CIS Controls v8 and v8.1 contain 18 Controls, from inventory of enterprise assets through penetration testing. Read them as a sequence of questions: what do we have, how is it set up, who can reach it, how do we spot trouble, and how do we recover. This post groups them that way.
The full list
CIS publishes the 18 Controls in this order:
- Inventory and Control of Enterprise Assets
- Inventory and Control of Software Assets
- Data Protection
- Secure Configuration of Enterprise Assets and Software
- Account Management
- Access Control Management
- Continuous Vulnerability Management
- Audit Log Management
- Email and Web Browser Protections
- Malware Defenses
- Data Recovery
- Network Infrastructure Management
- Network Monitoring and Defense
- Security Awareness and Skills Training
- Service Provider Management
- Application Software Security
- Incident Response Management
- Penetration Testing
Group them by the question they answer
What do we have? Controls 1 and 2 cover hardware and software. Nothing else works without them, because you cannot protect what you have not listed.
How is it set up? Controls 3, 4 and 12 cover data, configuration and network infrastructure.
Who can reach it? Controls 5 and 6 cover accounts and access.
What is weak? Controls 7 and 16 cover vulnerabilities and application software. If you build software, 16 is where your pipeline checks live.
What blocks common attacks? Controls 9 and 10 cover email, browsers and malware.
How do we notice? Controls 8 and 13 cover logs and monitoring.
How do we cope? Controls 11 and 17 cover recovery and incident response.
Who else touches us? Control 15 covers service providers. Control 14 covers people. Control 18 tests the rest.
A sensible order for a small team
This order is our own suggestion, not a CIS ruling:
- Assets and software inventory (1, 2).
- Accounts, access and multi factor sign in (5, 6).
- Secure configuration and patching (4, 7).
- Backups you have restored once (11).
- Logging you can search (8).
- The rest, guided by your Implementation Group.
CIS says Implementation Groups are based on an enterprise's risk profile and resources, and that IG1 is essential cyber hygiene that every enterprise should start with. Our post on CIS Controls IG1 goes deeper.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a software inventory is assembled, which is the heart of Control 2.
Safeguard's SBOM and dependency scanning covers the software inventory part of this work for code you build. The free scan at https://gold.safeguard.sh/scan is a quick way to see what a repository contains.
Quick check
How many CIS Controls are there in v8?
Eighteen, from Inventory and Control of Enterprise Assets to Penetration Testing.
Which Control should come first?
Inventory of assets, then software. The other Controls depend on knowing what exists.
Sources
Last reviewed: 19 October 2026.
