CIS Controls v8.1

The prioritized safeguard set, useful as a starting programme when a formal certification is not the goal.

What CIS Controls v8.1 is

The CIS Controls, published by the Center for Internet Security, are a prioritised set of safeguards ordered by how much risk they remove per unit of effort. Version 8 reorganised them around activities rather than device ownership — which is what made them usable in a world of cloud, remote work and BYOD — and grouped them into eighteen controls, from enterprise asset inventory through to penetration testing.

Their distinguishing feature is Implementation Groups. IG1 is the subset CIS considers essential cyber hygiene for a small organisation with limited expertise; IG2 and IG3 layer on for organisations with more complexity and more to lose. That gives a defensible answer to "where do we start" that no certification framework provides, because certification frameworks are all-or-nothing by design.

CIS is not certifiable and is not a regulatory requirement anywhere. It is what you run when you need to become materially more secure this quarter, and it is a common precursor to a 27001 or SOC 2 programme rather than a substitute for one.

Who it applies to

• Organisations with no immediate certification driver that want a defensible plan rather than a list of tool purchases.
• Small and mid-sized teams, for whom IG1 is a realistic scope and a full ISMS is not.
• Security leaders who need to sequence work and justify the order to a board.
• Organisations preparing for a certification later, using CIS to build the underlying controls first.

How it is structured in CMDash

CMDash seeds the individual v8 safeguards — the numbered items beneath each of the eighteen controls — because the safeguard is the level at which work is assigned and evidence exists.

Scope: The 153 safeguard identifiers and their 18 groups are v8.1; the v8.1 security-function mapping and Implementation Group positioning ship as a separate maturity pack.

The control text

What CMDash does for CIS Controls v8.1

• Every safeguard tracked separately with its own evidence requirement, owner and status.
• A seeded crosswalk to NIST CSF, so CIS work reports upward in the same language as everything else.
• A CIS Controls v8.1 Implementation Group maturity pack ships alongside the safeguards, so IG1/IG2/IG3 positioning is tracked in the product rather than in a side document.
• The safeguard set is where integration data is most directly useful — asset and software inventory, vulnerability management, audit log management and account management are all safeguard groups that connected tools report on continuously.

What it shares with your other frameworks

CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.

Where the evidence comes from

CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to CIS Controls v8.1’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.

All 47 integrations →

Where CMDash stops

Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.

• CIS licenses the Controls content under its own terms. CMDash ships safeguard identifiers, titles and its own evidence guidance rather than reproducing the CIS documentation.
• There is no certification. Some assessors will accept a CIS self-assessment as supporting evidence; none will accept it as a certificate.
• Implementation Group membership per safeguard is handled by the separate maturity pack rather than as a property of each seeded control row.

Common questions

Also in Security Programs

Paid plans cap how many frameworks you run at once, never which ones — CIS Controls v8.1 is available on every paid plan.