CIS Controls, by implementation group.
The CIS Controls tell you what to do first. TruOps shows how far you've gotten, safeguard by safeguard.
CIS Controls v8 implementation
Safeguards implemented, by Implementation Group
The same work also counts toward
Mapped coverage, with partial overlaps shown
Each mapping is labeled exact, partial, or inferred, with a source.
The CIS Critical Security Controls, maintained by the Center for Internet Security, are a prioritized set of 18 controls containing 153 safeguards in version 8.1. Safeguards are divided into three Implementation Groups: IG1 is essential cyber hygiene for every organization, and IG2 and IG3 add safeguards for organizations with more complex environments and higher risk.
- Maintained by
- Center for Internet Security
- Current version
- v8.1
- Structure
- 18 controls, 153 safeguards
- Implementation groups
- IG1 · IG2 · IG3
Implementation groups
| Group | Who it is for |
|---|---|
| IG1 | Essential cyber hygiene, the minimum for every organization |
| IG2 | Organizations with more IT staff, sensitive data, and multiple departments |
| IG3 | Organizations facing sophisticated attacks or with sensitive data and regulatory oversight |
The challenge
CIS Controls come in priority order. Start with IG1 and work up, with technical safeguards checked from tools you already own.
- IG1 was never scored separately from IG2 and IG3.
- Asset inventory, MFA, and vulnerability management data sit in your tools, and the CIS assessment doesn't use them.
- The same safeguards map to CSF and ISO, and get evidenced all over again.
What you're probably using today
Almost nobody starts CIS Controls from scratch. You already have a program somewhere, and TruOps picks up from there.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| SOC 2 automation tools | Great for getting certified, with automated tests, a big framework library, and often a trust center. Maturity scoring, custom frameworks, and deeper risk or vendor work can fall outside what they cover. | Keep your automated checks. Use any framework as your anchor, map the rest with partial overlaps clearly marked, and run vendor and risk work in the same place. Start with the policies and reports you already have. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
How TruOps helps with the CIS Controls
Pick the CIS Controls as your anchor, or map it to the framework you already run. TruOps keeps the CIS Controls' own structure, down to the individual requirement, and shows coverage per requirement as satisfied, partial, or open, with the evidence behind each.
Upload what you have (prior reports, policies, spreadsheets) and TruOps pre-fills your CIS Controls assessment with cited answers. Connected tools keep technical controls current on the schedule you set, and failed checks become findings with a recommended fix.
Many CIS safeguards, like asset inventory, MFA, and vulnerability management, can be checked directly from your connected tools.
How TruOps helps
- Anchor or map
- Use CIS Controls as your anchor or map it to another framework, and your work counts once.
- Pre-filled assessment
- Your CIS Controls assessment opens with the answers your evidence supports already filled, each cited.
- Accurate coverage
- Partial coverage is clearly marked, with the remaining requirements listed.
- Continuous monitoring
- Technical controls checked against your tools, from hourly to quarterly.
- Findings with fixes
- Failed checks become grouped findings with a recommended action.
- Audit-ready snapshots
- Results saved as of their date, with the evidence trail attached.
Questions
How many CIS Controls are there?
Eighteen controls with 153 safeguards in version 8.1.
What is CIS IG1?
Implementation Group 1, the set of safeguards CIS calls essential cyber hygiene for every organization.
Does TruOps include a CIS assessment?
Yes. CIS assessments are built in as starting points and can be scored by implementation group.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Does TruOps replace our auditor, QSA, or certification body?
No. Only a licensed auditor, QSA, C3PAO, or accredited certification body can issue the opinion. TruOps keeps your evidence current, sourced, and dated so fieldwork goes quickly.
Related
Govern, Identify, Protect, Detect, Respond, Recover, with maturity scoring.
→LearnMaturity assessmentScoring how capable a program is, beyond pass or fail.
→IndustriesManufacturingDefense supply chains, plant networks, and supplier risk.
→IndustriesHigher educationResearch data, student records, and decentralized IT.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.