CIS Critical Security Controls v8.1, explained

CIS Critical Security Controls v8.1 is the current version of the Center for Internet Security's prioritized cyber-defense checklist, made up of 18 Controls broken down into 153 Safeguards. CIS describes the Controls as "a prescriptive, prioritized, and simplified set of best practices" for defending against common attacks. Version 8.1 is an iterative refresh of Version 8 — CIS's own blog states it was released in June 2024, three years after Version 8's May 2021 release — and it deliberately kept the same 18 Controls and 153 Safeguards rather than renumbering or re-scoping them.

What actually changed in v8.1

CIS frames the v8.1 update around three design principles, quoted directly from its own page: "Context" ("enhances the scope and practical applicability of Safeguards by incorporating specific examples and additional explanations"), "Coexistence" ("aligns with other major security frameworks to the extent practical while preserving the unique features of the CIS Controls"), and "Consistency" ("maintains continuity for existing CIS Controls users, ensuring little to no change due to this update"). In concrete terms, CIS's own change list for v8.1 is:

• Added "the 'Govern' security function introduced in the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0"
• "Realigned NIST CSF security function mappings to match NIST CSF 2.0"
• "Included new and expanded glossary definitions for reserved words"
• "Revised Asset Classes, alongside new mappings to Safeguards"
• Fixed "minor typos in Safeguard descriptions"
• Added "clarification to a few anemic Safeguard descriptions"

None of this touched the count or numbering of Safeguards — an organization already working from v8 does not need to re-map its program to adopt v8.1.

The 18 Controls

Per CIS's own published list, the 18 Controls are:

#	Control
1	Inventory and Control of Enterprise Assets
2	Inventory and Control of Software Assets
3	Data Protection
4	Secure Configuration of Enterprise Assets and Software
5	Account Management
6	Access Control Management
7	Continuous Vulnerability Management
8	Audit Log Management
9	Email and Web Browser Protections
10	Malware Defenses
11	Data Recovery
12	Network Infrastructure Management
13	Network Monitoring and Defense
14	Security Awareness and Skills Training
15	Service Provider Management
16	Application Software Security
17	Incident Response Management
18	Penetration Testing

Each Control is an objective; the work itself lives in its individually numbered Safeguards (e.g., Safeguard 1.1, 1.2, …), 153 of which exist across all 18 Controls, per CIS's Implementation Groups page.

Implementation Groups: a cumulative, not alternative, structure

The most operationally important part of the Controls is not the 18-item list but the Implementation Groups (IGs) — a cumulative way to decide which Safeguards to adopt first. CIS's own IG pages state the structure directly:

Group	Safeguards	CIS's description
IG1	56 (the full set)	"The on-ramp to the CIS Controls," a "foundational set of 56 cyber defense Safeguards," aimed at an enterprise "typically small to medium-sized with limited IT and cybersecurity expertise"
IG2	+74 → 130 total	"Comprised [of] 74 additional Safeguards" that "builds upon the 56 Safeguards identified in IG1," for an enterprise with staff "responsible for managing and protecting IT infrastructure" across multiple departments
IG3	+23 → 153 total	"Comprised of an additional 23 Safeguards," building on IG1 and IG2 "totaling the 153 Safeguards in CIS Controls v8 and v8.1," for an enterprise with dedicated security specialists facing "targeted attacks from a sophisticated adversary"

Because the groups are cumulative, every IG1 Safeguard is also in IG2 and IG3 — there is no scenario where an organization implements IG2 without having also implemented IG1's 56 Safeguards. An auditor or customer asking "are you IG1?" is asking whether all 56 IG1-tagged Safeguards, spread across all 18 Controls, are in place — not just the first few Controls on the list.

Where this sits next to other frameworks

v8.1's main structural change was aligning its internal "security functions" to the six Functions of NIST CSF 2.0 (see our NIST CSF 2.0 guide) — adding a Govern function and realigning the others — which CIS calls "Coexistence": aligning "with other major security frameworks to the extent practical while preserving the unique features of the CIS Controls." That is a mapping exercise, not a merger: CIS Controls remain a flat list of 18 prescriptive Controls and 153 Safeguards, not CSF's six Functions/22 Categories/Subcategories taxonomy. Organizations already building toward CSF 2.0, ISO/IEC 27001, or sector rules like IEC 62443 (see our IEC 62443-2-1 guide) can use CIS Controls as the concrete "what to actually configure" layer underneath those higher-level outcome or requirement statements — but each framework's own text, not a third-party crosswalk, should be the final word on whether a specific Safeguard satisfies a specific regulatory requirement.

A workable starting point

1. Start at IG1, regardless of size. CIS positions IG1's 56 Safeguards as what every enterprise should have, not just small ones — confirm the full 56 across all 18 Controls before claiming IG1 status, since they are spread unevenly (some Controls have several IG1 Safeguards, others none).
2. Treat IGs as a roadmap, not a scorecard choice. Moving from IG1 to IG2 means implementing 74 additional Safeguards on top of the 56 already in place, not picking a different 130.
3. Use the v8.1 Govern-function and CSF realignment as a bridge, not a substitute, if your organization is also tracking NIST CSF 2.0 — the Safeguard-level detail in CIS Controls is what turns a CSF outcome statement into something an engineer can actually implement and audit.
4. Re-verify Safeguard-to-IG mappings against CIS's own Controls Navigator before building compliance tooling, since third-party summaries (including this guide's own tables) can drift from the authoritative source as CIS issues future minor updates.

SoftWSP's device and firmware security work can help an engineering team work out which CIS Safeguards are realistic to implement first for a connected product or OT environment, rather than treating all 153 as equally urgent: see device & firmware security services.

This guide summarises public CIS publications; it does not constitute legal or compliance advice. Confirm current Safeguard text and IG assignments against CIS's own Controls Navigator and downloadable workbook before using them in an audit or contract.