A prioritised, prescriptive set of safeguards. No certificate at the end, which is exactly why it is a good place to start before committing to one.
What are the CIS Controls?
The CIS Critical Security Controls are a prioritised set of safeguards published by the Center for Internet Security. Version 8.1, released in June 2024, contains 18 controls broken into 153 safeguards, each specific enough to act on rather than interpret.
The distinctive part is the Implementation Groups. IG1 is 56 safeguards described as essential cyber hygiene, aimed at organisations with limited resources, and defends against the most common attack patterns. IG2 adds a further 74 for organisations with more complex environments and regulated data. IG3 covers the rest, for large or high-risk organisations. You self-assess which group fits, then work through it.
There is no CIS certification and nobody will accept a CIS report in place of ISO 27001 or SOC 2. What it gives you is a defensible order of work. Teams that need to improve their posture before committing to a certification, or that need to answer a questionnaire honestly this quarter, get further with IG1 than with a gap analysis against a standard they are not ready for.
Compliance requirements
Eighteen controls, 153 safeguards, three implementation groups. The group you pick decides the scope.
Inventory and control of enterprise assets, software assets and data. Controls 1 to 3, and the ones every later safeguard depends on.
Secure configuration of assets and software, and account management. The safeguards that close the openings created by defaults.
Access control management and continuous vulnerability management, covering privilege, multi-factor authentication and patching cadence.
Audit log management, plus email, web browser and malware defences. Detection is worthless if the logs were never collected.
Data recovery, network infrastructure management, and network monitoring and defence.
Security awareness training, service provider management, application software security, incident response management and penetration testing.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We work out whether IG1, IG2 or IG3 is the right target for your risk profile and resources. Aiming too high is the usual way this stalls.
We assess you against every safeguard in the chosen group and score each one honestly, including the ones only partly in place.
Your compliance manager sequences the gaps by defensive value rather than by control number, so the earliest work removes the most risk.
We work alongside your team to close the safeguards, with evidence captured as you go rather than reconstructed later.
We re-score against the group and produce a posture report you can put in front of a board or a customer.
Where you want one, we map the work already done onto ISO 27001 or SOC 2, so the CIS programme becomes the first half of a certification rather than a detour.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone