What is meant by the CIS Controls?
The CIS Controls, formally the CIS Critical Security Controls, are a prioritized list of defensive actions published by the Center for Internet Security, a nonprofit. They began as a list of twenty controls, once widely known as the SANS Top 20, and were reorganized into 18 controls in version 8 in 2021; version 8.1 followed in 2024. Each control breaks down into specific safeguards, a little over 150 in all, written as actions an organization can put in place and measure.
The 18 controls
- Inventory and control of enterprise assets
- Inventory and control of software assets
- Data protection
- Secure configuration of enterprise assets and software
- Account management
- Access control management
- Continuous vulnerability management
- Audit log management
- Email and web browser protections
- Malware defenses
- Data recovery
- Network infrastructure management
- Network monitoring and defense
- Security awareness and skills training
- Service provider management
- Application software security
- Incident response management
- Penetration testing
Implementation groups
Few organizations can do everything at once, so each safeguard is assigned to one or more implementation groups. IG1 is the starting set, which CIS describes as the minimum standard of cyber hygiene for every enterprise, aimed at small organizations with limited IT and security staff. IG2 adds safeguards for organizations running more complex environments or handling sensitive data. IG3 includes every safeguard, for organizations facing skilled attackers or heavy regulatory demands. The groups are cumulative: an IG2 organization completes IG1 first.
How organizations use them
The order is deliberate. Nobody can protect assets they have not counted, so hardware and software inventory come first, followed by data protection and secure configuration. Teams use the list to set priorities, to run a self-assessment or gap analysis, and to map their program onto other frameworks; CIS publishes mappings to the NIST Cybersecurity Framework and other standards. Unlike ISO/IEC 27001, the CIS Controls are not something an accredited body certifies an organization against.
CIS Controls vs. CIS Benchmarks
Both come from the same organization, and they are easy to confuse. The CIS Controls say what a security program should do across the whole organization, such as keep an inventory, manage accounts and train staff. The CIS Benchmarks are detailed secure configuration guides for specific products, such as a Windows Server release, a browser or a cloud platform, with a Level 1 profile for most systems and a stricter Level 2. Control 4, secure configuration, is where the Benchmarks usually come in: applying one as the baseline is a common way to meet it.
CIS Controls on the CompTIA Security+ exam
The ideas behind the CIS Controls appear across SY0-801: frameworks, standards and benchmarking under objective 5.5, secure baselines often built from CIS Benchmarks under objective 4.1, and asset inventory, the subject of the first two controls, under objective 4.2. If a scenario asks for a free, prioritized list of safeguards that lets a small organization start with basic hygiene, the CIS Controls fit. If it asks for exact recommended settings for one operating system, the answer is a CIS Benchmark or a STIG. Distractors include ISO/IEC 27001, which is certifiable, and the NIST CSF, which organizes a program by function rather than prescribing ordered safeguards.