CIS Controls V8
Definition
The eighth version of the CIS Critical Security Controls, released in May 2021. It consolidates 18 Controls and 153 Safeguards, reorganised from the previous 20-control structure. The revision merged several Controls and added cloud and mobile coverage to reflect current infrastructure.
- Release date
- May 2021
- Structure
- 18 Controls, 153 Safeguards
- Prior structure
- 20 Controls in earlier versions
- Key change
- Consolidated Controls, added cloud and mobile coverage
Common questions
Why did the Controls count drop from 20 to 18 in v8?+
Several previous Controls that overlapped in scope, such as separate boundary defence and wireless access control Controls, were merged into broader activity-based Controls, reflecting how modern security work is actually organised rather than by device type.
How do Implementation Groups relate to v8's 153 Safeguards?+
Each Safeguard is tagged to Implementation Group 1, 2, or 3, letting an organisation apply the subset appropriate to its size and risk profile instead of attempting all 153 Safeguards at once regardless of resources.
Why was cloud and mobile coverage added specifically in v8?+
Earlier versions were written when most enterprise infrastructure was on-premises, so v8 rewrote and added Safeguards addressing cloud service configuration and mobile device management to match how organisations actually deploy technology today.
Related terms
- CIS Benchmark
- A technology-specific configuration hardening guide published by CIS for operating systems, cloud services, databases, and applications. Each Benchmark provides Level 1 (broadly...
- CIS Controls Self-Assessment Tool (CSAT)
- A free web-based tool provided by CIS that allows organisations to score their current implementation status for each Safeguard and generate a...
- Crosswalk
- A published table that aligns controls from two frameworks side by side to show which controls address the same security objective. NIST,...
- Implementation Group (IG)
- A CIS Controls concept that divides the 153 safeguards across three tiers by organisational size and risk profile. IG1 (56 safeguards) covers...
- Safeguard
- The individual action item within a CIS Control. Each Safeguard specifies a concrete activity (for example, 'establish and maintain an accurate inventory...