CIS Controls for Small Business: Implementation Guide 2026

Why CIS Controls Exist — And Why They Work for Small Businesses

Every major cybersecurity framework starts with the same problem: there are thousands of possible security measures, and no organisation has the budget or staff to implement all of them. The question is always which ones to implement first.

The CIS Critical Security Controls — developed by the Center for Internet Security — answer that question with unusual directness. Unlike frameworks built primarily for compliance purposes, the CIS Controls were designed specifically to stop the most common real-world attacks. The original controls were derived from analysis of what attacks were actually succeeding and what defences were actually stopping them. That heritage matters: implementing the CIS Controls doesn’t just help you pass an audit, it materially reduces your likelihood of being successfully attacked.

Version 8.1, released on June 25, 2024, is the current version. It contains 18 controls, 153 individual safeguards, and — critically for small businesses — a tiered implementation structure called Implementation Groups that tells you exactly which safeguards to implement first.

This guide focuses on what a small business with limited IT staff needs to know: which controls matter, which ones you can defer, and how to sequence implementation so you’re getting the biggest risk reduction per hour spent.

The Three Implementation Groups: Understanding IG1, IG2, and IG3

The most important concept in the CIS Controls framework for small businesses is the Implementation Group (IG) structure. This is what separates the CIS Controls from every other framework — it explicitly acknowledges that not all organisations need to implement everything, and it tells you what to do based on your size and risk profile.

Implementation Group 1 (IG1) — Essential Cyber Hygiene

IG1 is the tier for small and medium businesses with limited IT and cybersecurity expertise, often with no dedicated security staff. It contains 56 safeguards drawn from across 15 of the 18 controls. CIS describes IG1 as “essential cyber hygiene” — the baseline that every business of every size should have in place.

The 56 IG1 safeguards address the most common attack vectors against small businesses: unpatched software, weak or reused passwords, no multi-factor authentication, unprotected backups, and staff clicking on phishing emails. If your business implements only IG1 and nothing else, you will have addressed the controls responsible for the vast majority of successful attacks against organisations at your scale.

Implementation Group 2 (IG2) — For Businesses with Dedicated IT

IG2 adds 74 more safeguards, bringing the total to 130. It’s designed for organisations that have at least some dedicated IT resources and handle more sensitive data or face a higher threat profile — think a medical practice with an in-house IT person, or a financial services firm with a small security team. IG2 builds on IG1; you don’t skip IG1 safeguards and start at IG2.

Implementation Group 3 (IG3) — Mature Security Programmes

IG3 adds the remaining 23 safeguards, covering the full 153. It’s designed for organisations with dedicated security teams, significant sensitive data, and advanced threat exposure. For the typical small business reading this guide, IG3 is not your near-term target.

The practical implication: If you have under 50 employees and no dedicated security staff, IG1 is your target. All 56 safeguards. Nothing more until every IG1 safeguard is in place.

What Changed in v8.1 (June 2024)

CIS Controls v8 was released in 2021. Version 8.1, released June 25, 2024, is a refinement rather than a major revision — the 18 controls and overall structure are unchanged. The meaningful updates are:

Alignment with NIST CSF 2.0. The security function mappings were updated to reflect the NIST Cybersecurity Framework 2.0, which added “Govern” as a sixth function alongside Identify, Protect, Detect, Respond, and Recover. CIS v8.1 now maps to all six NIST CSF 2.0 functions.

New “Govern” safeguards. Reflecting the NIST CSF 2.0 Govern function, v8.1 added governance-focused safeguards across multiple controls, including documented data management processes, configuration management documentation, centralized account management, access control documentation, log collection procedures, backup and recovery documentation, network architecture documentation, formal security awareness training programmes, service provider management processes, and incident response plans. These additions emphasise that policies and processes — not just tools — are security controls.

New “Documentation” asset type. v8.1 recognises plans, policies, processes, and procedures as an asset type, alongside the existing categories of devices, users, applications, data, and networks. This formalises what experienced practitioners already knew: your documented procedures are themselves security-relevant assets that need to be managed and protected.

Clarifications and corrections. Glossary definitions were added for key terms including “plan” and “sensitive data,” and various safeguard descriptions were expanded or clarified.

