CIS Controls: the short list, in the right order
We assess you against the CIS Critical Security Controls, choose the implementation group that fits, and help you put the prioritised safeguards in place.
Overview
What the CIS Controls are
The CIS Critical Security Controls are a prioritised set of defensive practices maintained by the Center for Internet Security. The current version has 18 controls, from asset inventory and data protection to incident response and penetration testing, each broken down into specific safeguards.
The safeguards are sorted into three implementation groups. IG1 is essential cyber hygiene, the floor every organisation should stand on. IG2 and IG3 add safeguards for organisations with more complex environments, more sensitive data or more capable adversaries. Each group includes the one before it, so you climb rather than choose.
There is no CIS Controls certification. The framework is meant to be used, measured and improved. Black Fox measures where you stand and helps with the work, documents and technical configuration alike.
Who it is for
Small and mid-sized organisations that want a concrete, prioritised starting point, IT teams that prefer a list of things to do over a management system, and organisations that already follow a framework such as ISO/IEC 27001 and want a technical baseline under it.
The work, from scoping to evidence.
What we do
Implementation group
We help you decide which implementation group fits your size, data and exposure, so you aim at the right set of safeguards.
Safeguard assessment
Each safeguard in scope checked against evidence: implemented, partly implemented or missing.
Asset and software inventory
The first controls ask you to know what you run. We help you build inventories that stay current.
Technical implementation
Hands-on hardening of endpoints, servers, network devices and accounts, including configuration baselines such as the CIS Benchmarks.
Mapping to other frameworks
The CIS Controls map to the NIST CSF, ISO/IEC 27001 and others. We use that mapping so the work counts more than once.
How the engagement runs
Kickoff
We agree the scope, the people involved and the access we need, and sign an NDA first if you need one.
Proposal
A business proposal with the method, the scope and the contract type that suits you.
Assessment
Interviews, configuration review and evidence sampling against the safeguards of your implementation group.
Results handover
A scored view of every safeguard, a business report and a technical report with the steps to close each gap.
Implementation support
Optional hands-on work on the gaps you choose, in the order the controls suggest.
Closing
Project close with feedback, and an optional reassessment to measure progress.
What you receive
- Implementation group recommendation
- Safeguard-by-safeguard assessment
- Prioritised remediation plan
- Business report for management
- Technical report with configuration guidance
- Mapping to NIST CSF or ISO/IEC 27001 where useful
Questions
Can we be certified against the CIS Controls?
No. CIS publishes the controls and tools to measure them, but there is no certification scheme for organisations. An independent assessment, like ours, shows where you stand. If you need a certificate, look at ISO/IEC 27001.
What is the difference between the CIS Controls and the CIS Benchmarks?
The Controls describe what to do across your security programme. The Benchmarks are detailed secure configuration guides for specific products, such as operating systems and cloud platforms. Several safeguards point to secure configuration, which is where the Benchmarks come in.
Which implementation group should we aim for?
Every organisation should cover IG1. Whether you need IG2 or IG3 depends on how sensitive your data is, how complex your environment is and what your clients and regulators expect. We help you decide during the assessment.
Is this only a document exercise?
No. Most safeguards are technical. We check configurations and evidence, and we can do the hardening work with you.
Related services
- Governance and riskNIST Cybersecurity FrameworkNIST CSF 2.0 support from Black Fox Security: current and target profiles across Govern, Identify, Protect, Detect, Respond and Recover, and a plan to close the gap.
- Managed securitySecurity hardeningSecurity hardening by Black Fox Security: endpoint, server and network hardening, secure configuration baselines, monitoring setup and personal security.
- Managed securityVulnerability managementRecurring vulnerability reviews from Black Fox Security: scanning, triage, prioritisation by exploitability and exposure, fix tracking and trend reporting.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
Start with IG1
Tell us what you run. We will tell you which safeguards to do first and help you do them.