CIS Controls version 8 - Less is More

There are now 18 Controls, reduced from 20; These Controls are a prioritised set of Safeguards (formerly sub-controls) to mitigate the most prevalent cyber-attacks against systems and networks, and now include Service Provider Management, an increasingly key area of cyber risk.

As before, there are 3 levels of implementation that an organisation can choose from, depending on the criticality of the information and processes. These are called Implementation Groups (IGs):

• As a minimum standard of Information Security, organisations need to apply IG1 – “Basic Cyber hygiene”.
• Organisations would choose IG2 if they store and process sensitive client or enterprise information and can withstand short interruptions of service
• If an organisation handles highly sensitive information or is heavily regulated, and where successful attacks can cause significant harm to the public welfare, IG3 would be the appropriate level.

Cybercraft offers expert cyber risk governance, management and assessment services. Take a look at our Cyber Risk Assessment solution and our Fractional Chief Information Security Officer service.