CIS Controls v8.1 Implementation — Implementation Groups 1 to 3
The CIS Controls are a prioritised list of security safeguards that stop the most common attacks. Implementation Group 1 is essential cyber hygiene for every organisation; IG2 and IG3 add depth for organisations with more risk and resources.
They are an ideal practical baseline when you need measurable progress fast — especially for SMEs and for organisations preparing for ISO 27001, NIST CSF or Cyber Essentials.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- Center for Internet Security (CIS)
- Current Version
- CIS Controls v8.1 — 18 controls grouped into Implementation Groups IG1–IG3
- Who It's For
- Any organisation wanting a prioritised, measurable security baseline; insurers and customers increasingly ask for IG1 as a minimum.
Core Domains
A Practical Compliance Path
- 01
Baseline
Measure current implementation of IG1 safeguards.
- 02
Prioritise
Close IG1 gaps first, then IG2/IG3 based on risk.
- 03
Automate
Use tooling for inventory, configuration and vulnerability checks.
- 04
Measure
Track maturity over time and map to other frameworks.
Fast, measurable hygiene
CIS IG1 gives quick wins we can verify technically, then we map progress into the frameworks you need to certify against.
- IG1 assessment in weeks
- Configuration benchmarks
- Mapping to ISO 27001 and Cyber Essentials
Related Pages
From IG1 to IG3, mapped and measured
grComply loads all 18 CIS Controls with Implementation Groups and cross-maps them to ISO 27001, NIST CSF and Cyber Essentials, with vulnerability-management evidence from built-in scanning.
- Safeguards by Implementation Group
- Scanning evidence for Control 7
- Training evidence for Control 14
- Cross-mapping to ISO 27001 and NIST
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About CIS Controls
What are CIS Implementation Groups?
IG1, IG2 and IG3 group the safeguards by organisation size and risk. IG1 is the essential minimum for everyone; IG2 and IG3 build on it.
How many CIS Controls are there?
Version 8.1 has 18 controls, each made up of specific safeguards.
Can CIS Controls replace ISO 27001?
They are complementary. CIS provides a technical baseline; ISO 27001 provides a certifiable management system. Many organisations use CIS to implement ISO 27001 controls.
Ready to Start Your CIS Controls Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.