What is it?
The CIS Critical Security Controls (formerly the SANS Top 20) are a prioritised set of 18 controls and 153 safeguards that real-world data shows mitigate the most common attacks. Unlike a regulatory framework, CIS isn't certified — it's a technical baseline that many organisations adopt to satisfy "industry best practice" clauses in contracts and the "reasonable security" standard cited by state laws and the FTC.
Who should adopt it?
Almost everyone. CIS organises safeguards into three Implementation Groups:
- IG1 — essential cyber hygiene; ~56 safeguards. Small businesses with limited IT resources.
- IG2 — mid-market with sensitive data; ~74 additional safeguards.
- IG3 — full coverage including advanced persistent-threat resistance.
How it maps to other frameworks
CIS publishes mappings to NIST CSF, ISO/IEC 27001:2022, PCI DSS, and HIPAA. In iCompaas, evidence collected against a CIS safeguard usually pre-fills the corresponding ISO/NIST control automatically — you don't double-prove the same fact.
What an audit (or self-attestation) looks like
CIS has no central certifying body. Most organisations either (a) self-attest via the CIS Controls Self-Assessment Tool, or (b) commission a third-party gap assessment. Tooling matters: CIS-CAT Pro and iCompaas continuous-scan results both count as evidence of implementation.
The high-leverage controls
If you implement nothing else, prioritise Control 1 — Inventory of Enterprise Assets, Control 5 — Account Management, Control 6 — Access Control Management, Control 7 — Continuous Vulnerability Management, and Control 11 — Data Recovery. They cover the entry, escalation and impact stages of the vast majority of breaches.
How iCompaas helps
Every CIS safeguard with a technical check (≈ 80% of the catalogue) is continuously evaluated against your AWS / Azure / GCP / Workspace / GitHub estate. The remaining policy-and-process safeguards are tracked with attestation tasks, owners and review cadences in the Policies module.