← CIS Controls v8 in plain English

CIS Controls v8 IG3 153 safeguards

Implementation Group 3 / Specialist coverage

Written for an organization with security specialists across separate disciplines, and exposure that justifies them.

Think of it likeKeeping a locksmith, an electrician, and a fire inspector on staff because the building is big enough to need all three.

In plain English

IG3 is the full catalogue. The safeguards added here assume dedicated expertise in areas like application security, incident response, and penetration testing, so reaching it is a staffing question before it is a control question.

IG3 covers 153 of the 153 safeguards in CIS Controls v8, which is every IG2 safeguard plus the 23 added at this level. Each one below links to a plain-English translation.

Control 1: Inventory and Control of Enterprise Assets

Control 2: Inventory and Control of Software Assets

Control 3: Data Protection

Control 4: Secure Configuration of Enterprise Assets and Software

Control 5: Account Management

Control 6: Access Control Management

Control 7: Continuous Vulnerability Management

Control 8: Audit Log Management

Control 9: Email and Web Browser Protections

Control 10: Malware Defenses

Control 11: Data Recovery

Control 12: Network Infrastructure Management

Control 13: Network Monitoring and Defense

Control 14: Security Awareness and Skills Training

Control 15: Service Provider Management

Control 16: Application Software Security

Control 17: Incident Response Management

Control 18: Penetration Testing

Check yourself against it