CIS Controls
A prioritised set of cybersecurity safeguards published by the Center for Internet Security.
Overview
The CIS Controls group defensive actions into prioritised implementation groups, making them practical for organisations with limited resources.
As an industry standard it binds through regulation that cites it, contracts that require it or audits that test it. The authorities most closely connected to it are CIS. It is often read together with NIST CSF.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
They are a pragmatic baseline many regulators and insurers recognise.
Who it affects
Organisations building or benchmarking a security programme.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to CIS Controls. Select one to open it.
What to do about it
- 1Decide whether it applies through regulation, contract, audit or certification.
- 2Run a gap assessment against your current controls.
- 3Crosswalk it to the regulations and contracts that reference it.
- 4Collect evidence continuously for the audit period.
From requirement to evidence.
CIS Controls are crosswalked with NIST CSF and ISO 27001.
Request early access →