CIS Controls v8 organised safeguards by implementation group, not device

What the document says

On 18 May 2021, the Center for Internet Security released version 8 of the CIS Critical Security Controls, consolidating what had been 20 controls into 18, organised by activity rather than by who manages a device. The announcement said that physical devices, fixed boundaries and separate islands of security work are less central once organisations run cloud services, mobile devices and remote work. Version 8 groups its 153 safeguards into three Implementation Groups. IG1, the entry tier, has 56 safeguards CIS describes as essential cyber hygiene for organisations with limited in-house security staff and mostly commodity hardware; IG2 and IG3 add safeguards for organisations with greater data sensitivity and more capacity to run them. In June 2024, CIS published version 8.1, an incremental update that clarified terminology, revised asset-class mappings and realigned the framework's cross-references to NIST's Cybersecurity Framework 2.0, adding a governance category. It did not add or remove safeguards or Implementation Groups.

Confidence and limits

These facts come directly from CIS's own release announcement and its current framework pages, which is strong evidence for what the controls contain and when they changed. It is weaker evidence for anything about effectiveness: CIS is the document's author and the beneficiary of its adoption, and none of the pages opened here describe independent testing of whether following the controls reduces incidents. The prioritisation is CIS's own judgement, shaped by volunteer contributors, not a statistically derived ranking of attack frequency.

Why it mattered

Implementation Groups gave a small organisation a defensible answer to where to start, rather than a flat list an under-resourced team had no way to sequence. That mattered because earlier control lists were often read as all-or-nothing, and a partial effort could be dismissed as non-compliant with no credit for the safeguards already in place. IG1 in particular has become a reference point cited by insurers and regulators for a baseline level of hygiene, even though CIS itself does not describe IG1 as sufficient protection against a determined attacker.

Defensive takeaway

Treat IG1 as a floor, not a target. Map your current controls against the 56 IG1 safeguards before assuming a more advanced group is the right first step, and confirm which Implementation Group your organisation's data sensitivity and staffing actually place you in.

• Which of the 56 IG1 safeguards, if any, are we missing today?
• Does our security staffing match the Implementation Group we are trying to operate?
• Are we citing a control's presence in a policy, or its measured operation, as evidence of compliance?

A control list is a checklist for coverage, not a measurement of how well any single control is running. Reading the safeguards without confirming they operate as intended risks mistaking a documented policy for a working defence.