CIS Controls Implementation Group 1, or IG1, is the starting checklist for a first year plan. CIS says every enterprise should start with IG1, which it defines as essential cyber hygiene. Use it as the backbone of quarters one and two, and look at IG2 once IG1 is largely in place.
What the groups are
CIS Controls v8 and v8.1 contain 153 Safeguards in total. They are divided into three Implementation Groups, based on an enterprise's risk profile and available resources. IG1 is the foundational set meant to guard against the most common attacks. IG2 builds on IG1, and IG3 comprises all the Controls and Safeguards.
For a software company of 20 to 200 engineers, IG1 is a sensible fit. It is written for organizations that cannot dedicate large teams to security. Your later growth, regulated customers or sensitive data may push you toward IG2 sooner.
How to use IG1 without drowning
- Download the Controls and filter to IG1. Ignore the rest for now.
- Mark each Safeguard as done, partly done, not done, or not applicable, with a one line note on what evidence exists.
- Sort the not done items by how much of your product and customer data they affect.
- Slot them into quarters. Inventory and access items go first because many later items depend on them.
- Re-mark at the end of each quarter and keep the history.
The note column matters. "Done" with no evidence is the pattern that falls apart in customer reviews.
A suggested placement
| Quarter | Typical IG1 themes |
|---|---|
| 1 | Inventory of enterprise assets and software, account management, access control basics |
| 2 | Vulnerability management routine, secure configuration, data protection basics |
| 3 | Incident response preparation, service provider management, awareness |
| 4 | Review, logging and monitoring basics, plan for IG2 gaps |
This is a planning aid, not a statement of what CIS requires per quarter. Reorder to match your risks.
What IG1 does not cover well
CIS Controls are general across technology. A software producer has extra concerns: build pipeline integrity, dependency risk, and secure development practices. Pair IG1 with a development framework such as NIST SSDF or OWASP SAMM for those. See the post on CIS Controls as a map for startup questionnaires for how the Controls help answer buyers.
Do not call it a certification
Aligning with IG1 is a way to organize work. Describe it that way: "we use CIS IG1 as our baseline and here is our status." Avoid wording that suggests an external seal.
Try it yourself
This demo shows control mapping across frameworks. Click through and look at how a single piece of evidence can support several controls, which is how IG1 work helps with later frameworks.
Click through it at your own pace, or open it full screen.
Safeguard's asset discovery, SBOM and dependency scanning, and compliance and evidence automation cover several IG1 themes for the software side. The free scan is a fast way to begin.
Quick check
How many Safeguards are in IG1?
Check the current CIS document for the count. CIS reports 153 Safeguards across all of v8 and v8.1, with IG1 as a subset.
Can IG1 replace a development framework?
No. IG1 covers general hygiene. Use a development framework for build and code practices.
Sources
Last reviewed: 19 October 2026.