For small businesses, the practical implication of v8.1 is that documentation — your written policies, incident response plans, and backup procedures — is now explicitly part of the framework, not just a nice-to-have.

All 18 CIS Controls: What Each One Requires

Here is every CIS Control with its safeguard count and the number of those safeguards in IG1 — the ones your small business should prioritise.

Control 1: Inventory and Control of Enterprise Assets 5 safeguards total — 2 in IG1

Know every device connected to your network. IG1 requires maintaining an active inventory of all enterprise assets (computers, servers, phones, printers, network devices) and making sure only authorised devices are allowed to connect. You cannot protect what you cannot see.

Control 2: Inventory and Control of Software Assets 7 safeguards total — 3 in IG1

Know every piece of software running in your environment and allow only authorised, supported software to operate. IG1 requires an inventory of all authorised software and a process for blocking or removing unauthorised applications. Attackers frequently exploit outdated or unknown software — you can’t patch what you don’t know exists.

Control 3: Data Protection 14 safeguards total — 6 in IG1

Classify your data by sensitivity, restrict access to sensitive data to those who need it, encrypt sensitive data in transit and at rest, establish retention periods, and dispose of data securely when it’s no longer needed. IG1 covers the foundational data protection requirements including a documented data management process (new in v8.1), encryption of sensitive data on portable devices, and secure disposal of data and equipment.

Control 4: Secure Configuration of Enterprise Assets and Software 12 safeguards total — 7 in IG1

Harden your systems by removing unnecessary services, changing default passwords, enabling host-based firewalls, and applying vendor-recommended security configurations. IG1 includes requiring a documented configuration management process (v8.1), applying secure configuration baselines to laptops and desktops, enabling automatic screen lock after inactivity, encrypting data on mobile devices, and using host-based firewalls on end-user devices.

Control 5: Account Management 6 safeguards total — 4 in IG1

Maintain an inventory of all user and administrator accounts. Disable or remove accounts that are no longer needed — former employee accounts, test accounts, default vendor accounts. Limit administrative accounts; regular users should not have administrator-level access for daily work. IG1 covers account inventories, disabling dormant accounts, and restricting administrator privileges to accounts used solely for administrative tasks.

Control 6: Access Control Management 8 safeguards total — 5 in IG1

Establish and follow a process for granting, reviewing, and revoking access permissions. Require multi-factor authentication (MFA) for remote network access and for all administrative access. IG1 covers access grant and revocation processes, MFA for remote access, MFA for administrative accounts, MFA for external-facing applications, and restricting access to sensitive data based on need-to-know.

Control 7: Continuous Vulnerability Management 7 safeguards total — 4 in IG1

Establish a programme for identifying, tracking, and remediating vulnerabilities in your software, operating systems, and devices. IG1 requires a documented vulnerability identification and remediation process (v8.1), operating system updates, software updates, and a formal patching programme with defined timelines. High-severity vulnerabilities should be patched within 14 days; critical vulnerabilities within 72 hours under IG1.

Control 8: Audit Log Management 12 safeguards total — 3 in IG1

Collect, retain, and review logs from your systems and applications to detect and investigate security incidents. IG1 requires documenting your log collection, review, and retention processes; collecting audit logs from enterprise assets; and ensuring logs are retained long enough to support incident investigation. For most small businesses, 90 days of log retention is the IG1 minimum.

Control 9: Email and Web Browser Protections 7 safeguards total — 2 in IG1

Defend against phishing, malware delivery via email, and malicious websites. IG1 requires using DNS filtering (or similar web content filtering) to block known malicious domains, and ensuring email clients do not automatically execute scripts or attachments. For small businesses, this translates to: enable your email provider’s built-in anti-phishing and anti-spam features, and use a DNS filtering service.

Control 10: Malware Defenses 7 safeguards total — 3 in IG1

Deploy anti-malware tools on all devices. IG1 requires anti-malware software on all endpoints, regular signature updates, and configuring anti-malware to scan removable media (USB drives). For most small businesses, the built-in Windows Defender or macOS built-in security tools satisfy the IG1 requirements with appropriate configuration — a third-party endpoint protection product is IG2.

