> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CIS Controls v8.1

> Implement prioritized cybersecurity best practices with the CIS Controls framework.

The CIS Controls (Center for Internet Security Controls) are a prioritized set of cybersecurity best practices designed to help organizations defend against the most common cyber threats. Version 8.1 includes 18 control groups organized by implementation priority.

## Who needs CIS Controls?

Any organization looking for a practical, prioritized approach to cybersecurity — especially those without the resources for comprehensive frameworks like ISO 27001. CIS Controls are widely used in government, healthcare, and education.

## 18 CIS Control groups

| #  | Control                                     | Priority |
| -- | ------------------------------------------- | -------- |
| 1  | Inventory and Control of Enterprise Assets  | IG1      |
| 2  | Inventory and Control of Software Assets    | IG1      |
| 3  | Data Protection                             | IG1      |
| 4  | Secure Configuration of Assets and Software | IG1      |
| 5  | Account Management                          | IG1      |
| 6  | Access Control Management                   | IG1      |
| 7  | Continuous Vulnerability Management         | IG2      |
| 8  | Audit Log Management                        | IG2      |
| 9  | Email and Web Browser Protections           | IG2      |
| 10 | Malware Defenses                            | IG2      |
| 11 | Data Recovery                               | IG2      |
| 12 | Network Infrastructure Management           | IG2      |
| 13 | Network Monitoring and Defense              | IG3      |
| 14 | Security Awareness and Skills Training      | IG2      |
| 15 | Service Provider Management                 | IG2      |
| 16 | Application Software Security               | IG2      |
| 17 | Incident Response Management                | IG2      |
| 18 | Penetration Testing                         | IG3      |

## Implementation Groups

<CardGroup cols={3}>
  <Card title="IG1 — Essential" icon="shield">
    Basic cyber hygiene. Minimum standard for all organizations regardless of size.
  </Card>

  <Card title="IG2 — Foundational" icon="shield-check">
    For organizations with moderate IT complexity managing sensitive data.
  </Card>

  <Card title="IG3 — Organizational" icon="shield-halved">
    For mature organizations facing sophisticated threats and regulatory requirements.
  </Card>
</CardGroup>

## How DSALTA helps

* **All 18 CIS control groups** mapped to actionable controls
* **Implementation Group tracking** to prioritize by your organization's maturity
* **Automated evidence** from connected integrations
* **Cross-framework mapping** — CIS Controls overlap heavily with SOC 2, ISO 27001, and NIST

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Are CIS Controls mandatory?" icon="gavel">
    No, they are voluntary best practices. However, many regulatory frameworks reference CIS Controls, and some industries require them (e.g., CMMC references CIS).
  </Accordion>

  <Accordion title="Which Implementation Group should I target?" icon="layer-group">
    Most small and medium businesses should start with IG1 (essential hygiene). Move to IG2 as your security program matures.
  </Accordion>
</AccordionGroup>

## How DSALTA automates this

**85** of DSALTA's automated checks contribute evidence to this framework, drawn from **11** integrations. Browse them in the [Compliance Tests](/tests/overview) catalog. They are linked through the controls each check satisfies, so a single check usually contributes to several frameworks at once — the count is not a list of checks unique to this one.

## Related pages

* [Active Frameworks](/guides/compliance/frameworks-active)