Start with CIS Controls v8.1 Implementation Group 1: the 56 safeguards CIS calls essential cyber hygiene

CIS defines Implementation Group 1 of CIS Controls v8 and v8.1 as essential cyber hygiene: 56 safeguards every enterprise should apply against the most common attacks, aimed at small and medium-sized organizations with limited IT and security expertise. Version 8.1 adds the Govern function from NIST CSF 2.0 and revises asset classes and definitions.

Source facts

CIS’s Implementation Group 1 page says CIS Controls v8 and v8.1 define IG1 as essential cyber hygiene and an emerging minimum standard of information security for all enterprises, consisting of a foundational set of 56 cyber defense safeguards that every enterprise should apply to defend against the most common attacks. It describes a typical IG1 enterprise as small to medium-sized with limited IT and cybersecurity expertise and limited tolerance for downtime, and says IG1 safeguards should be implementable with limited expertise and aimed at general, non-targeted attacks.

The CIS Controls v8.1 page says v8.1 is an iterative update to v8 that updates alignment with evolving standards and frameworks, revises asset classes and safeguard descriptions, and adds the Govern security function introduced in NIST CSF 2.0. It lists realigned CSF 2.0 mappings, new glossary definitions and clarified safeguard descriptions, and says the download includes PDF and Excel versions, a change log and the Implementation Groups.

Applicability

Use this for organizations that need a practical starting baseline. Implementation Groups 2 and 3 add safeguards for more complex environments, and contracts, insurers or regulations may require a different framework.

DSE recommendation

DSE recommends using CIS Controls v8.1 Implementation Group 1 as the baseline checklist for small organizations, and tracking each of its 56 safeguards to an owner and evidence. Begin with asset and software inventory, secure configuration, account management, data recovery and patching, review progress quarterly, and map the results to any framework a customer, insurer or regulator requires.

Verification

Score each IG1 safeguard as implemented, partial or missing with supporting evidence, have someone outside the IT team review a sample, and repeat the assessment yearly.

Official references

Center for Internet Security — CIS Critical Security Controls Implementation Group 1. Center for Internet Security — CIS Critical Security Controls Version 8.1. Reviewed October 19, 2026.