Control 11: Data Recovery 5 safeguards total — 4 in IG1

Establish and maintain a data recovery process. IG1 requires a documented backup and recovery procedure (v8.1), regular automated backups of in-scope data, protected (immutable or isolated) backup copies, and periodic tested restores. The 3-2-1 backup rule is the standard implementation: three copies of data, two different media types, one copy offsite or in isolated cloud storage.

Control 12: Network Infrastructure Management 8 safeguards total — 1 in IG1

Keep network infrastructure secure, patched, and documented. IG1 requires only one safeguard: ensuring network infrastructure components (routers, switches, firewalls) receive security updates. This is the control with the lightest IG1 burden — apply firmware updates to your network equipment. The more detailed network architecture and segmentation requirements are IG2 and IG3.

Control 13: Network Monitoring and Defense 11 safeguards total — 0 in IG1

Monitor network traffic for anomalous activity and deploy network-based defences. No IG1 safeguards — this control is entirely IG2 and IG3. Small businesses can skip Control 13 until IG1 is complete.

Control 14: Security Awareness and Skills Training 9 safeguards total — 6 in IG1

Train all staff to recognise and report security threats. IG1 requires establishing and maintaining a security awareness training programme (with a documented plan, mandatory for new hires, repeated annually per v8.1), conducting phishing simulation exercises, and training staff specifically on authentication best practices, recognising social engineering attacks, recognising and reporting data incidents, and using data correctly in accordance with your policies.

Control 15: Service Provider Management 7 safeguards total — 1 in IG1

Evaluate and manage third-party providers who have access to your systems or data. IG1 requires maintaining an inventory of your service providers. The more demanding requirements — formal risk assessments, contractual security requirements, ongoing monitoring — are IG2 and IG3. For a small business, IG1 means keeping a simple list of every vendor with access to your systems or data.

Control 16: Application Software Security 14 safeguards total — 0 in IG1

Build security into software development and software acquisition. No IG1 safeguards — entirely IG2 and IG3. If you don’t develop custom software, this control is largely not applicable to you regardless of IG level.

Control 17: Incident Response Management 9 safeguards total — 3 in IG1

Prepare for, respond to, and learn from security incidents. IG1 requires designating personnel responsible for incident response, establishing a documented incident response plan, and ensuring that plan includes reporting procedures. For a small business, this means: someone is in charge when an incident happens, there is a written plan they can follow, and the plan says who gets called (IT provider, cyber insurer, legal counsel, affected customers if required by state law).

Control 18: Penetration Testing 5 safeguards total — 0 in IG1

Test your controls by simulating real attacks. No IG1 safeguards — entirely IG2 and IG3. Penetration testing is not a small business starting point. Skip it until IG1 is complete and you have budget for professional testing.

Your IG1 Implementation Sequence: 4 Phases

Implementing all 56 IG1 safeguards at once is impractical. This sequence is designed to address the highest-risk gaps first and build toward full IG1 compliance progressively. Each phase builds on the previous one.

Phase 1 (Weeks 1–4): Know What You Have and Secure Access

Before you can protect anything, you need to know what exists. Start here.

Build your asset inventory (Control 1.1, 1.2). A spreadsheet is adequate for a business with under 50 employees: list every computer, server, phone, and network device with its owner, operating system version, and last update date. Include cloud services and SaaS subscriptions in a separate tab.

Build your software inventory (Control 2.1, 2.2, 2.3). Document every application in use — installed software on each machine plus all cloud and SaaS tools. Note which applications are no longer supported by their vendors. Unsupported software is the single most common exploited vulnerability in small business environments.

Audit your accounts (Control 5.1, 5.2, 5.3, 5.4). List every user account across every system and service. Disable or delete accounts belonging to former employees immediately. Identify which accounts have administrative privileges — these should be separate accounts used only for admin tasks, not the same account the person uses for email and web browsing.

Enable MFA everywhere it’s available (Control 6.3, 6.4, 6.5). Start with the highest-risk access points: remote network access (VPN), email accounts, cloud services (Microsoft 365, Google Workspace, AWS, any SaaS tool with sensitive data access), and any admin panel for your website or e-commerce platform. MFA is the single highest-impact control for preventing account compromise — the most common way attackers get initial access to small business systems.

Phase 1 deliverables: Asset inventory spreadsheet. Software inventory spreadsheet. Account list with admin accounts identified. MFA enabled on remote access, email, and primary cloud services.

