What category of guidance this is
The CIS Critical Security Controls (CIS Controls) are a prioritized set of Safeguards. The Safeguards defend against prevalent attacks against systems and networks. The Version 8.1 page states that the Controls are mapped to and referenced by multiple legal, regulatory, and policy frameworks. Implementation Groups (IGs) are recommended guidance for which Safeguards to implement first. The official IG page bases that choice on an enterprise risk profile. The choice also depends on the resources available to implement the Controls.
Implementation Groups are an industry prioritization discipline. They are not a U.S. statute.
Edition covered
CIS Controls Version 8.1 is an iterative update to Version 8. The Center for Internet Security announced the release in a press release dated 2024-06-25. The Version 8.1 white paper was published 2024-06-24. The Version 8.1 page still presents Version 8.1 as the current Controls version as of this review (2026-09-26). The same page points readers to earlier versions. If a newer version appears, this pin must change. The older claim is then UNKNOWN.
The Version 8.1 pages list five highlights. The first highlight is a realignment of the Controls maps to NIST CSF 2.0 security functions. That realignment covers the Govern function. Two more highlights are revised asset classes and clarifications to some Safeguard descriptions. Another highlight is expanded glossary definitions for reserved words. The last highlight is the design principles of context, coexistence, and consistency.
IG1, then IG2, then IG3
IG1 is essential cyber hygiene. The official IG page describes IG1 as the foundational set of cyber defense Safeguards for every enterprise. Those Safeguards guard against the most common attacks. IG2 builds upon IG1. IG3 builds upon IG1 and IG2. The same page states that IG3 is comprised of all the Controls and Safeguards (the full set). Risk profile and available resources decide which group is the current target.
CIS states that there is a total of 153 Safeguards in Version 8 and Version 8.1. IG1 is the first subset. IG2 and IG3 are cumulative, because each later group builds on the earlier group. IG3 is the full set.
A first-step discipline, not a trophy
CIS guidance places every enterprise at IG1 first. Implementation is iterative. Environments, threats, and business objectives change. A group chosen once is therefore not a finish line.
IG progress is a prioritization discipline. Attackers do not automatically honor that discipline as a safe harbor. Completion of a first set does not mean that an attack will skip the enterprise. The 2024-06-25 press release states that the Controls are included in state cybersecurity safe harbor statutes. Those states are Ohio, Utah, Connecticut, and Iowa. Whether a specific statute treats an IG1 program as a defense is UNKNOWN. The terms of any such defense are also UNKNOWN. Those questions go to counsel. A vendor "aligned" claim is still not a certificate.
What Implementation Groups are not
A Controls map to the CSF 2.0 Govern function is not completion of Govern.
Rewrite the one-line claim
The claim "we are CIS, IG1, CSF, and ISO compliant" mixes four objects. Exact replacement: "We use CIS Controls Version 8.1 Implementation Groups as a hygiene prioritization discipline for a first step (IG1, then IG2, then IG3)." That discipline is different from an ISO/IEC 27001 scoped certificate and from CSF 2.0 outcomes. That discipline is also different from an SP 800-53 baseline.
A slide can state "CIS aligned." The team then privately asks which Implementation Group is the current target. The team also asks what evidence shows that a Safeguard actually runs.
IG1 is not a certificate, not CSF Govern, not an 800-53 baseline, and not an ISO certificate
| Phrase people use | Literacy correction |
|---|---|
| We finished IG1, so we are certified / safe harbor | CIS Implementation Groups are not a formal certificate scheme. Reference card: /reference/frameworks/cis-controls-8-1/. |
| IG1 = CSF Govern done | CSF Govern is outcomes language. IG1 is a CIS hygiene set for a first step. Related maps exist in Version 8.1. The two objects stay separate. Reference card: /reference/frameworks/nist-csf-2-0/. Lesson: /learn/topics/outcomes-then-controls/. |
| IG1 = 800-53 baseline | SP 800-53B baselines are a different catalog companion. IG1 and an 800-53 baseline are not equal. Explainer: /learn/explainers/sp-800-53/. Reference card: /reference/frameworks/nist-sp-800-53-r5/. |
| IG1 = ISO certificate | ISO/IEC 27001 is an ISMS requirements and certification lane. An ISO certificate is a different object. Explainer: /learn/explainers/iso-27001/. |
| CIS done means CSF / ISO / 800-53 done | CIS progress does not finish CSF, ISO, or 800-53 work. Six-map comparison: /reference/frameworks/compare/. |
Common misconceptions
Completion of IG1 means the enterprise is certified, holds a safe harbor, and attackers will skip the enterprise.
Implementation Groups are not a formal certificate scheme. Completion of IG1 is not proof that an attack will fail. Whether a specific state statute treats an IG1 program as a defense is UNKNOWN. That question goes to counsel.
CIS aligned, an ISO certificate, CSF done, and an 800-53 baseline are the same badge.
Those four badges are different objects. An ISO/IEC 27001 certificate is a scoped ISMS assurance lane. CSF 2.0 is outcomes language. An SP 800-53B baseline is a catalog companion. A map between those objects does not finish the others.
IG1 contains all 153 Safeguards.
IG1 is the first subset of the 153 Safeguards. Only IG3 contains every Safeguard.
A large enterprise can skip IG1 and start at IG3.
CIS tells every enterprise to start with IG1. IG3 includes all of the Safeguards in IG1 and IG2.
Once an enterprise picks its Implementation Group, the choice is final.
CIS calls the groups self-assessed categories, based on the risk profile and the resources of the enterprise. When those change, the enterprise can assess its group again.
The IG ladder
The ladder comes from the CIS Implementation Groups page.
| Group | Literacy | Boundary |
|---|---|---|
| IG1 | Essential cyber hygiene. The foundational first set for every enterprise, to guard against the most common attacks | A first subset of the 153 Safeguards. Not the full set, and not a certificate. |
| IG2 | Builds upon IG1. The group that fits still depends on risk profile and available resources | Cumulative with IG1. Not a separate catalog, and not a certificate. |
| IG3 | Builds upon IG1 and IG2. The IG page states that this group is comprised of all the Controls and Safeguards (the full set) | The full set. Not proof that an attacker will skip the enterprise. |
CHECK THE CATEGORY
Which sentence matches CIS Implementation Groups?
Glossary and nearby pages
- CIS Controls Reference card (framework summary)
- Compare the six maps (a row is not this ladder)
- Outcomes first, then controls (F8a)
- ISO/IEC 27001 explainer (scoped certificate, different object)
- SP 800-53 explainer (catalog and baselines, not an Implementation Group)
- NIST SP 800-53 Reference card (catalog summary)
- NIST CSF 2.0 framework card (outcomes, including Govern)
- GRC practice path
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.