Reach full CIS IG3 coverage with automated evidence and monitoring

CIS IG3 is Implementation Group 3 of the CIS Critical Security Controls, the most complete of the three groups. It covers all 153 Safeguards across the 18 Controls in version 8.1, adding 23 advanced Safeguards to those in IG1 and IG2. The Center for Internet Security designed it for organisations with dedicated security experts that need to defend against sophisticated, targeted attacks and protect sensitive data.

CIS IG3 is intended for organisations that hold sensitive or regulated data, run critical services, or face targeted attacks, and that employ security specialists across areas such as risk management, penetration testing and application security. Most organisations reach IG3 after implementing IG1 and IG2, because each Implementation Group builds on the one before it rather than replacing it.

No, the CIS Controls are a voluntary framework and there are no statutory penalties for not adopting IG3. However, customers, cyber insurers and some sector regulators reference the CIS Controls when judging whether security is reasonable, so falling short can affect contracts, insurance terms and how your security posture is viewed after an incident.

The three groups are cumulative. IG1 contains 56 Safeguards and is described by CIS as essential cyber hygiene. IG2 adds 74 Safeguards, giving 130, for organisations managing more complex environments and sensitive data. IG3 adds the final 23 Safeguards, covering all 153, with advanced measures such as penetration testing, red team exercises and in-depth application security for mature security teams.

No, CIS does not certify organisations against the CIS Controls. You can self-assess your implementation, for example with the CIS Controls Self Assessment Tool, or ask an independent assessor to review it. Many organisations use the CIS Controls as the technical baseline for a certifiable standard such as ISO 27001 or a SOC 2 attestation.

The CIS Controls are a prescriptive set of technical Safeguards, while ISO 27001 is a certifiable management system standard and SOC 2 is an attestation report. They overlap heavily, and CIS publishes mappings to frameworks including ISO 27001 and NIST CSF. Implementing IG3 provides much of the technical evidence those frameworks require.

It depends on your starting point, the size of your environment and how much of IG1 and IG2 you already have in place. Because IG3 includes all 153 Safeguards, including penetration testing, red teaming and secure development practices, it is usually a multi-phase programme. Automating evidence collection and monitoring shortens the time spent proving each Safeguard.

Yes, OneClickComply supports CIS Controls v8.1 IG3 today. Every Safeguard is mapped to its control library, evidence is collected automatically from connected tools, and continuous monitoring alerts you to drift. Its in-house audit team, virtual CISO and penetration testing services help with the advanced IG3 Safeguards. OneClickComply does not issue certification, as CIS does not certify organisations.