By Samuel Keene, March 10, 2026

CR-T Site

The CIS Critical Security Controls are a framework of cybersecurity best practices aimed at guiding organizations in managing and reducing cybersecurity risks. Developed by the Center for Internet Security (CIS), these Controls provide a set of recommended actions to safeguard sensitive data and information systems against modern threats. The evolving landscape of cyber threats necessitates a robust approach, and the CIS Controls offer actionable advice for organizations of all sizes, from small businesses to large enterprises.

In today’s digital age, threats such as malware, ransomware, and data breaches are more prevalent than ever. The CIS Controls are designed to help organizations not only identify potential vulnerabilities but also implement effective cyber hygiene practices. Continuous updates to the Controls ensure that they remain relevant to current technologies and attack vectors, allowing organizations to stay ahead of cyber adversaries.

Implementing the CIS Controls can lead to significant improvements in cybersecurity posture, including:

• Identifying and addressing inventory weaknesses in assets
• Facilitating tracking and assessment of cyber risks
• Providing practical measures for enhanced security

Organizations often utilize the CIS Controls as foundational elements for risk management frameworks, particularly concerning service provider management, which is pivotal as many companies outsource functions to third-party vendors. These Controls serve as an excellent starting point for developing comprehensive cybersecurity strategies rather than an exhaustive solution for all security challenges.

Latest Version of the CIS Controls

As of May 18, 2021, CIS published Version 8 of the CIS Controls, introduced during the RSA Conference of the same year. This update aims to keep the recommendations aligned with the fast-paced evolution of the cyber threat landscape. One of the most notable revisions in this version is the simplification of each Control, allowing for a clearer understanding of the required actions.

In Version 8, the focus centers on task-based implementation, regardless of who manages the devices. This consolidation approach streamlines the Controls, making them easier for organizations to apply without extensive interpretation. The resultant feedback from cybersecurity experts and organizations indicates a positive trend toward improved comprehension and implementation within teams.

Differences Between CIS Controls v8 and v7

The transition from CIS Controls v7 to v8 saw a reduction in the total number of Controls. Specifically, v8 features 18 Controls, a decrease from the previous version’s 20, as some were effectively merged:

• Control 4, previously “Control of Admin Privileges,” combined with Control 14 into the new “Access Control Management.”
• Control 5 and Control 11 merged into “Secure Configuration of Enterprise Assets and Software.”
• Control repositioning, such as moving “Data Protection” from Control 13 to Control 3.

This streamlined version not only makes the framework easier to follow but also aligns it more closely with other cybersecurity initiatives, such as the NIST Cybersecurity Framework (CSF).

CIS Controls List Overview

The following breakdown outlines the current 18 CIS Controls, each designed to tackle specific aspects of cybersecurity:

Control 1: Inventory and Control of Enterprise Assets

This Control emphasizes the importance of maintaining a comprehensive inventory of all organizational assets, including hardware and software. Through effective asset management, organizations can better protect their infrastructure and reduce the attack surface.

Control 2: Inventory and Control of Software Assets

Organizations must catalog all software assets to defend against attacks that often exploit vulnerabilities in outdated or unpatched systems. Implementing regular updates and tracking unauthorized software is essential for maintaining a secure environment.

Control 3: Data Protection

This Control focuses on data lifecycle management, stressing the importance of understanding what data is collected, how it is accessed, when it should be deleted, and why it requires protection. Complying with data privacy regulations, such as the GDPR, is also central to this Control.

Control 4: Secure Configuration of Enterprise Assets and Software

CIS Control 4 spotlights the need for securely configuring all assets in line with organizational policies, encompassing hardware and software configurations. This often involves implementing security measures such as firewalls and encryption.

Control 5: Account Management

Control 5 emphasizes managing user accounts to prevent unauthorized access. Maintaining a clear inventory of accounts and privileges, particularly for administrator-level access, is critical for reducing vulnerability to attacks.

Control 6: Access Control Management

Access Control Management includes establishing access rules based on the principle of least privilege, ensuring that users have only the necessary access required for their roles. Implementing multi-factor authentication is also a recommended best practice.

Control 7: Continuous Vulnerability Management

Organizations must proactively identify and address vulnerabilities through a continuous management program. Regular assessments and timely remediation of discovered vulnerabilities are essential components of effective cybersecurity.

Control 8: Audit Log Management

This Control outlines best practices for collecting, managing, and analyzing audit logs to support compliance and incident response actions. Regular log reviews are critical for early identification of potential security incidents.

Control 9: Email and Web Browser Protections

Given that email and web browsers are common entry points for attacks, Control 9 recommends implementing measures such as blocking risky file types and utilizing protected servers to safeguard organizational data.

Control 10: Malware Defenses

Focus on implementing defenses against malware includes automating scans and using updated security tools. Basic measures like disabling unnecessary functionalities on removable media remain effective strategies for preventing malware infections.

Control 11: Data Recovery

CIS Control 11 stresses the importance of creating a robust data recovery plan, ensuring that organizations can quickly restore data after incidents involving loss or corruption. Regular testing of backup systems is a recommended practice.

Control 12: Network Infrastructure Management

Control 12 outlines strategies for securing network infrastructure, recognizing its potential vulnerability. It encourages practices such as centralizing authentication and utilizing Virtual Private Networks (VPNs) for remote access.

Control 13: Network Monitoring and Defense

This Control advocates for comprehensive monitoring of network traffic to identify potential threats. Utilizing intrusion detection systems and alerting mechanisms is crucial for timely response to security incidents.

Control 14: Security Awareness and Skills Training

This human-centric Control emphasizes the need for organizations to develop and maintain security awareness programs to educate employees about threats and best practices for protecting organizational data.

Control 15: Service Provider Management

Focusing on third-party relationships, Control 15 highlights the necessity of securely managing service providers to mitigate risks introduced to the organization’s network. This includes due diligence, ongoing assessments, and contract compliance checks.

Control 16: Application Software Security

Application software can harbor vulnerabilities, making it crucial to establish practices that secure application development and deployment. Reviewing and testing software code for security flaws ensures that applications meet security standards before deployment.

Control 17: Incident Response Management

Control 17 underscores the importance of preparedness for responding to incidents when they arise. Organizations should have an incident response plan that includes defined roles and responsibilities, ensuring that personnel know how to act during a crisis.

Control 18: Penetration Testing

The final Control emphasizes proactive risk assessment through penetration testing. Regular testing helps identify weak spots and drives improvements in security posture, ensuring that vulnerabilities are addressed before being exploited by attackers.

Conclusion

The CIS Critical Security Controls offer a structured approach to cybersecurity that organizations can adopt to defend against sophisticated threats. By leveraging these established guidelines, businesses can protect their digital infrastructure and sensitive data, cultivating a culture of security awareness and risk management.

To learn more about implementing comprehensive cybersecurity strategies, including service provider management as part of your overall security governance, explore the CR-T Site.