Security · Framework
CIS Controls v8.1, the prioritised security controls
A prioritised list of security controls, starting with essential cyber hygiene.
- Type
- Framework
- Group
- Security
- We help with
- Cybersecurity and VAPT
- Issued by
- No certificate issued
What it is.
The CIS Critical Security Controls v8.1 are 18 prioritised controls for defending against common attacks. Implementation Groups IG1 to IG3 help organisations decide what to do first; IG1 is described as essential cyber hygiene.
Who usually needs it
- Small and mid-sized organisations wanting practical priorities
- IT teams hardening systems
- Organisations that need a concrete baseline
Related founder credential
CompTIA Security+HeldWhat it covers.
- 01
18 controls
From asset inventory and secure configuration to incident response.
- 02
Implementation Groups
IG1, IG2 and IG3 scale the safeguards to the organisation's risk and resources.
- 03
IG1 first
IG1 is described as essential cyber hygiene, a sensible starting point.
How we help with CIS Controls v8.1
For most small and mid-sized businesses we start with Implementation Group 1, the 56 safeguards CIS calls essential cyber hygiene: asset inventory, secure configuration, MFA, patching, backups and awareness. We assess each safeguard, fix the gaps hands-on in your Microsoft 365, endpoints and network, and move to IG2 when your risk calls for it.
Typical phases.
Each phase ends with something you keep. Timelines depend on scope and are agreed in the proposal.
- 1
Assess
- IG1 gap list
- 2
Harden
- Baseline configurations
- 3
Implement
- Inventory, patching, MFA, backups
- 4
Maintain
- Periodic review
Version 8.1 has 18 controls.
Implementation Group 1, described as essential cyber hygiene: the safeguards every organisation should have.
The CIS Controls are a framework, not a certification. They are used as a practical baseline.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal
This page is general guidance, not legal advice. Last reviewed October 2026.