<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

What are the CIS implementation Groups

down-arrow

The Center for Internet Security (CIS) is one of the forerunners in developing guidelines for protecting people, organizations, and governments from cyber threats in our continually evolving digital landscape. Operating as a nonprofit organization, CIS is responsible for creating the CIS controls, globally recognized as best practices for securing IT systems and sensitive data (including mobile devices, laptops, workstations, and servers). Additionally, CIS is home to the Multi-State Information Sharing and Analysis Center, a cyber threat prevention resource for US State, Local, Tribal, and Territorial government entities. It also manages and supports the Elections Infrastructure Information Sharing and Analysis Center, responsible for supporting US election offices’ cybersecurity initiatives.

The CIS Controls operate as a gold standard framework for individuals, corporations, and governments alike, and is comprised of 20 Critical Security Controls. Much like the NIST Cybersecurity Framework, CIS critical security controls function based on risk assessment best practices and contain guidelines to provide the proper maintenance, monitoring, and analysis required to secure an organization. Having its roots in risk management, using CIS controls is scalable for any sized organization, through utilizing the level. Meanwhile, the CIS Risk Assessment process (CIS RAM) and implementation groups assess what controls need to be implemented.

The CIS Controls Implementation Groups (IG) fall into three categories based on appropriate cybersecurity attributes. IGs have their respective subset of controls, estimated to be executed reasonably and affordably. Each IG is more complex than its predecessor and scales based on an organization’s size, type, and function. All of these IGs require the analysis of audit logs to prove compliance and secure configurations of hardware.

CIS Implementation Group 1

An organization that operates in a small to medium capacity with limited IT and cybersecurity knowledge fits this group. The primary focus of organizations in this implementation group is to maintain operation. Controls within this group should be executable with limited cybersecurity expertise and should protect against non-targeted attacks. Additionally, controls in this IG work in conjunction with small or home office hardware and software.

CIS Implementation Group 2

Organizations that fit into the IG2 category are responsible for having dedicated cybersecurity teams for protecting information security and IT systems. Typically, these companies operate on a medium-scale scale and store sensitive data to clients and the organization. Additionally, they contain multiple departments with varying levels of risk profiles. One primary concern in this IG is the loss of public confidence if a breach happens. While they can often withstand short interruptions of service, IG2 helps security teams cope with a higher operational complexity level.

CIS Implementation Group 3

This IG is the most complex to implement and requires cybersecurity experts that specialize in different areas. Systems and data that belong to IG3 are subject to oversight. For this, an organization will need to log the availability of its services and the confidentiality and integrity of data stored. This is important because attacks on these types of organizations can lead to significant harm to public welfare. Sub controls in IG3 must show their data recovery capabilities and malware defenses to prove that targeted attacks can be abated in the event of a zero-day attack.

Using IGs in conjunction with CIS’s free Risk Assessment Tool (CIS RAM) can help your organization know what controls you need to be compliant with on a granular level. No two organizations’ paths to compliance will be the same, and maintaining a good risk profile takes a continuous effort. Utilizing an integrated risk management solution like CyberStong can help assist with your cybersecurity team’s compliance efforts. By using patented AI and our advanced Natural Language Processing (NLP) methodology, you can not only prove compliance with a gold standard framework like CIS but many others, including the NIST CSF, ISO, and many more. If you have any further questions about CIS or CIS critical controls, give us a call at 1-800 NIST CSF or click here to learn more.

You may also like

Top Business Stakeholder ...
on May 13, 2021

It can often feel like a cultural divide exists between security teams and the rest of the company. COVID-19 disrupted every day-to-day services for many enterprises, overloading ...

Kyndall Elliott
The Top 4 Risks of Cloud Computing ...
on May 12, 2021

The global pace at which technology is evolving and accelerating is incredible. People and companies are becoming less concerned with having “physical” assets or solutions. Tom ...

Kyndall Elliott
Going Beyond Cloud Security ...
on May 7, 2021

Modern businesses have been migrating to the cloud in droves throughout the pandemic. It was a necessity in order to secure remote work during COVID-19, but as cloud service ...

Kyndall Elliott
5 Steps to Take When Maturing Your ...
on May 5, 2021

According to the Council for Strategic and International Studies, an estimated $600 billion is lost to cyber criminals each year. In a study done by Juniper, it’s estimated that ...

Kyndall Elliott
How Advanced Automation and New ...
on April 29, 2021

As industries try to play catch-up as COVID-19 pushed everyone to remote work, technical debt is more of an issue than ever before. Technical debt is a term that describes the ...

Kyndall Elliott
Why the Shift to Remote Work is ...
on April 27, 2021

Remote work has become the new normal globally. COVID-19 has presented a lot of challenges, but enterprises were shown that a remote workplace was not only feasible but ...

Kyndall Elliott