The Center for Internet Security (CIS) is one of the forerunners in developing guidelines for protecting people, organizations, and governments from cyber threats in our continually evolving digital landscape. Operating as a nonprofit organization, CIS is responsible for creating the CIS security controls, globally recognized as best practices for securing IT systems and sensitive data (including mobile devices, laptops, workstations, and servers). CIS is also home to the Multi-State Information Sharing and Analysis Center, a cyber threat prevention resource for US State, Local, Tribal, and Territorial government entities. It also manages and supports the Elections Infrastructure Information Sharing and Analysis Center (E-ISAC), which supports US election offices’ cybersecurity initiatives and security measures.
In response to the changing technology, work, and threat landscape, The Center for Internet Security (CIS) has launched CIS Controls v8. This update now has 18 key controls with 153 safeguards and addresses cloud and mobile technologies.
The CIS Controls operate as a gold standard framework for individuals, corporations, and governments alike and are comprised of 20 Critical Security Controls. Much like the NIST Cybersecurity Framework, CIS critical security controls function based on risk assessment best practices and contain guidelines to provide the proper maintenance, monitoring, and analysis required to secure an organization. Having its roots in risk management, the implementation of these controls is scalable for any sized organization, by utilizing the level. Meanwhile, the CIS Risk Assessment process (CIS RAM) and implementation groups assess what controls must be implemented.
The CIS Controls Implementation Groups (IG) fall into three categories based on appropriate cybersecurity attributes. IGs have their respective subset of controls, estimated to be executed reasonably and affordably. Each IG is more complex than its predecessor and scales based on an organization’s size, type, and function. All of these IGs require the analysis of audit logs to prove compliance and secure hardware configurations.
CIS Implementation Group 1
This group fits an organization that operates in a small to medium capacity with limited IT and cybersecurity knowledge. The primary focus of organizations in this implementation group is to maintain operation as a starting point. Controls within this group should be executable with limited cybersecurity expertise and protect against non-targeted attacks. Additionally, controls in this IG work in conjunction with small or home office hardware and software.
CIS Implementation Group 2
Organizations that fit into the IG2 category are responsible for having dedicated cybersecurity teams for protecting information security and IT systems. Typically, these companies operate on a medium-scale scale and store sensitive information regarding clients and the organization. Additionally, they contain multiple departments with varying levels of risk profiles. One primary concern in this IG is the loss of public confidence if a breach happens. While they can often withstand short service interruptions, IG2 helps security teams cope with a higher operational complexity level and further implementation of CIS controls.
CIS Implementation Group 3
This IG is the most complex to implement and requires cybersecurity experts that specialize in different areas. Systems and data that belong to IG3 are subject to oversight. For this, an organization will need to log the availability of its services and the confidentiality and integrity of data stored. This is important because attacks on these types of organizations can lead to significant harm to public welfare. Sub controls in IG3 must show their data recovery capabilities and malware defenses to prove that targeted attacks can be abated in the event of a zero-day attack.
Using IGs in conjunction with CIS’s free Risk Assessment Tool (CIS RAM) can help your organization know what controls you need to be compliant with on a granular level. No two organizations’ paths to compliance will be the same, and maintaining a good risk profile takes a continuous effort. Utilizing an integrated risk management solution like CyberStong can help assist with your cybersecurity team’s data protection and compliance efforts. By using patented AI and our advanced Natural Language Processing (NLP) methodology, you can not only prove compliance with a gold standard framework like CIS but many others, including the NIST CSF, ISO, and many more. If you have any further questions about CIS or CIS critical controls, give us a call at 1-800 NIST CSF or click here to learn more.
