Overview
The CIS Critical Security Controls are a prioritized, prescriptive set of 18 controls (v8) distilled from real-world attack data to stop the most prevalent threats.
Purpose
Give teams an actionable, ordered starting point — "do these first" — that is more concrete than outcome-based frameworks.
Architecture
Controls are grouped into Implementation Groups (IG1–IG3) so organizations adopt a subset scaled to their risk and resources; IG1 is defined as essential cyber hygiene.
Core Concepts
- Safeguards — the individual, measurable actions within each control.
- Implementation Groups — tiered adoption based on organizational maturity and risk.
Cloud Mapping
Controls 5 & 6 (Account and Access Control Management) map to AWS IAM, Azure RBAC + Entra ID, and Kubernetes RBAC; Control 8 (Audit Log Management) maps to native cloud logging services.
References
See the primary source below.