When a client asks “what should we be doing for security?” they need a better answer than “it depends.” The CIS Controls are a prioritized set of 18 controls and 153 safeguards that tell organizations exactly what to protect and in what order. For MSPs delivering security services to SMBs, the framework is also practical enough to deploy across every client without reinventing the approach each time.
What makes CIS Controls different from enterprise-heavy frameworks is the Implementation Group structure. Your clients start with 56 essential safeguards and scale up as their risk profile and resources grow. That tiered approach maps directly to how you already think about service delivery. Match the engagement to the client’s maturity, then expand over time.
What Are CIS Controls v8?
CIS Controls are a prioritized set of cybersecurity best practices maintained by the Center for Internet Security. Originally developed in 2008 as the SANS Critical Security Controls, the framework has been refined over nearly two decades based on real-world attack data and input from practitioners across government, industry, and academia. The current version, v8.1 (released June 2024), contains 18 controls broken down into 153 safeguards, each specific and actionable enough to defend against the most common attack patterns observed in the field.
CIS Controls are voluntary, and that distinction matters for how you position this with clients. Organizations align with CIS Controls rather than certifying to them. This makes the framework a practical starting point for SMBs that need demonstrable security practices without the audit burden of formal certification programs. When a client’s industry eventually requires formal compliance, CIS alignment provides a documented foundation that maps to NIST CSF 2.0, ISO 27001, PCI DSS v4.0, CMMC 2.0, and SOC 2 through the CIS Controls Navigator. Several U.S. states now reference CIS Controls when defining what constitutes “reasonable” cybersecurity for government contractors and agencies.
That cross-framework mapping is where CIS Controls become especially valuable for your practice. A single assessment methodology can satisfy multiple client obligations, which means the work you do once scales across clients with different regulatory contexts. But the real operational question is where to start, and the answer is built into the framework itself.
Implementation Groups: Where Most Clients Should Start
Not every client needs all 153 safeguards. CIS Controls use Implementation Groups (IGs) to help organizations prioritize based on risk profile and available resources. The groups build cumulatively, so IG2 includes all of IG1, and IG3 includes everything.
Here’s how the groups break down:
| Group | Safeguards | Who It’s For |
|---|---|---|
| IG1 | 56 | All organizations, essential cyber hygiene |
| IG2 | IG1 + additional | Organizations with moderate cybersecurity programs |
| IG3 | All 153 | Regulated industries and high-risk environments |
IG1 is your baseline service tier
IG1 represents the 56 safeguards every organization should implement regardless of size or industry. These address the most common attack vectors with achievable controls:
- Maintaining inventory of devices and software
- Configuring systems securely
- Implementing multi-factor authentication (MFA) for all users
- Applying patches within defined timeframes
- Maintaining tested backups
- Basic logging and alerting
- Anti-malware protection
- Security awareness training
For your SMB clients, IG1 is the structured answer to “what should we be doing?” It eliminates the low-hanging fruit that attackers exploit most frequently, and it’s achievable without dedicated security staff on the client side. If you think about this in service delivery terms, IG1 is the baseline engagement you can standardize across your entire portfolio.
IG2 and IG3: when clients outgrow the baseline
IG2 adds safeguards for organizations with more complex environments, sensitive data, or regulatory obligations. Centralized logging with SIEM correlation, EDR coverage, network segmentation, formal incident response testing, privileged access management, and phishing simulations all live in IG2. Your clients typically move from IG1 to IG2 when they acquire sensitive data, face regulatory requirements, or expand to multi-cloud environments.
IG3 covers all 153 safeguards for organizations facing sophisticated threat actors or operating in heavily regulated industries. That includes threat intelligence integration, threat hunting, application allowlisting, DLP, and red team exercises. Most SMBs will never need IG3, and that’s the point. The Implementation Group structure prevents your clients from overinvesting in controls that exceed their actual risk profile.
From a practice-building perspective, these tiers give you a natural upsell path. A client starts at IG1. As their business grows or compliance requirements kick in, you expand the engagement to IG2. Each tier is more MRR for the same client relationship, and the progression is built into the framework rather than something you have to sell from scratch. The controls themselves, though, deserve a closer look, starting with the ones that drive ongoing operational work.
The 18 CIS Controls
The controls are numbered by priority, not alphabetically. Control 1 (asset inventory) comes first because you cannot secure what you do not know exists. Control 18 (penetration testing) comes last because it validates everything else.
