldwide, the CIS Controls provide actionable recommendations to protect against today’s top threats. The latest version, CIS Controls v8.1, includes 18 top-level measures that address various aspects of cybersecurity, including inventory management, data protection, access control, and incident response. These controls are designed to be easy to understand and implement, making them accessible to organizations of all sizes.

Implementing CIS Controls helps organizations achieve essential cyber hygiene by addressing common vulnerabilities such as unpatched software and poor configuration management. The controls also serve as a foundation for compliance with various industry regulations, including PCI DSS, HIPAA, and GDPR. By following the CIS Controls, organizations can create a streamlined approach to cybersecurity that aligns with regulatory requirements and best practices, ensuring a robust defense against cyberattacks. The controls are also structured to support hybrid and fully cloud environments, emphasizing the importance of securing supply chains and evolving workplace technologies.

The CIS Controls are divided into specific actions called Safeguards, each requiring minimal interpretation to implement. These Safeguards guide the practical application of the top-level controls and are organized into Implementation Groups (IGs) that help organizations prioritize their cybersecurity efforts. IG1, for example, represents essential cyber hygiene, while IG2 and IG3 build upon this foundation with more advanced measures. This tiered approach ensures organizations can tailor their cybersecurity strategies to their specific risk profiles and resource availability.

Various free resources are available to support the adoption and implementation of the CIS Controls, including mappings to other security standards, policy templates, and companion guides. The CIS Controls Navigator tool helps organizations see how these controls fit into their broader security programs. By leveraging these resources, organizations can effectively integrate CIS Controls into their cybersecurity frameworks, enhancing their security posture and compliance efforts.

Read more about CIS Controls resources