CIS Controls v8.1: what changed from v8 and what to do about it

CIS Controls v8.1 is an iterative update to v8, not a rewrite. CIS added the Govern security function from NIST CSF 2.0, a glossary of reserved words, revised asset classes with new Safeguard mappings, small wording fixes, and CSF mappings realigned to CSF 2.0. If you already work from v8, your control list stays recognisable.

What CIS says changed

CIS describes the release as an iterative update. Its own summary names these changes:

• The Govern function from NIST CSF 2.0 is now part of the Controls.
• New and expanded definitions for reserved words used throughout, such as plan, process and sensitive data.
• Asset classes revised, with new mappings to Safeguards.
• Minor typos fixed and a few unclear Safeguard descriptions clarified.
• NIST CSF function mappings realigned to CSF 2.0.

The CIS page we read does not state a release date or a Safeguard count for v8.1. It does say the Implementation Groups page gives a total of 153 Safeguards for both v8 and v8.1, which suggests the set itself is stable.

Why the glossary matters more than it sounds

Auditors and customers ask whether you have a "documented process" or an "established plan". Before, each reader chose a meaning. A glossary pins the words down. If your policies use those terms, read the new definitions and check that your documents say what you mean.

What to change in your own work

A short checklist for a team already using v8:

1. Note which version your spreadsheet or tool cites. Label it v8 or v8.1, not just "CIS Controls".
2. If you map CIS to NIST CSF, refresh the mapping so it points at CSF 2.0 functions, including Govern.
3. Re-read your asset inventory categories against the revised asset classes.
4. Scan your policy wording for the reserved words and compare it with the glossary.
5. Keep your Implementation Group choice. Nothing in the CIS summary suggests the groups changed.

What does not need to change

You do not need to restart an assessment. The 18 Controls remain the working structure, and the CIS summary describes the Safeguard edits as clarifications. A gap analysis done against v8 is still a good starting point. Record the version it used and note differences as you touch each control.

For the full list of controls, see our plain language walkthrough of the 18 CIS Controls.

Try it yourself

Click through it at your own pace, or open it full screen. Look at how one control maps to several frameworks, which is the same exercise as refreshing a CIS to CSF mapping.

Safeguard's compliance and evidence automation can hold a mapped control set and the evidence behind each item. Check which frameworks are enabled in your workspace before relying on any particular mapping.

Quick check

Sources

• CIS Controls v8.1
• CIS Controls Implementation Groups

Last reviewed: 19 October 2026.