| Control | Name | What It Covers |
|---|---|---|
| 1 | Inventory and Control of Enterprise Assets | Track all devices connected to infrastructure |
| 2 | Inventory and Control of Software Assets | Manage authorized software, detect unauthorized installations |
| 3 | Data Protection | Classify, handle, and dispose of data securely |
| 4 | Secure Configuration | Harden devices and software against misconfigurations |
| 5 | Account Management | Manage user and service account lifecycles |
| 6 | Access Control Management | Implement least privilege and MFA |
| 7 | Continuous Vulnerability Management | Assess and remediate vulnerabilities continuously |
| 8 | Audit Log Management | Collect, review, and retain logs for detection and investigation |
| 9 | Email and Web Browser Protections | Defend against phishing and web-based threats |
| 10 | Malware Defenses | Prevent and detect malicious software |
| 11 | Data Recovery | Maintain tested backup and recovery capabilities |
| 12 | Network Infrastructure Management | Secure and manage network devices |
| 13 | Network Monitoring and Defense | Monitor for and respond to network threats |
| 14 | Security Awareness and Skills Training | Train the workforce on security practices |
| 15 | Service Provider Management | Evaluate and monitor third-party security |
| 16 | Application Software Security | Secure in-house and acquired software |
| 17 | Incident Response Management | Develop and test incident response capabilities |
| 18 | Penetration Testing | Test security through simulated attacks |
Most of your SMB clients will not implement all 153 safeguards across 18 controls. They are starting with the 56 in IG1, and four of these controls deserve particular attention because they represent ongoing operational practices rather than one-time implementations.
Four Controls That Drive Recurring Engagements
Audit log management (Control 8)
Control 8 contains 12 safeguards focused on collecting, reviewing, and retaining logs for detection and investigation. For your clients, the work extends well beyond the initial setup. It requires defining what events to log (authentication, access changes, admin actions), determining retention periods based on regulatory and operational needs, establishing who reviews logs and how frequently, integrating with alerting systems to flag anomalies, and testing that logs are actually being captured and retained.
Organizations without dedicated security operations typically need outside help to make sense of log data. That dependency is what makes audit log management a natural fit for managed services and an ongoing engagement rather than a project.
Secure configuration (Control 4)
Default configurations are rarely secure. Out-of-the-box settings prioritize ease of use, not defense. Control 4 addresses this through hardened baseline configurations for each asset type, consistent application across the environment, detection and remediation of configuration drift, and documented exception management.
CIS Benchmarks (separate from CIS Controls) provide specific configuration recommendations for particular platforms. Controls tell your team what to do at a strategic level; Benchmarks tell your team how to configure specific systems. The ongoing challenge is configuration drift. Without continuous monitoring, systems gradually deviate from their hardened state as changes accumulate, which is why this becomes a recurring service rather than a one-time hardening project.
Access control management (Control 6)
Control 6 goes beyond “implement MFA” to address the full lifecycle of access credentials. That means creating accounts with appropriate initial permissions, reviewing and adjusting permissions as roles change, revoking access promptly when employment ends, managing privileged access separately from standard user access, and implementing MFA for all users rather than just administrators.
The principle of least privilege sounds straightforward but requires continuous attention. Permissions accumulate over time as employees change roles, creating excessive access that persists until someone audits it. For your clients, that audit is the service you provide.
Incident response management (Control 17)
Security incidents will happen. Control 17 addresses whether your client’s organization is prepared to respond effectively. That preparation includes documented policies and procedures for common incident types, defined roles and escalation paths, responder training, communication templates and protocols, and regular testing through tabletop exercises.
A plan that has not been tested is a plan that will not work under pressure. Regular exercises expose gaps in procedures and build team confidence before a real incident forces them to perform. Running those exercises is another engagement that reinforces your value as an ongoing security partner, and it connects directly to how you implement CIS Controls as a program rather than a project.
Implementing CIS Controls as an Ongoing Program
CIS Controls implementation is not a project with a completion date. It is a program that evolves as threats change, your client’s business grows, and their risk profile shifts.
Start with IG1 and prioritize within it. Every implementation should begin with the 56 IG1 safeguards. Prioritize based on current gaps. If your client has no asset inventory, start there. If backup and recovery has not been tested, that takes precedence over access management refinements. The gap analysis you run at the start of the engagement also gives your client a clear picture of where they stand and gives you the scope for everything that follows.
Assess continuously, not annually. Point-in-time assessments capture a snapshot that begins degrading immediately. Asset inventory changes, configurations drift from hardened baselines, vulnerabilities emerge, and people leave without access being revoked. Continuous assessment does not mean constant manual review. It means automated monitoring with human analysis of exceptions and trends.
Use CIS as a cross-framework foundation. Organizations pursuing multiple compliance requirements can implement CIS Controls once and demonstrate alignment across NIST CSF 2.0, ISO 27001:2022, PCI DSS v4.0, CMMC 2.0, and SOC 2. For your practice, this means a single assessment methodology that satisfies multiple client obligations without starting from scratch for each framework.
Document progress for triple-duty value. Track implementation status, responsible parties, evidence, gaps, and review dates for each control. This documentation demonstrates improvement to client stakeholders, guides resource allocation, and provides evidence of “reasonable” security practices during audits, insurance applications, and client security assessments.
For MSPs building security services at scale, platforms such as Cynomi map assessments and policies to CIS Controls v8.1, automate evidence collection, and track progress across the control set. Implementation Group alignment means you can match the right controls to each client’s maturity level and demonstrate measurable progress over time, turning security from an abstract conversation into a visible program with clear next steps.