CIS Controls v8 implementation means working through 18 Controls and 153 Safeguards split across three Implementation Groups — IG1, IG2, and IG3 — starting with IG1's 56 safeguards for baseline cyber hygiene before scaling up. There's no certification body for CIS Controls v8 itself, but the framework underpins NCSC guidance and shows up in cyber insurance questionnaires and vendor security reviews across the UK in 2026.
Why this matters
No UK regulator mandates CIS Controls v8 by name, but auditors, insurers, and enterprise procurement teams increasingly reference it as the control set behind frameworks they do mandate.
If you've already worked through the NCSC 10 Steps to Cyber Security, CIS Controls v8 gives you a more granular safeguard list to check your existing controls against — not a separate programme to run in parallel.
Getting the Implementation Group wrong is the most common mistake in 2026: businesses jump to IG2 or IG3 before IG1 is solid, and end up with gaps in the basics while chasing advanced safeguards.
How to implement CIS Controls v8 for UK businesses
Work through these steps in order — skipping ahead is how gaps get missed.
- Pick your Implementation Group. Small businesses with limited IT staff start at IG1. Firms handling sensitive client data or facing regulatory scrutiny move to IG2 or IG3.
- Inventory assets and data. Controls 1 and 3 require a documented list of every device, application, and dataset before anything else can be scored.
- Map existing tools against the safeguard list. Most businesses already meet 20-30 IG1 safeguards through firewalls, MFA, and basic patching — the gap analysis tells you what's missing.
- Close priority gaps first. Identity and access management, patch management, and logging safeguards carry the most risk when left open.
- Assign an owner to each safeguard. Safeguards without a named owner don't get maintained past month one.
- Automate evidence collection. Screenshots and spreadsheets don't scale past IG1 — automated evidence capture keeps the audit trail current without manual chasing.
- Reassess annually. Your Implementation Group and safeguard count should shift as headcount, data sensitivity, and vendor relationships change.
CIS Controls v8 Implementation Groups compared
| Implementation Group | Safeguards | Best for |
|---|---|---|
| IG1 | 56 | Small businesses, limited IT staff, low regulatory exposure — start here |
| IG2 | 130 total (74 added) | Mid-market firms handling sensitive or regulated data |
| IG3 | 153 total (23 added) | High-value targets, regulated sectors, mature security teams |
IG1: 56 safeguards for essential cyber hygiene
IG1 is the floor, not the ceiling. It covers asset inventory, basic access control, malware defences, and email/browser protections — the safeguards every business should have regardless of size.
Best for: businesses under roughly 50 employees with no dedicated security team. Verdict: implement IG1 first, always.
IG2: 130 safeguards for growing risk exposure
IG2 layers on data protection, network monitoring, and incident response safeguards. It suits firms that store customer PII, process payments, or sell into regulated industries where a breach carries reputational and contractual fallout.
Best for: mid-sized firms with an internal IT function or an outsourced MSP. Verdict: move to IG2 once IG1 is fully closed out, not before.
IG3: 153 safeguards for high-value and regulated targets
IG3 adds application security testing, advanced logging, and penetration testing safeguards aimed at organisations that are frequent attack targets — financial services, critical infrastructure, and large enterprises.
Best for: regulated financial services firms, critical infrastructure operators, and enterprises with dedicated security teams. Verdict: only pursue IG3 if your risk profile genuinely calls for it — most SMEs never need the full 153.
Firms already working through Annex A control mapping for ISO 27001 will recognise most IG2 and IG3 safeguards — the overlap is deliberate and worth exploiting rather than duplicating.
Automate your CIS Controls evidence trail
One evidence library, mapped across CIS, ISO 27001, and Cyber Essentials.
Why the safeguard count varies
Not every business needs the full 153. The right count depends on:
- Company size and IT headcount — a 10-person firm can't realistically staff 153 safeguards.
- Data sensitivity — health, financial, or biometric data pushes firms toward IG2/IG3 regardless of headcount.
- Regulatory overlap — firms already meeting DORA, NHS DSPT, or FCA requirements often sit closer to IG2 by default.
- Existing tooling maturity — cloud-native firms with modern identity and logging tools clear IG1 and IG2 faster.
- Cyber insurance requirements — some insurers now reference CIS safeguard tiers when setting premiums.
- Vendor and procurement pressure — enterprise customers increasingly ask suppliers which Implementation Group they meet.
Is CIS Controls v8 the same as Cyber Essentials?
No — Cyber Essentials is a UK government-backed certification scheme with five technical control areas, while CIS Controls v8 is a voluntary framework with 18 Controls and 153 Safeguards. Cyber Essentials maps roughly to a subset of IG1; businesses aiming for both should implement CIS Controls v8's IG1 first, since it covers Cyber Essentials requirements and more.
Does CIS Controls v8 map to ISO 27001?
Yes — CIS publishes a formal mapping between its 18 Controls and ISO 27001 Annex A, so safeguard evidence gathered for CIS Controls v8 largely satisfies Annex A control requirements too. This is the main reason to run CIS Controls v8 alongside an ISO 27001 programme rather than as a standalone exercise.
How long does IG1 implementation take?
IG1 implementation time depends on how many of the 56 safeguards a business already meets through existing tools like MFA, firewalls, and patch management. Firms starting from close to zero should expect a longer rollout than firms that already run basic security hygiene and just need to document and close remaining gaps.
Frequently asked questions
One last thing
Most UK businesses that fail their first CIS Controls v8 self-assessment don't fail on advanced safeguards — they fail on Control 1 and Control 3, asset and data inventory, because nobody kept the list current after the first pass in 2026. Build the inventory review into a quarterly calendar reminder before you touch anything else on the safeguard list.