CIS Controls IG1 in practice: what each group of safeguards asks you to do

The short answer

CIS Controls Implementation Group 1 (IG1) is the set of 56 safeguards that the Center for Internet Security calls essential cyber hygiene: the minimum every organization should have in place. In CIS Controls v8 and v8.1, IG1 is aimed at small and midsize organizations with limited IT and security expertise, and it is designed to stop the common, non-targeted attacks that cause most small-business incidents, such as phishing, ransomware and stolen passwords.

The 56 safeguards fall under 15 of the 18 CIS Controls. In everyday terms they ask you to know your devices, software and data, configure things securely, manage accounts and MFA, patch, log, filter email and web traffic, stop malware, back up and protect the backups, train staff, track your vendors and know who handles incidents. Below is what each group means and the order we would tackle them.

Why IG1 is a good yardstick

CIS describes IG1 as an emerging minimum standard of information security for all enterprises. It is specific enough to check (each safeguard is a yes-or-no question), it can be implemented with off-the-shelf tools, and it maps to the NIST Cybersecurity Framework, cyber-insurance questionnaires and many client security questionnaires. Version 8.1 kept the same 56 IG1 safeguards, added the Govern function from NIST CSF 2.0, revised its asset classes and clarified definitions of terms such as plan, process and sensitive data.

IG2 and IG3 add safeguards for organizations with more sensitive data or dedicated security staff. Start with IG1 and do it fully before reaching further.

The IG1 safeguards by control, in plain terms

Know what you have (Controls 1, 2 and 3)

• Control 1, enterprise assets (2 safeguards): keep a list of every computer, phone, server and network device, and deal with unknown devices on your network.
• Control 2, software (3): keep a software list, make sure everything is still supported by its vendor and remove unauthorized software.
• Control 3, data protection (6): have a data management process, know where sensitive data is, restrict who can reach it, set retention, dispose of it securely and encrypt data on laptops and phones.

Configure securely (Controls 4 and 12)

• Control 4, secure configuration (7): a standard secure setup for devices and network gear, automatic screen locking, firewalls on servers and computers, secure management of devices and changing or disabling default accounts.
• Control 12, network infrastructure (1): keep routers, firewalls and switches up to date.

Control who gets in (Controls 5 and 6)

• Control 5, accounts (4): keep a list of accounts, use unique passwords, disable accounts unused for 45 days and use separate admin accounts for admin work.
• Control 6, access control (5): written processes to grant and revoke access, and MFA for internet-facing apps, remote network access and all admin access.

Keep things patched and watched (Controls 7 and 8)

• Control 7, vulnerability management (4): a process for finding and fixing vulnerabilities, plus automated patching for operating systems and applications.
• Control 8, audit logs (3): a log management process, logging turned on and enough storage to keep logs.

Block common attacks (Controls 9 and 10)

• Control 9, email and browsers (2): only supported browsers and email clients, and DNS filtering to block known bad sites.
• Control 10, malware defenses (3): anti-malware on every device, automatic signature updates and autorun disabled for USB drives.

Be able to recover (Control 11)

• Control 11, data recovery (4): a recovery process, automated backups, protected backup data and an isolated copy that ransomware cannot reach.

People, vendors and incidents (Controls 14, 15 and 17)

• Control 14, security awareness (8): a training program covering phishing and social engineering, passwords and MFA, data handling, accidental data exposure, reporting incidents, spotting missing updates and the risks of public Wi-Fi.
• Control 15, service providers (1): a list of your vendors and what they handle.
• Control 17, incident response (3): a named person to handle incidents, contact details for reporting and a process staff follow to report.

Want to know how many of the 56 you already meet? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, backups and business continuity as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

The order we would put them in

IG1 is meant to be done in full, but not all at once. For a 25 to 100 person business, this sequence gets the biggest risk reduction earliest.

1. Weeks 1 to 4: identity and recovery. MFA everywhere it is listed (6.3, 6.4, 6.5), dormant and leaver accounts disabled (5.3, 6.2), separate admin accounts (5.4), automated backups with an isolated copy and a test restore (11.2, 11.3, 11.4).
2. Months 2 to 3: patching and malware. Automated OS and application updates (7.3, 7.4), anti-malware with automatic updates (10.1, 10.2), DNS filtering (9.2), supported browsers only (9.1).
3. Months 3 to 4: inventories. Devices, software, accounts, data locations and vendors (1.1, 2.1, 5.1, 3.2, 15.1). Remove what should not be there.
4. Months 4 to 5: configuration. Encryption on laptops and phones (3.6), screen lock, firewalls, default accounts, network gear updates.
5. Month 6: people and process. Training program, incident contacts and reporting process, written processes for access, data retention and logging.

Then repeat yearly: re-check every safeguard, update inventories and test restores again.

Where small businesses usually get stuck

• Inventories (1.1, 2.1). Nobody has time to list devices by hand. Use the device management console in Microsoft 365 or Google Workspace, or your IT provider’s monitoring tool, which builds the list automatically.
• Separate admin accounts (5.4). Owners resist logging in twice. Explain that a phished everyday account should not be able to change company-wide settings.
• Isolated backups (11.4). A sync service such as OneDrive is not a backup. You need a copy attackers cannot delete with stolen credentials.
• Logs (8.2, 8.3). Some subscriptions keep sign-in logs for only a short period by default. Check retention before you need the logs.
• Written processes (3.1, 6.1, 7.1, 8.1, 11.1). Several IG1 safeguards ask for a documented process. One page each is enough.

How to track progress

Keep a simple spreadsheet with the 56 safeguard numbers, a status (done, partly, not started), evidence (a screenshot or report) and an owner. CIS offers free tools for members of its community, including a self-assessment tool, but a spreadsheet works fine at this size. Evidence matters: when an insurer or client asks whether you use MFA for remote access, you want to answer with a report, not a guess.

Much of IG1 is the routine work in our cybersecurity services and managed IT: MFA, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security and monitored backups with tested restores. Our guide to backup and disaster recovery covers Control 11 in more depth.

Keep reading

• HIPAA security risk assessment: how small practices do it (and where they fall short)
• HIPAA compliant email: what it takes with Microsoft 365, Google Workspace and Gmail
• NIST Cybersecurity Framework for small business: how to use CSF 2.0
• HIPAA IT requirements for small medical practices in 2026

Related services

• Cybersecurity services
• Managed IT services
• Free Technology Health Assessment