The Center for Internet Security (CIS) is one of the forerunners in developing guidelines for protecting people, organizations, and governments from cyber threats in our continually evolving digital landscape. Operating as a nonprofit organization, CIS is responsible for creating the CIS controls, globally recognized as best practices for securing IT systems and sensitive data (including mobile devices, laptops, workstations, and servers). Additionally, CIS is home to the Multi-State Information Sharing and Analysis Center, a cyber threat prevention resource for US State, Local, Tribal, and Territorial government entities. It also manages and supports the Elections Infrastructure Information Sharing and Analysis Center, responsible for supporting US election offices’ cybersecurity initiatives.
The CIS Controls operate as a gold standard framework for individuals, corporations, and governments alike, and is comprised of 20 Critical Security Controls. Much like the NIST Cybersecurity Framework, CIS critical security controls function based on risk assessment best practices and contain guidelines to provide the proper maintenance, monitoring, and analysis required to secure an organization. Having its roots in risk management, using CIS controls is scalable for any sized organization, through utilizing the level. Meanwhile, the CIS Risk Assessment process (CIS RAM) and implementation groups assess what controls need to be implemented.
The CIS Controls Implementation Groups (IG) fall into three categories based on appropriate cybersecurity attributes. IGs have their respective subset of controls, estimated to be executed reasonably and affordably. Each IG is more complex than its predecessor and scales based on an organization’s size, type, and function. All of these IGs require the analysis of audit logs to prove compliance and secure configurations of hardware.
CIS Implementation Group 1
An organization that operates in a small to medium capacity with limited IT and cybersecurity knowledge fits this group. The primary focus of organizations in this implementation group is to maintain operation. Controls within this group should be executable with limited cybersecurity expertise and should protect against non-targeted attacks. Additionally, controls in this IG work in conjunction with small or home office hardware and software.
CIS Implementation Group 2
Organizations that fit into the IG2 category are responsible for having dedicated cybersecurity teams for protecting information security and IT systems. Typically, these companies operate on a medium-scale scale and store sensitive data to clients and the organization. Additionally, they contain multiple departments with varying levels of risk profiles. One primary concern in this IG is the loss of public confidence if a breach happens. While they can often withstand short interruptions of service, IG2 helps security teams cope with a higher operational complexity level.
CIS Implementation Group 3
This IG is the most complex to implement and requires cybersecurity experts that specialize in different areas. Systems and data that belong to IG3 are subject to oversight. For this, an organization will need to log the availability of its services and the confidentiality and integrity of data stored. This is important because attacks on these types of organizations can lead to significant harm to public welfare. Sub controls in IG3 must show their data recovery capabilities and malware defenses to prove that targeted attacks can be abated in the event of a zero-day attack.
Using IGs in conjunction with CIS’s free Risk Assessment Tool (CIS RAM) can help your organization know what controls you need to be compliant with on a granular level. No two organizations’ paths to compliance will be the same, and maintaining a good risk profile takes a continuous effort. Utilizing an integrated risk management solution like CyberStong can help assist with your cybersecurity team’s compliance efforts. By using patented AI and our advanced Natural Language Processing (NLP) methodology, you can not only prove compliance with a gold standard framework like CIS but many others, including the NIST CSF, ISO, and many more. If you have any further questions about CIS or CIS critical controls, give us a call at 1-800 NIST CSF or click here to learn more.