Phase 2 (Weeks 5–8): Harden Configurations and Protect Data

With your inventory in place and access secured, move to hardening.

Apply secure configurations (Control 4.1–4.7). Enable host-based firewalls on all laptops and desktops. Configure automatic screen lock (10 minutes of inactivity is a reasonable baseline). Enable full-disk encryption on all laptops and mobile devices (BitLocker on Windows, FileVault on macOS). Remove or disable software and services that are not needed. Change any default passwords on network equipment, routers, and any management interfaces.

Implement your patching process (Control 7.1–7.4). Enable automatic operating system updates on all devices. Create a calendar reminder to check for updates on software that doesn’t auto-update, including third-party applications, browser extensions, and firmware on network devices. Document your patching cadence — even a one-page written process counts. For critical vulnerabilities publicly disclosed via CISA’s Known Exploited Vulnerabilities catalogue, aim for a 72-hour patch window.

Set up data protection basics (Control 3.1–3.6). Identify where your sensitive data lives: customer records, payment information, employee data, health information if applicable. Ensure sensitive data on portable devices is encrypted (covered by the disk encryption you set up in Phase 1 if you enforce it on laptops). Establish a written data retention and disposal policy — how long you keep data and how you dispose of devices and media when retiring them.

Phase 2 deliverables: Disk encryption enabled on all portables. Firewalls active on all endpoints. Patching schedule documented and in use. Sensitive data locations mapped. Written data retention policy.

Phase 3 (Weeks 9–12): Backups, Email Defenses, and Logging

Phase 3 closes the three most common gaps that turn incidents into disasters.

Implement your backup strategy (Control 11.1–11.4). Write a one-page backup and recovery procedure: what gets backed up, how often, where it’s stored, how long it’s retained, and how to restore. Configure automated backups for all critical data. Ensure at least one backup copy is isolated from your primary environment — cloud backup with a different provider, or an offline copy. Enable immutable backup features where available (most cloud backup services offer this). Test restores at least quarterly: an untested backup is not a reliable backup.

Enable email and web filtering (Control 9.1, 9.2). Turn on your email provider’s built-in anti-phishing and anti-spam features if not already active. Enable DNS filtering to block connections to known malicious domains — Cloudflare Gateway (free), Cisco Umbrella (paid), and similar services operate at the DNS level and block malicious sites before connections are established. Configure email clients to not automatically execute scripts or open attachments without user confirmation.

Configure malware defenses (Control 10.1–10.3). Verify that anti-malware is running and current on all endpoints. Windows Defender with current definitions satisfies the IG1 requirement for Windows devices. macOS built-in security (XProtect and Gatekeeper) satisfies the requirement for Mac devices if kept updated. Ensure anti-malware scans removable media (USB drives) when connected. Configure alerts so malware detection generates a notification to whoever handles IT.

Set up basic audit logging (Control 8.1–8.3). Document your log collection approach — even a one-page note stating which systems generate logs, where those logs are stored, and who reviews them is sufficient for IG1. Ensure logging is enabled on your most critical systems: authentication logs (who logged in, from where, when), administrative activity logs, and firewall logs. Most cloud services and SaaS platforms retain logs by default; confirm where they’re accessible and how long they’re retained.

Phase 3 deliverables: Written backup procedure. Automated backups running with isolated copy. Successful test restore documented. DNS filtering enabled. Audit logging active with documentation.

Phase 4 (Weeks 13–24): Training, Incident Response, and Service Providers

Phase 4 is the ongoing operational layer — processes and people rather than technology.

Launch your security awareness training programme (Control 14.1–14.6). Document a written security awareness training plan: who must complete training, how often (annually at minimum), what topics are covered, and how completion is tracked. New hires should complete training before they’re given access to sensitive systems. Topics that IG1 specifically requires: recognising phishing and social engineering attacks, authentication best practices, recognising and reporting data incidents, and using company data in accordance with your policies. Free training resources include CISA’s free awareness materials, KnowBe4 Free Tools, and Proofpoint’s free phishing simulation tool.

Run a phishing simulation (Control 14.2). Send a simulated phishing email to all staff and track who clicks. You don’t need to shame individuals — aggregate results give you a baseline and identify whether training is working. Most email security platforms include phishing simulation features; standalone free tools are available as well.

