Derived from CIS Critical Security Controls

CIS Controls v8.1 Scope Map

Pick a target Implementation Group and see which of the eighteen CIS Controls fall in scope for it.

All templates

When sizing a security uplift and deciding how far up the Implementation Groups to aim.

What you need and what you get

You'll need

A target Implementation Group (IG1, IG2 or IG3)

You'll get

A scoped control map, downloadable as PNG or PowerPoint
The in-scope control count for the chosen group
An Excel register carrying exactly what the diagram shows

CIS Controls v8.1: the eighteen controls by implementation group

All eighteen CIS Critical Security Controls v8.1, numbered 01 to 18, each carrying the lowest implementation group that activates it. Choose a target group and the controls in scope take the red tint.

Pick the implementation group your organisation is aiming for. IG1 is essential cyber hygiene; IG2 and IG3 add the controls for organisations holding sensitive data and facing targeted attacks. The count line states how many of the eighteen controls sit in scope.

Choose the implementation group your organisation is aiming for and the controls in scope take the red tint. The count and what the group represents appear here.