The CIS Critical Security Controls are a prioritised set of defensive actions that reduce cyber risk and build measurable security maturity: 153 safeguards across 18 controls, in three Implementation Groups (IGs) that let you scale the work to your size, risk profile and resources.
years testing for government and enterprise
CREST-accredited through CREST ANZ
We perform independent CIS 18 assessments across all three Implementation Groups, using CIS Controls v8.1.
Each assessment shows how well you meet the safeguards, which risks remain, and a practical roadmap for improvement.
The CIS Controls are divided into three Implementation Groups. We assess your organisation against the group you are aiming for, and the result is an evidence-based view of your security posture that supports planning, budgeting and compliance decisions.
56 safeguards that address the most common, non-targeted attacks. Suitable for smaller organisations with limited IT resources.
IG1’s 56 safeguards plus 74 more, covering incident response, data management and security operations.
All 153 safeguards, for defence against sophisticated and targeted attacks.
You can. Several tools scan for CIS compliance, mostly checking technical configuration against the CIS Benchmarks that map to the Controls: CIS’s own CIS-CAT Pro, and commercial vulnerability scanners with CIS Benchmark audit checks. We often use one as part of an assessment.
Scanners are excellent at checking settings, such as whether password complexity is enforced or RDP is disabled. Many CIS safeguards are procedural or human, not technical.
an incident response process (Control 17)
a data recovery process (Control 11)
security awareness training for staff (Control 14)
a process for vetting service providers (Control 15)
A scan can give you a passing grade on technical settings while your organisation stays exposed through missing processes, untrained staff or a lack of oversight. Finding those gaps needs an assessor who understands the Controls and looks at evidence, not just scan output.
Each step builds on the last, from agreeing your target Implementation Group to verified controls and a roadmap to get there.
We start with your security goals: how you identify, prioritise and manage risk, and which IG you are aiming for. Aiming for IG1 is as valid as IG3; it is a business decision. We then set the baseline through evidence reviews, interviews, configuration sampling and technical analysis, in a report you can share with IT, leadership and external stakeholders.
We verify how the in-scope controls operate day to day: configuration consistency, operational processes, evidence of repeatability, and whether controls meet the intent of the safeguards for your target IG. This separates controls that exist on paper from controls that work, and finds configuration drift, manual workarounds and the gaps scanners cannot see.
A prioritised roadmap from your current state to your target IG, shaped by your operational constraints and risk profile. It can cover inventory management, data protection, audit log management and malware defences. We can keep validating progress, advise on control redesign, and support sustained improvement.
Our CIS 18 assessment and uplift services are practical, independent and evidence-driven.
We assess every level, from an IG1 baseline to organisations aiming for IG3, if that is your goal. Our experience covers government, private sector and regulated environments.
We run our own ISO 27001 certified ISMS and SOC and MDR services, and know the Essential Eight and NIST CSF, so we can borrow from them where CIS 18 falls short. We have built and run controls like data recovery and account management in production.
Our recommendations account for technical realities, business priorities and resource constraints, drawing on our system hardening work. The goal is uplift that is sustainable and measurable.
With your requirements and the Implementation Group you are aiming for. There is no need to aim for IG3 for its own sake: the right IG depends on your current maturity, how you manage risk, and your expertise, time and budget. Starting from requirements and risk makes a timely, cost-effective outcome far more likely.
A baseline: evaluating your in-scope environment against the safeguards for your target IG. If you have not done this before, we usually start with the 56 IG1 safeguards for essential cyber hygiene. Once the baseline is done, you have a line in the sand and can prioritise your uplift.
The Essential Eight focuses on eight mitigation strategies, designed for Microsoft Windows-based networks. The CIS Controls are a whole-of-security framework across 18 controls, including data protection, service provider management and penetration testing. CIS publishes a mapping between the two.
Prioritised improvements where safeguards fall short, tailored to make operational and business sense; faster risk reduction across the organisation; and a clear baseline for stakeholders that becomes the reference point for later improvement, supporting planning, budgeting and decisions at every level. More in our post Why ransomware victims pay.
The CIS Controls v8.1 are 18 controls, each with between 5 and 14 safeguards. dotSec can help you understand them and map a time- and cost-effective path to your target Implementation Group.
Contact us to schedule a discovery discussion and begin your CIS 18 uplift.
