Implementation Group 1, or IG1, is the entry level of the CIS Critical Security Controls. CIS describes it as essential cyber hygiene, the foundational safeguards that guard against the most common attacks. CIS says every enterprise, whatever its size, should start with IG1.
What an implementation group is
The CIS Controls contain 153 safeguards across versions 8 and 8.1. Not every organization can do all of them. CIS sorts them into three implementation groups so that organizations can match effort to risk and resources.
IG1 is the first group. Think of it as the floor: the things a small organization with limited staff and limited tolerance for downtime should do before anything else.
Why small organizations like it
Most security frameworks assume a security team. IG1 does not. It reads as a list of practical jobs: know your devices and software, control who has admin access, keep systems updated, back up data, filter email, train people, and plan for incidents.
That makes it a good backbone for a school IT coordinator or a nonprofit operations manager. You do not need to learn a new vocabulary to start.
How to use it without getting lost
Do not try to read all 153 safeguards. Work in this order:
- Inventory devices and software. Even a spreadsheet counts.
- Inventory accounts, and remove ones you do not recognize.
- Set secure defaults: updates on, unneeded services off, admin rights limited.
- Protect data: backups, encryption on laptops, retention rules.
- Train staff and volunteers on phishing and reporting.
- Write a short response plan and test it once.
Mark each item as done, partly done or not started. That sheet is your first honest gap list.
What IG1 does not give you
It is not a certification. A mark on a checklist does not mean you are safe, and no auditor signs off on it by default. It is a way to organize effort and explain it to a board, an insurer or a funder.
If a funder or grant requires a specific framework, follow that requirement. IG1 can still be the practical starting point underneath it.
Where to check the details
CIS publishes the full control set and the per group lists. The count of safeguards in IG1 appears in a graphic on the CIS page, so read it there rather than relying on a number quoted in a blog post, including this one.
Safeguard can help with the software side of the inventory step, through SBOM and dependency scanning, and with compliance and evidence automation if you later need to prove work to an auditor.
Quick check
Is IG1 only for tiny organizations?
No. CIS says every enterprise should start with IG1. Larger organizations then add groups two and three.
Sources
Last reviewed: 19 October 2026.
