The CIS Controls aren't 18 equal controls. They're two inventories, and then sixteen things that assume you finished the inventories.
That's my hill.
Version 8 came out in May 2021 with 153 safeguards sorted into 18 CIS Controls.
Here they are in the official order. The number in each line is the first safeguard, the one you'd actually start on.
The 18, in order
- 1. Inventory and Control of Enterprise Assets. Every device that touches your network, including the ones nobody bought through IT. Safeguard 1.1 asks for a detailed asset inventory, kept current.
- 2. Inventory and Control of Software Assets. Same idea for software. 2.1 is the software inventory, and 2.2 says everything on it has to still be supported.
- 3. Data Protection. Fourteen safeguards, tied for the biggest control. 3.1 asks for a data management process before anyone mentions encryption.
- 4. Secure Configuration of Enterprise Assets and Software. Hardening. 4.1 asks for a documented secure configuration process, which is where the CIS Benchmarks come in.
- 5. Account Management. 5.1 is an inventory of accounts. Yes, another inventory.
- 6. Access Control Management. Who gets access and how it gets taken away. 6.1 is an access granting process, and MFA shows up in 6.3 through 6.5.
- 7. Continuous Vulnerability Management. 7.1 asks for a written vulnerability management process. Not a scanner. A process.
- 8. Audit Log Management. 8.1 is a log management process. Twelve safeguards, and only 3 of them are IG1.
- 9. Email and Web Browser Protections. 9.1 says run only fully supported browsers and email clients.
- 10. Malware Defenses. 10.1 is deploy anti-malware. Your EDR probably covers it.
- 11. Data Recovery. Backups. 11.1 is a recovery process, and 11.4 wants an isolated copy of the recovery data, which is the one ransomware crews go looking for.
- 12. Network Infrastructure Management. 12.1 says keep the network gear up to date.
- 13. Network Monitoring and Defense. 13.1 is centralized security event alerting, which in practice means a SIEM. Zero IG1 safeguards.
- 14. Security Awareness and Skills Training. 14.1 asks for a program. Eight of its nine safeguards are IG1.
- 15. Service Provider Management. New in v8. 15.1 is, again, an inventory, this time of your vendors.
- 16. Application Software Security. Only bites if you write or ship code. 16.1 asks for a secure development process.
- 17. Incident Response Management. 17.1 asks you to name the person who runs incident handling, plus a backup for when they're on a plane.
- 18. Penetration Testing. Dead last.
Why 1 and 2 go first
They aren't first because they're easy. You can't patch a laptop you don't know exists, and you can't say a piece of software is supported if you never wrote down that it's installed.
Count the lists. 1.1 is devices, 2.1 is software, 3.2 is data, 5.1 is accounts, 15.1 is service providers.
Five of the 18 controls carry an inventory.
What I keep seeing is the opposite order. A team buys an EDR license, rolls it out, and only then finds out the console and the finance spreadsheet disagree about how many laptops the company owns.
That disagreement is Control 1. They just did it last.
I'd rather see a messy spreadsheet of every laptop than a clean EDR dashboard that covers most of them.
56, then 130, then 153
The implementation groups stack. IG1 is 56 safeguards, IG2 adds 74 more for 130, and IG3 adds the last 23 to reach all 153.
CIS calls IG1 essential cyber hygiene. I read that as the floor for everyone, not a small-business edition.
Three controls have no IG1 safeguards at all. Network monitoring (13), application security (16), and pen testing (18) only start at IG2.
So here's the side my pen-testing friends won't like. If you haven't finished IG1, don't buy a pentest yet. You'll pay for a findings report that says, at length, that you didn't finish Controls 1 and 2.
Control 14 is the odd one out the other way. Eight of its nine safeguards sit in IG1, which makes training the most front-loaded control in the set.
If you're the one-person IT shop that has to tell the board by December 31 what "we follow CIS" means, say IG1 and mean all 56. The IG1 list is the scope. The IG3 page is where you go when someone asks what's left.
Top 20, v7, v8, v8.1. Same family.
The CIS Critical Security Controls, the CSC, and the Top 20 are one lineage.
(SANS ran the list for years before it moved over to CIS in 2015, so somebody in your next audit meeting will still call it the SANS Top 20 and mean exactly this list of controls.)
Version 7.1 in 2019 had 20 controls. Version 8 cut that to 18 by grouping safeguards around activities instead of around who manages the device.
Wireless Access Control stopped being its own control. Service Provider Management showed up as Control 15.
Then v8.1 landed in June 2024 and added a Govern function so the mapping lines up with NIST CSF 2.0, which NIST published that February. The count stayed at 18.
I don't care which name goes in your policy. Write v8.1 if you want to be current, or v8 if that's what your cyber insurance questionnaire asks about.
Whether the Govern tag changes how a 40-person company actually runs its program, I don't know yet.
It's October 2026 and it reads to me like a relabel more than new work. I'd want another audit cycle before I said that with a straight face.
Where to start Monday
Open the plain-English safeguard pages, then run the IG1 assessment and count how many of the 56 you'd sign your name to. If 1.1 is a no, you already know what Monday is for.