Write your incident response plan (Control 17.1–17.3). Document who is responsible for incident response decisions, what constitutes a security incident requiring escalation, and what the first response steps are. Your plan should include: contact information for your IT provider, cyber insurance carrier, and legal counsel; a checklist of first actions when an incident is suspected; and notification obligations (state breach notification laws, cyber insurance policy requirements). The plan doesn’t need to be long — a two-page document covering the above is sufficient for IG1.

Inventory your service providers (Control 15.1). List every third-party vendor with access to your systems, networks, or data. Include your IT provider, cloud service providers, payroll processor, HR software, email provider, any SaaS tools with employee or customer data, and any contractors with system access. This inventory will inform your IG2 work when you get there.

Phase 4 deliverables: Written security awareness training plan. First phishing simulation completed. Written incident response plan with contact information. Service provider inventory.

IG1 Completion Checklist

The following is a condensed checklist of all controls with IG1 safeguards. Use it to track your implementation progress.

Control 1 — Asset Inventory ☐ 1.1 — Maintain an active inventory of all enterprise assets ☐ 1.2 — Address unauthorised assets found on the network

Control 2 — Software Inventory ☐ 2.1 — Maintain an active inventory of all authorised software ☐ 2.2 — Ensure only authorised software is installed ☐ 2.3 — Address unauthorised software found on devices

Control 3 — Data Protection ☐ 3.1 — Establish and maintain a documented data management process ☐ 3.2 — Establish and maintain a data inventory of sensitive data ☐ 3.3 — Configure data access control lists ☐ 3.4 — Enforce data retention policies ☐ 3.5 — Securely dispose of data and equipment ☐ 3.6 — Encrypt sensitive data on end-user devices

Control 4 — Secure Configuration ☐ 4.1 — Establish and maintain a documented secure configuration process ☐ 4.2 — Establish and maintain a documented process for managing default accounts ☐ 4.3 — Configure automatic session locking on enterprise assets ☐ 4.4 — Implement and manage a firewall on servers (where applicable) ☐ 4.5 — Implement and manage a firewall on end-user devices ☐ 4.6 — Securely manage enterprise assets ☐ 4.7 — Manage default accounts on enterprise assets and software

Control 5 — Account Management ☐ 5.1 — Establish and maintain an inventory of accounts ☐ 5.2 — Use unique passwords ☐ 5.3 — Disable dormant accounts ☐ 5.4 — Restrict administrator privileges to dedicated admin accounts

Control 6 — Access Control Management ☐ 6.1 — Establish an access granting process ☐ 6.2 — Establish an access revoking process ☐ 6.3 — Require MFA for externally-exposed applications ☐ 6.4 — Require MFA for remote network access ☐ 6.5 — Require MFA for administrative access

Control 7 — Vulnerability Management ☐ 7.1 — Establish and maintain a documented vulnerability management process ☐ 7.2 — Establish and maintain a remediation process ☐ 7.3 — Perform automated operating system patch management ☐ 7.4 — Perform automated application patch management

Control 8 — Audit Log Management ☐ 8.1 — Establish and maintain an audit log management process ☐ 8.2 — Collect audit logs from enterprise assets ☐ 8.3 — Ensure adequate storage for audit logs

Control 9 — Email and Web Browser Protections ☐ 9.1 — Ensure use of only fully supported browsers and email clients ☐ 9.2 — Use DNS filtering services

Control 10 — Malware Defenses ☐ 10.1 — Deploy and maintain anti-malware software ☐ 10.2 — Configure automatic anti-malware signature updates ☐ 10.3 — Disable autorun and autoplay for removable media

Control 11 — Data Recovery ☐ 11.1 — Establish and maintain a documented data recovery process ☐ 11.2 — Perform automated backups ☐ 11.3 — Protect recovery data ☐ 11.4 — Test data recovery

Control 12 — Network Infrastructure Management ☐ 12.1 — Ensure network infrastructure is kept up to date

Control 14 — Security Awareness and Skills Training ☐ 14.1 — Establish and maintain a security awareness programme ☐ 14.2 — Train workforce members on authentication best practices ☐ 14.3 — Train workforce members on data handling best practices ☐ 14.4 — Train workforce members on causes of unintentional data exposure ☐ 14.5 — Train workforce members on recognising social engineering attacks ☐ 14.6 — Train workforce members on recognising and reporting security incidents

