Definition
CIS Controls
In one sentence
CIS Controls are a prioritized set of cybersecurity safeguards published by the Center for Internet Security that describe the most effective actions organizations can take to defend against common attacks.
NIST Cybersecurity FrameworkBaseline cyber security controlsAsset inventory
CIS Controls Explained
The current version, CIS Controls v8.1, contains 18 controls covering areas such as asset inventory, data protection, secure configuration, account and access management, vulnerability management, audit logs, email and browser protection, malware defences, data recovery, security awareness training, service provider management, incident response and penetration testing.
The safeguards are grouped into three Implementation Groups. Implementation Group 1 (IG1) is described as essential cyber hygiene, a set of 56 safeguards that every organization should implement, and it is designed with small and mid-sized organizations with limited IT and security expertise in mind. IG2 and IG3 add safeguards for organizations with greater complexity and risk.
For Canadian SMBs, IG1 is one of the most practical starting points available. It is specific enough to act on, free to download and maps to NIST CSF, ISO 27001 and other frameworks. Implementing IG1 well also covers much of what CyberSecure Canada and cyber insurers expect.
General information for Canadian organizations, not legal advice.