The 18 CIS controls each include three categories of sub-controls, called implementation groups, that increase in complexity based on the maturity of the organization’s cyber defenses. It is designed to measure an organization’s level of maturity as compared to a set of recommended standards. CIS 18Īs the name suggests, the CIS 18 is a list of 18 primary security controls organized by activity. Let’s start with CIS 18 as we’re asked about that one most often.

That said, it’s important to understand exactly what these frameworks are and how they help improve your cybersecurity posture. Our team has vast experience with both CIS 18 (formerly SANS Top 20 or CIS 20) and NIST CSF v1.1 requirements, and we can develop a scope of work based on either.

Regardless of the reason, the question we get most often is which standard is best for the company. Other times, they simply want to have a better internal understanding of their overall security posture and gaps. Depending on their industry and/or company size, Raxis customers are sometimes required to assess the maturity of their cybersecurity using these tools.

Critical security controls version 7