Control 15 — Service Provider Management ☐ 15.1 — Establish and maintain an inventory of service providers

Control 17 — Incident Response Management ☐ 17.1 — Designate personnel to manage incident handling ☐ 17.2 — Establish and maintain contact information for reporting incidents ☐ 17.3 — Establish and maintain an enterprise incident response process

CIS Controls vs. Other Frameworks

If you’ve been reading about cybersecurity frameworks, you’ve likely come across NIST CSF, ISO 27001, and SOC 2 alongside the CIS Controls. Here’s how they differ in practice for a small business.

The practical relationship between CIS Controls and NIST CSF 2.0

CIS Controls v8.1 was specifically updated to map to NIST CSF 2.0. If you implement IG1, you will have addressed the core requirements of NIST CSF’s Protect and Recover functions for a small organisation. The two frameworks are complementary: NIST CSF provides the risk management vocabulary and structure; CIS Controls provides the specific, actionable controls to implement within that structure.

Many organisations use NIST CSF as their governance framework (for reporting to leadership and board) and CIS Controls as their implementation framework (for telling the IT team what to actually do). This combination works well and is increasingly the standard approach for mid-market businesses.

When does ISO 27001 or SOC 2 matter for a small business?

ISO 27001 and SOC 2 become relevant when a large enterprise customer requires you to demonstrate your security posture through a formal audit or certification as a condition of doing business. For a small business with a general consumer or small business customer base, neither framework is your starting point — both are expensive, time-consuming, and primarily useful as signals to sophisticated buyers.

Build to CIS IG1 first. If a customer relationship eventually requires ISO 27001 or SOC 2, the foundation built from IG1 will significantly reduce the cost and time of that certification engagement.

How Much Does Implementing CIS IG1 Cost?

Most of the 56 IG1 safeguards don’t require purchasing new tools — they require configuring what you already have, documenting what you do, and building habits.

What you probably already have:

Windows Defender satisfies the IG1 anti-malware requirement for Windows environments. macOS built-in security (XProtect, Gatekeeper) satisfies it for Mac environments. Your operating system’s built-in disk encryption (BitLocker, FileVault) satisfies the data encryption requirement. Your firewall router likely already provides the network protection IG1 requires, if it’s kept updated. Your cloud providers (Microsoft 365, Google Workspace) already have logging capabilities that satisfy much of the IG1 log management requirement.

What you may need to add:

A password manager for the whole organisation: $3–$8 per user per month (Bitwarden Business, 1Password Teams, Dashlane for Business). This supports Controls 5 and 6 and is the most consistently ROI-positive security investment a small business can make.

DNS filtering: Cloudflare Gateway’s basic filtering is free for organisations of any size. Cisco Umbrella starts at approximately $2.50 per user per month for SMB tiers. This satisfies Control 9’s DNS filtering requirement.

Security awareness training platform (optional): many providers offer free tiers or free tools sufficient for IG1. KnowBe4’s free tools, CISA’s free awareness materials, and Proofpoint’s free phishing simulation tools cover the training content requirements without a platform subscription.

Cloud backup with isolation: most cloud backup services cost $2–$10 per device per month. Many organisations use Microsoft 365 or Google Workspace backup add-ons ($3–$5/user/month) plus a separate object storage backup for critical files.

Rough total for a 10-person business:

Direct tool costs: $100–$200/month ($1,200–$2,400 per year) covering password manager, DNS filtering, and cloud backup.

Initial setup and documentation time: 40–80 hours of internal staff time, or equivalent engagement with an IT provider. If outsourced, $3,000–$8,000 for initial IG1 implementation assistance depending on your environment and provider rates.

Ongoing maintenance: 2–4 hours per month of staff time for patch management, backup verification, and log review.

IG1 is deliberately designed to be achievable by a small business without a security team. The time and cost requirements are real but manageable.

The Tennessee Exception: CIS Controls as a Legal Defence

One unusual aspect of the CIS Controls framework worth knowing: Tennessee’s Information Protection Act (TIPA), which took effect July 1, 2025, includes a specific affirmative defence for businesses that maintain a written security programme that aligns with the NIST Cybersecurity Framework or an equivalent framework. The CIS Controls are widely considered an equivalent framework for this purpose.

