Put CIS IG1 essential cyber hygiene in place and prove it
CIS IG1 is Implementation Group 1 of the CIS Critical Security Controls v8.1: a foundational set of 56 Safeguards that the Center for Internet Security defines as essential cyber hygiene. It is the on-ramp to the CIS Controls, built to be implementable with limited cyber security expertise and to stop common, non-targeted attacks. Implementation Groups 2 and 3 build on it with further Safeguards.
Is CIS IG1 right for your organisation?
IG1 suits small and medium-sized organisations with limited IT and security resources, and CIS presents it as an emerging minimum standard of information security for every enterprise. It is voluntary, but organisations often adopt it to set a defensible baseline, answer customer security questionnaires, or prepare for a broader framework such as ISO 27001 or SOC 2.
Adopting it is voluntary, though customers and auditors often expect it.
- Issued by
- Center for Internet Security (CIS)
- Latest version
- CIS Controls v8.1, published June 2024
- Size
- 56 Safeguards, out of 153 in the full CIS Controls
- Status
- Voluntary best-practice framework
- Applies to
- Organisations of any size, especially those with limited security resources
- Next steps
- Implementation Groups 2 and 3 add further Safeguards on top of IG1
- Assessment route
- Self-assessment or third-party assessment; there is no formal CIS certification
- Type
- Framework (voluntary)
- Region
- Global
- In OneClickComply
- Supported today
OneClickComply makes it simple
OneClickComply maps each IG1 Safeguard to controls tested against your connected cloud, identity and device tools, so evidence for inventories, MFA, patching, backups and anti-malware is collected automatically and monitored for drift. AutoComplete generates the policies and processes IG1 asks you to establish and maintain, and OneClickFix corrects supported misconfigurations in one click. Because controls are mapped across frameworks, the same evidence also counts towards ISO 27001, SOC 2 and other standards.
Requirements covered
56 Safeguards drawn from 15 of the 18 CIS Controls, spanning asset and software inventory, data protection, secure configuration, account and access control, vulnerability management, audit logs, email and browser protection, malware defences, data recovery, network infrastructure, awareness training, service providers and incident response.
Manual CIS IG1 vs. OneClickComply
- Asset, software and account inventories built in spreadsheets and out of date within weeks
- Checking MFA, patch levels and anti-malware device by device across several admin consoles
- Writing process documents for data management, configuration and incident handling from scratch
- Screenshots gathered by hand whenever a customer or assessor asks for proof
- No warning when a setting drifts out of line with a Safeguard
- Inventories kept current automatically from your cloud, identity and device integrations
- MFA, patching and anti-malware status checked continuously in one place
- Policies and processes generated from your real environment with AutoComplete
- Evidence collected automatically and ready to share with customers or assessors
- Alerts when controls drift, with OneClickFix for supported issues
Everything you need for CIS IG1
All 56 IG1 Safeguards mapped to automated controls
Live asset, software and account inventories from your connected tools
Continuous checks for MFA, patching, anti-malware and backups
OneClickFix for supported misconfigurations, logged as evidence
AutoComplete policies for data management, secure configuration and incident handling
Evidence reused across ISO 27001, SOC 2 and other mapped frameworks
Three steps to CIS IG1 compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against CIS IG1 and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates CIS IG1-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
CIS Controls v8.1 Implementation Group 1 (IG1) requirements
All 56 IG1 Safeguards in CIS Controls v8.1, numbered by their parent CIS Control (official titles use US spelling).
