CIS Controls v8.1, published in 2024, is an iterative update to v8 that adds a Govern function to line up with NIST CSF 2.0. The part that matters most for a small company has not changed: Implementation Group 1, or IG1, which the Center for Internet Security calls essential cyber hygiene and "an emerging minimum standard of information security for all enterprises".
What's affected
CIS says IG1 consists of a foundational set of 56 safeguards, and that these are what every enterprise should apply to defend against the most common attacks. They are meant to be implementable with limited cybersecurity expertise and aimed at general, non-targeted attacks. CIS describes the typical IG1 organization as small to medium sized, with limited IT and security staff, and holding data that is mostly employee and financial information.
A SaaS company holding customer data may need more than IG1 eventually. But IG1 is a defensible baseline to answer "which framework do you follow?"
What to do now
- Download CIS Controls v8.1 from CIS, which includes the Excel version and the Implementation Groups.
- Filter the spreadsheet to IG1. You will have 56 rows.
- Add three columns: status (done, partly, not done), evidence link, owner.
- Start with the safeguards that most questionnaires touch: asset and software inventory, MFA on admin and remote access, automated backups, patching, audit logs, security awareness training and an incident contact list.
- Score yourself as a count: for example, 38 of 56 done. State the count, the date, and the plan for the rest.
- Re-run it every six months.
How to avoid this trap
Do not say "we are CIS compliant". CIS Controls are a set of recommended practices, not a certification. Say "we assess ourselves against CIS Controls v8.1 IG1, and as of this date we meet X of 56 safeguards".
Also avoid marking a safeguard done without evidence. "Backups are automated" needs a job name and a restore test date.
Quick check
How many safeguards are in IG1?
56, according to CIS.
