The CIS Critical Security Controls are a prioritized set of actions maintained by the Center for Internet Security. They started life as the SANS Top 20, and version 8 consolidated them into 18 controls with a set of safeguards under each.
The reason to learn these first is the ordering. Most frameworks give you a list. This one gives you a sequence, and the sequence reflects what actually reduces risk per unit of effort.
Implementation Groups
Version 8 organizes safeguards into three implementation groups so the list scales to the organization.
IG1 is described as basic cyber hygiene, aimed at small organizations with limited expertise. It is a genuinely achievable set and it is the right target for most small businesses.
IG2 adds safeguards for organizations with dedicated security staff and more complex environments. IG3 is for organizations with specialist expertise facing sophisticated attackers.
The honest advice for most organizations is to finish IG1 properly before touching anything else. A completed IG1 beats a partially implemented IG3 every time.
Controls 1 to 6, Know What You Have
Control 1 is enterprise asset inventory. Control 2 is software inventory. These are first because every other control silently assumes them, and because a very large share of incidents involve something nobody was tracking.
Control 3 is data protection, meaning knowing what data you have, where it is, and how it is handled. Control 4 is secure configuration of assets and software, which is where the CIS Benchmarks come in.
Control 5 is account management and Control 6 is access control management. Together they are the identity foundation, and they map directly onto the identity work that zero trust depends on.
Controls 7 to 12, Keep It Healthy
Control 7 is continuous vulnerability management, covered in the vulnerability management guide. Control 8 is audit log management, which is the prerequisite for every detection and every investigation.
Control 9 covers email and web browser protections. Control 10 is malware defenses. Control 11 is data recovery, which is the control that decides whether a ransomware incident is a bad week or an existential event. Control 12 is network infrastructure management.
The theme through this group is that these are ongoing programs with owners, not projects with end dates.
Controls 13 to 18, Watch, Train, and Test
Control 13 is network monitoring and defense, which is the SOC. Control 14 is security awareness and skills training. Control 15 is service provider management, meaning third party risk.
Control 16 is application software security. Control 17 is incident response management. Control 18 is penetration testing.
Control 18 being last is deliberate and frequently ignored. Paying for a penetration test before you have asset inventory, patching, and logging produces a report telling you things you could have worked out for free.
CIS Benchmarks Are a Different Thing
The Controls say what to do. The CIS Benchmarks are detailed hardening configurations for specific technologies: Windows, various Linux distributions, cloud providers, Kubernetes, databases, and browsers.
They are free to download and extremely detailed, and they are the practical implementation of Control 4. The usual approach is to adopt a benchmark as a baseline, document deviations with reasons, and scan for drift.
Do not apply one blindly to production. Some settings break applications, which is why the documented deviation process matters more than the score.
Mapping to Everything Else
CIS publishes mappings from the Controls to NIST CSF, ISO 27001, PCI DSS, HIPAA, and others. That is the practical answer to running one control set internally while answering many external questionnaires.
It also means you can do the work once. Implement the Controls, then map the evidence to whatever standard a customer asks about. See compliance frameworks.
How to Actually Start
Download the Controls from cisecurity.org, they are free. Assess yourself honestly against IG1, which usually takes a week and usually produces an uncomfortable picture.
Fix inventory first, both assets and software. It is boring, it is the foundation, and nearly every organization discovers things they did not know they had.
Then work down the list in order, with an owner and a date for each safeguard. Re-assess quarterly and track the trend rather than the absolute number.
Learn This at HackRange
Week 4 of the mentorship works through all 18 controls and then asks you to map your own audit findings from Week 3 onto them.