# CIS Critical Security Controls v8.1 — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_cis-cis-critical-security-controls-v81-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_62000112673_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

CIS Critical Security Controls v8.1 · 153 safeguards across 18 controls

### What is it?

The **CIS Critical Security Controls** (formerly the SANS Top 20) are a prioritised set of **18 controls** and **153 safeguards** that real-world data shows mitigate the most common attacks. Unlike a regulatory framework, CIS isn't certified — it's a _technical baseline_ that many organisations adopt to satisfy "industry best practice" clauses in contracts and the "reasonable security" standard cited by state laws and the FTC.

### Who should adopt it?

Almost everyone. CIS organises safeguards into three **Implementation Groups**:

-   **IG1** — essential cyber hygiene; ~56 safeguards. Small businesses with limited IT resources.
-   **IG2** — mid-market with sensitive data; ~74 additional safeguards.
-   **IG3** — full coverage including advanced persistent-threat resistance.

### How it maps to other frameworks

CIS publishes mappings to NIST CSF, ISO/IEC 27001:2022, PCI DSS, and HIPAA. In iCompaas, evidence collected against a CIS safeguard usually pre-fills the corresponding ISO/NIST control automatically — you don't double-prove the same fact.

### What an audit (or self-attestation) looks like

CIS has no central certifying body. Most organisations either (a) **self-attest** via the CIS Controls Self-Assessment Tool, or (b) commission a third-party gap assessment. Tooling matters: CIS-CAT Pro and iCompaas continuous-scan results both count as evidence of implementation.

### The high-leverage controls

If you implement nothing else, prioritise **Control 1 — Inventory of Enterprise Assets**, **Control 5 — Account Management**, **Control 6 — Access Control Management**, **Control 7 — Continuous Vulnerability Management**, and **Control 11 — Data Recovery**. They cover the entry, escalation and impact stages of the vast majority of breaches.

### How iCompaas helps

Every CIS safeguard with a technical check (≈ 80% of the catalogue) is continuously evaluated against your AWS / Azure / GCP / Workspace / GitHub estate. The remaining policy-and-process safeguards are tracked with attestation tasks, owners and review cadences in the Policies module.

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.