This is currently unique to Tennessee, but it points to a broader direction in US privacy and cybersecurity law. Several state attorneys general and federal regulators (including the FTC) look favourably on documented security programmes aligned with recognised frameworks when assessing whether a business met a reasonable security standard after an incident. Implementing CIS Controls and documenting your programme is not just a security measure — it’s evidence of due care.

Final Verdict

The CIS Controls framework is the most practical starting point for small business cybersecurity because it tells you exactly what to do, in what order, at a level of specificity that most other frameworks deliberately avoid.

For a small business with limited IT resources, IG1 is the target: 56 safeguards across 15 controls that address the most common attack vectors against organisations at your scale. The four-phase implementation sequence above gets you to full IG1 compliance in roughly six months without requiring a dedicated security team.

The three most important things to start this week: enable MFA on every account that allows it, starting with email and cloud services; inventory every user account and disable any that belong to former employees or are no longer needed; and verify that automated backups are running and that you can actually restore from them.

Those three actions address the controls responsible for the majority of successful attacks against small businesses. Everything else builds from there.

Frequently Asked Questions

What is CIS Controls v8.1 and how is it different from v8?

CIS Controls v8.1 was released on June 25, 2024. It is a refinement of v8 (released 2021) rather than a major revision — the framework still has 18 controls and 153 safeguards. The main changes are alignment with NIST CSF 2.0 (including support for the new “Govern” security function), new governance-focused safeguards that emphasise written policies and documentation as formal security controls, a new “Documentation” asset type, and clarified terminology. For small businesses, the most practical change is the added emphasis on written policies and documented processes — v8.1 makes clear that documentation is not optional.

What is CIS IG1 and is it really enough for a small business?

IG1 (Implementation Group 1) contains 56 of the 153 CIS safeguards and is specifically designed for organisations with limited IT and cybersecurity resources. It covers “essential cyber hygiene” — the baseline set of controls that address the most common attack vectors at any scale. For most small businesses, IG1 is an appropriate and achievable target. That said, “enough” depends on your threat profile and regulatory obligations. A healthcare practice subject to HIPAA or a financial services firm subject to state financial regulations may need to implement additional controls beyond IG1 to meet sector-specific requirements.

How long does it take to implement all 56 IG1 safeguards?

The four-phase implementation sequence in this guide is designed to be completed in approximately six months for a small business with 10–50 employees and basic cloud and on-premises infrastructure. Some safeguards (enabling MFA, running a backup test) can be done in an afternoon. Others (building a training programme, writing an incident response plan) take more sustained effort. The biggest variable is whether you have internal staff time available or need to engage an IT provider.

Does implementing CIS Controls satisfy HIPAA, PCI-DSS, or other compliance requirements?

CIS Controls are a cybersecurity framework, not a compliance programme. Implementing IG1 addresses many of the technical controls required by HIPAA’s Security Rule, PCI-DSS’s technical requirements, and various state data security laws — but it doesn’t satisfy all requirements, and it doesn’t demonstrate compliance in the way that a formal audit or assessment does. Many regulated businesses use CIS Controls as their implementation framework while mapping it to their specific regulatory requirements. If you have mandatory compliance obligations, work with a compliance professional to confirm how CIS Controls implementation maps to those specific requirements.

Is there a free version of the CIS Controls documentation?

Yes. CIS makes the full CIS Controls v8.1 documentation, the IG1 Implementation Guide for SMEs, and supporting spreadsheets available as free downloads from their website after a brief registration. The official documentation is the definitive source for safeguard descriptions and IG assignments.

This article provides general educational information about the CIS Critical Security Controls framework and does not constitute legal, compliance, or professional cybersecurity advice. Implementation requirements will vary based on your organisation’s specific environment, risk profile, and regulatory obligations. For US government cybersecurity guidance for small businesses, see CISA’s Small Business Cybersecurity Resources.

Related reading on SmallBiz Defense:

• NIST Cybersecurity Framework for Small Business: Simplified Guide (2026)
• How to Prepare for a Cyber Insurance Audit: SMB Checklist (2026)
• Best Antivirus for Small Business (2026)
• Business Password Manager Comparison: 1Password vs Dashlane vs Bitwarden (2026)