<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

What are the CIS implementation Groups

down-arrow

The Center for Internet Security (CIS) is one of the forerunners in developing guidelines for protecting people, organizations, and governments from cyber threats in our continually evolving digital landscape. Operating as a nonprofit organization, CIS is responsible for creating the CIS controls, globally recognized as best practices for securing IT systems and sensitive data (including mobile devices, laptops, workstations, and servers). Additionally, CIS is home to the Multi-State Information Sharing and Analysis Center, a cyber threat prevention resource for US State, Local, Tribal, and Territorial government entities. It also manages and supports the Elections Infrastructure Information Sharing and Analysis Center, responsible for supporting US election offices’ cybersecurity initiatives.

The CIS Controls operate as a gold standard framework for individuals, corporations, and governments alike, and is comprised of 20 Critical Security Controls. Much like the NIST Cybersecurity Framework, CIS critical security controls function based on risk assessment best practices and contain guidelines to provide the proper maintenance, monitoring, and analysis required to secure an organization. Having its roots in risk management, using CIS controls is scalable for any sized organization, through utilizing the level. Meanwhile, the CIS Risk Assessment process (CIS RAM) and implementation groups assess what controls need to be implemented.

The CIS Controls Implementation Groups (IG) fall into three categories based on appropriate cybersecurity attributes. IGs have their respective subset of controls, estimated to be executed reasonably and affordably. Each IG is more complex than its predecessor and scales based on an organization’s size, type, and function. All of these IGs require the analysis of audit logs to prove compliance and secure configurations of hardware.

CIS Implementation Group 1

An organization that operates in a small to medium capacity with limited IT and cybersecurity knowledge fits this group. The primary focus of organizations in this implementation group is to maintain operation. Controls within this group should be executable with limited cybersecurity expertise and should protect against non-targeted attacks. Additionally, controls in this IG work in conjunction with small or home office hardware and software.

CIS Implementation Group 2

Organizations that fit into the IG2 category are responsible for having dedicated cybersecurity teams for protecting information security and IT systems. Typically, these companies operate on a medium-scale scale and store sensitive data to clients and the organization. Additionally, they contain multiple departments with varying levels of risk profiles. One primary concern in this IG is the loss of public confidence if a breach happens. While they can often withstand short interruptions of service, IG2 helps security teams cope with a higher operational complexity level.

CIS Implementation Group 3

This IG is the most complex to implement and requires cybersecurity experts that specialize in different areas. Systems and data that belong to IG3 are subject to oversight. For this, an organization will need to log the availability of its services and the confidentiality and integrity of data stored. This is important because attacks on these types of organizations can lead to significant harm to public welfare. Sub controls in IG3 must show their data recovery capabilities and malware defenses to prove that targeted attacks can be abated in the event of a zero-day attack.

Using IGs in conjunction with CIS’s free Risk Assessment Tool (CIS RAM) can help your organization know what controls you need to be compliant with on a granular level. No two organizations’ paths to compliance will be the same, and maintaining a good risk profile takes a continuous effort. Utilizing an integrated risk management solution like CyberStong can help assist with your cybersecurity team’s compliance efforts. By using patented AI and our advanced Natural Language Processing (NLP) methodology, you can not only prove compliance with a gold standard framework like CIS but many others, including the NIST CSF, ISO, and many more. If you have any further questions about CIS or CIS critical controls, give us a call at 1-800 NIST CSF or click here to learn more.

You may also like

New Gartner Report Identifies ...
on September 15, 2021

With a variety of risks growing out of the pandemic, cybersecurity control failures was listed as the top executive concern during Q1 2021. According to the Gartner Emerging Risks ...

Why IOT in the Commercial ...
on September 14, 2021

Every month there seems to be a new device that changes the way we travel, communicate, conduct business, and live our personal lives. The transformation promises efficiency and ...

Why the Chemical Sector is ...
on September 1, 2021

The chemical sector encompasses more than 70,000 diverse products that are critical to the modern global infrastructure. Several thousand chemical facilities ship, manufacture, ...

Kyndall Elliott
What Does the Future of Risk ...
on August 31, 2021

Cyber risk is the top concern for water and wastewater systems. With government intelligence confirming cyber attacks staged by Russia and Iran, utilities need strong risk ...

What Threatens Other Critical ...
on August 24, 2021

Everyone knows that one person that likes to say that they’re not addicted to their phone. In 2021, it’s difficult to find a way to socialize, work, access vital services, and be ...

Is the Energy Sector Paving the ...
on August 13, 2021

It’s difficult to imagine a day in which the products and services we use are not connected back to the energy sector. How we heat or cool our homes to how we remotely work are ...