← CIS Controls v8 in plain English

CIS Controls v8 IG2 130 safeguards

Implementation Group 2 / Risk-aware operations

Written for an organization with people whose actual job is managing IT infrastructure, and data whose loss would hurt.

Think of it likeHiring someone whose job is the building, rather than asking whoever is nearest to check the locks.

In plain English

IG2 is cumulative: it is every IG1 safeguard plus the ones that need someone to own them full time. The jump is less about buying tools and more about having a person accountable for configuration, logging, and access review.

IG2 covers 130 of the 153 safeguards in CIS Controls v8, which is every IG1 safeguard plus the 74 added at this level. Each one below links to a plain-English translation.

Control 1: Inventory and Control of Enterprise Assets

Control 2: Inventory and Control of Software Assets

Control 3: Data Protection

Control 4: Secure Configuration of Enterprise Assets and Software

Control 5: Account Management

Control 6: Access Control Management

Control 7: Continuous Vulnerability Management

Control 8: Audit Log Management

Control 9: Email and Web Browser Protections

Control 10: Malware Defenses

Control 11: Data Recovery

Control 12: Network Infrastructure Management

Control 13: Network Monitoring and Defense

Control 14: Security Awareness and Skills Training

Control 15: Service Provider Management

Control 16: Application Software Security

Control 17: Incident Response Management

Control 18: Penetration Testing

Check yourself against it