| Reference | Requirement |
|---|---|
| 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory |
| 1.2 | Address Unauthorized Assets |
| 2.1 | Establish and Maintain a Software Inventory |
| 2.2 | Ensure Authorized Software is Currently Supported |
| 2.3 | Address Unauthorized Software |
| 3.1 | Establish and Maintain a Data Management Process |
| 3.2 | Establish and Maintain a Data Inventory |
| 3.3 | Configure Data Access Control Lists |
| 3.4 | Enforce Data Retention |
| 3.5 | Securely Dispose of Data |
| 3.6 | Encrypt Data on End-User Devices |
| 4.1 | Establish and Maintain a Secure Configuration Process |
| 4.2 | Establish and Maintain a Secure Configuration Process for Network Infrastructure |
| 4.3 | Configure Automatic Session Locking on Enterprise Assets |
| 4.4 | Implement and Manage a Firewall on Servers |
| 4.5 | Implement and Manage a Firewall on End-User Devices |
| 4.6 | Securely Manage Enterprise Assets and Software |
| 4.7 | Manage Default Accounts on Enterprise Assets and Software |
| 5.1 | Establish and Maintain an Inventory of Accounts |
| 5.2 | Use Unique Passwords |
Always check the official CIS IG1 text for the exact wording.
CIS IG1 FAQs
What is CIS IG1?
CIS IG1 is Implementation Group 1 of the CIS Critical Security Controls, a set of 56 Safeguards that the Center for Internet Security defines as essential cyber hygiene. It is the starting point of the CIS Controls, designed for organisations with limited security expertise, and focuses on defending against common, non-targeted attacks through basics such as inventories, secure configuration, MFA, patching, backups and training.
How many Safeguards are in CIS Controls v8.1 IG1?
IG1 contains 56 Safeguards. They are drawn from 15 of the 18 CIS Controls, and the full CIS Controls v8.1 contains 153 Safeguards in total. IG2 adds further Safeguards for organisations with more complex environments, and IG3 includes every Safeguard. Each group includes everything in the groups below it, so IG1 is always the foundation.
Is CIS IG1 mandatory?
No. The CIS Controls are a voluntary best-practice framework, so there are no fines for not following IG1. However, customers, insurers and partners increasingly ask whether you meet a recognised baseline, and CIS describes IG1 as an emerging minimum standard of information security for all enterprises. Some contracts or sector schemes may reference the CIS Controls directly.
Who should implement CIS IG1?
Every organisation can benefit from IG1, but it is aimed particularly at small and medium-sized businesses with limited IT and cyber security resources. It is also a sensible first milestone for larger organisations building a security programme, because IG2 and IG3 build directly on the same Safeguards rather than replacing them.
Can you get certified against CIS IG1?
CIS does not run a formal certification scheme for the CIS Controls. Organisations usually self-assess their implementation, often using CIS assessment tools, or ask an independent assessor to review it. The result can then be shared with customers or used to support questionnaires, but it is not a certificate in the way ISO 27001 is.
How does CIS IG1 relate to ISO 27001 and SOC 2?
IG1 overlaps heavily with ISO 27001 Annex A and SOC 2 security criteria, covering the same areas such as access control, malware protection, backups, logging and incident response. IG1 is more prescriptive and technical, while ISO 27001 adds a management system and certification and SOC 2 adds an independent attestation report. Implementing IG1 first gives a strong head start on either.
What changed in CIS Controls v8.1?
Version 8.1, published by CIS in June 2024, is an iterative update to v8. It added a Govern security function to align with NIST Cybersecurity Framework 2.0, refreshed glossary terms and asset classes, and revised some Safeguard descriptions. The structure of 18 Controls and the 56 IG1 Safeguards remains in place, so v8 IG1 work carries forward.
Does OneClickComply support CIS IG1?
Yes. OneClickComply supports CIS Controls v8.1 IG1 today. Each Safeguard is mapped to controls that are evidenced automatically from your connected tools and monitored continuously, with AutoComplete policies for the processes IG1 requires and OneClickFix for supported misconfigurations. Our in-house audit team is available through Ask an Auditor if you need guidance on a Safeguard.
Related standards
All standards- CIS Controls v8.1Framework · Global
- CIS Controls v8.1 Implementation Group 3 (IG3)Framework · Global
- CIS Critical Security Controls v8.1 Implementation Group 2 (IG2)Framework · Global
- MITRE ATT&CK v16Framework · Global
- COBIT 2019Framework · Global
- CSA Cloud Controls Matrix (CCM) v4.1Framework · Global
- CSA IoT Security Controls Framework v2Framework · Global
- AICPA Privacy Management FrameworkFramework · Global
Get CIS IG1 ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.