CIS 18 Compliance Software | CIS Controls v8 IG1, IG2, IG3

Frequently Asked Questions About CIS 18

What are the CIS 18 Controls, and who are they designed for?

The CIS Controls (formerly known as the SANS Top 20) are a prioritised set of 18 security control families developed by the Center for Internet Security (CIS). They are designed to help organisations of all sizes defend against the most common and damaging cyber attacks. Unlike regulatory frameworks, the CIS Controls are not a legal requirement — they are a practitioner-developed, evidence-based framework built around what actually works in stopping real-world threats. They are widely used as a baseline for cyber hygiene and are referenced by regulators, cyber insurers, and enterprise procurement teams alike.

What is the difference between CIS v7 and CIS v8?

CIS v8, released in 2021, is a significant restructuring of the previous v7 framework. The number of controls was reduced from 20 to 18, and the total number of safeguards was consolidated from 171 to 153. More importantly, v8 introduced the concept of Implementation Groups (IG1, IG2, IG3) to replace the previous Basic, Foundational, and Organisational tiers, making it easier to prioritise implementation based on organisational size and risk profile. CIS v8 also reflects the shift to cloud, mobile, and remote work environments more explicitly than v7. Organisations still working from v7 should plan a migration to v8, as it better reflects the current threat landscape.

What are the three Implementation Groups (IG1, IG2, IG3), and which one applies to us?

Implementation Groups divide the 153 CIS safeguards into three tiers based on an organisation's resources, risk exposure, and sensitivity of data. IG1 covers 56 safeguards representing Essential Cyber Hygiene — the minimum standard every organisation should meet to defend against common, non-targeted attacks. IG2 adds a further set of safeguards for organisations with more sensitive data or operational complexity, while IG3 covers the full set of 153 safeguards for organisations facing sophisticated, targeted attacks. Most mid-market organisations begin with IG1 and progressively implement IG2 as their security programme matures. NorthGRC filters and organises safeguards by Implementation Group, so you always know exactly which tier you are targeting and what remains.

How do the 18 CIS Control families relate to each other?

The 18 control families are grouped into three broad categories that follow a logical security progression. The first controls (1–6) focus on basic inventory and configuration: knowing what assets you have, managing software, protecting data, and controlling administrative privileges. Controls 7–16 address more operational security capabilities, including email and web browser defences, malware defences, network infrastructure, audit log management, penetration testing, and application software security. Controls 17–18 cover incident response management and security awareness training. Together they form a layered defence — you cannot effectively manage what you have not first inventoried, which is why Controls 1 and 2 are always the starting point.

How does CIS 18 relate to ISO 27001 and NIS2?

CIS 18 and ISO 27001 are highly complementary. ISO 27001 provides the management system framework and governance structure, while CIS 18 provides the specific, technical safeguards that make the ISMS operational. Many of the CIS safeguards map directly to ISO 27001 Annex A controls, meaning organisations that implement CIS 18 often find significant portions of their ISO 27001 evidence is already in place. Similarly, NIS2 requires organisations to adopt appropriate and proportionate security measures — the CIS Controls, particularly IG2 and IG3, are widely accepted as evidence of meeting that standard. NorthGRC's cross-mapping engine automatically maps your CIS 18 safeguard evidence to the corresponding ISO 27001 and NIS2 requirements, eliminating duplicate documentation work.

How does NorthGRC support CIS 18 implementation?

NorthGRC structures the entire CIS 18 implementation into a task-driven workbench. Every safeguard is pre-loaded, categorised by Implementation Group, and assigned to the relevant control family. The platform gives you a real-time view of your maturity level across all 18 control families, clearly showing which safeguards are implemented, in progress, or outstanding. Expert-validated templates for policies, procedures, and evidence documentation are included from day one, so you can move from a blank compliance register to a defensible implementation without starting from scratch.

Can we start with IG1 and expand to IG2 and IG3 over time within NorthGRC?

Yes — and this is the recommended approach. NorthGRC is built around a progressive implementation model. You begin by activating IG1 and focusing on the 56 Essential Cyber Hygiene safeguards, which immediately gives you a structured view of your current baseline. As your programme matures, you can toggle on IG2 and IG3 tasks directly in the platform without losing any previous work or evidence. Your compliance status, risk register, and cross-framework mappings all carry forward automatically, so expanding your scope is additive rather than disruptive.

Master the CIS Critical Security Controls with Tactical Precision

The "153 Safeguard" Stalling Point

A Prioritised Path to Maturity

Structured ISMS operations

From statements to ongoing compliance

ISO 27001 certified in just 4 months

Simplifying NIS2 compliance without distracting from core business

1/1

The Tactical Workbench

1. The "Map-Once, Comply-Many"

2. Managed Implementation Groups (IG1, IG2, IG3)

3. Threat-Based Risk Assessment for CIS

Key Features for CIS 18 Compliance

Asset Management

Compliance Management

Risk Management

Planning & Tasks

Vendor Management

Incident Management

Dashboard

Proven Security. Expert Guidance.