<img src="https://ws.zoominfo.com/pixel/4CagHYMZMRWAjWFEK36G" width="1" height="1" style="display: none;">
Request Demo

What are the CIS implementation Groups

down-arrow

The Center for Internet Security (CIS) is one of the forerunners in developing guidelines for protecting people, organizations, and governments from cyber threats in our continually evolving digital landscape. Operating as a nonprofit organization, CIS is responsible for creating the CIS controls, globally recognized as best practices for securing IT systems and sensitive data (including mobile devices, laptops, workstations, and servers). Additionally, CIS is home to the Multi-State Information Sharing and Analysis Center, a cyber threat prevention resource for US State, Local, Tribal, and Territorial government entities. It also manages and supports the Elections Infrastructure Information Sharing and Analysis Center, responsible for supporting US election offices’ cybersecurity initiatives.

The CIS Controls operate as a gold standard framework for individuals, corporations, and governments alike, and is comprised of 20 Critical Security Controls. Much like the NIST Cybersecurity Framework, CIS critical security controls function based on risk assessment best practices and contain guidelines to provide the proper maintenance, monitoring, and analysis required to secure an organization. Having its roots in risk management, using CIS controls is scalable for any sized organization, through utilizing the level. Meanwhile, the CIS Risk Assessment process (CIS RAM) and implementation groups assess what controls need to be implemented.

The CIS Controls Implementation Groups (IG) fall into three categories based on appropriate cybersecurity attributes. IGs have their respective subset of controls, estimated to be executed reasonably and affordably. Each IG is more complex than its predecessor and scales based on an organization’s size, type, and function. All of these IGs require the analysis of audit logs to prove compliance and secure configurations of hardware.

CIS Implementation Group 1

An organization that operates in a small to medium capacity with limited IT and cybersecurity knowledge fits this group. The primary focus of organizations in this implementation group is to maintain operation. Controls within this group should be executable with limited cybersecurity expertise and should protect against non-targeted attacks. Additionally, controls in this IG work in conjunction with small or home office hardware and software.

CIS Implementation Group 2

Organizations that fit into the IG2 category are responsible for having dedicated cybersecurity teams for protecting information security and IT systems. Typically, these companies operate on a medium-scale scale and store sensitive data to clients and the organization. Additionally, they contain multiple departments with varying levels of risk profiles. One primary concern in this IG is the loss of public confidence if a breach happens. While they can often withstand short interruptions of service, IG2 helps security teams cope with a higher operational complexity level.

CIS Implementation Group 3

This IG is the most complex to implement and requires cybersecurity experts that specialize in different areas. Systems and data that belong to IG3 are subject to oversight. For this, an organization will need to log the availability of its services and the confidentiality and integrity of data stored. This is important because attacks on these types of organizations can lead to significant harm to public welfare. Sub controls in IG3 must show their data recovery capabilities and malware defenses to prove that targeted attacks can be abated in the event of a zero-day attack.

Using IGs in conjunction with CIS’s free Risk Assessment Tool (CIS RAM) can help your organization know what controls you need to be compliant with on a granular level. No two organizations’ paths to compliance will be the same, and maintaining a good risk profile takes a continuous effort. Utilizing an integrated risk management solution like CyberStong can help assist with your cybersecurity team’s compliance efforts. By using patented AI and our advanced Natural Language Processing (NLP) methodology, you can not only prove compliance with a gold standard framework like CIS but many others, including the NIST CSF, ISO, and many more. If you have any further questions about CIS or CIS critical controls, give us a call at 1-800 NIST CSF or click here to learn more.

You may also like

What's New in NIST SP 800 53 Rev 5
on November 27, 2020

NIST Special Publication (SP) 800-53 offers regulatory guidelines and controls for federal information systems except those relating to national security. This catalog of security ...

NIST SP 800-53 Explained
on November 24, 2020

Has anyone ever been the victim of a data breach? I have, and it’s not a pleasant experience. For some, it’s as simple as getting a new credit or debit card, but for others, it ...

How Healthcare IT Teams Can Unify ...
on November 19, 2020

The Health Insurance Portability and Accountability Act (HIPAA) seeks to ensure that patients’ data, protected health information (PHI), is reasonably protected from both a ...

How the Convergence of IT and OT ...
on November 17, 2020

The oil and gas industry has transformed through the adoption of many new technologies. Information Technology (IT), Operational Technology (OT), and Internet of Things (IoT) ...

Three Ways Tracking NIST 800 53 in ...
on November 12, 2020

The new NIST 800-53 revision five has over one thousand controls. Let that sink in - over one thousand individual controls. Of course, as the sophistication of cyber-attacks has ...

How IRM is Accelerating Digital ...
on November 9, 2020

The way the insurance industry has operated has changed dramatically in recent years. With the rise of insurtech startups and digitalization using emerging technologies to bridge ...