Your safeguard list, imported
CIS Controls is not a bundled template. Bring the safeguard list as a spreadsheet and import it as a framework; each safeguard becomes a control with a status and an owner.
Framework template
CIS Controls
A prioritised set of safeguards for cyber defence. Version 8 has 18 controls and 153 safeguards, grouped into three implementation groups by organisation size and risk.
Center for Internet Security Critical Security Controls
Import from a spreadsheet
In practice
CIS Controls are a benchmark rather than a regulation. Implementation Group 1 is essential cyber hygiene; groups 2 and 3 add safeguards for larger or higher-risk environments. Many organisations use it as the working control set beneath a SOC 2 or ISO 27001 programme.
Requirements
What CIS Controls asks of you.
01
Implementation Group 1
Asset and software inventory, data protection, secure configuration, account management and access control.
02
Implementation Group 2
Email and browser protection, malware defence, data recovery, network infrastructure management and awareness training.
03
Implementation Group 3
Application security, incident response, penetration testing and security service provider management.
How the Desk helps
The CIS Controls programme, run on the Compliance Desk.
Each step below is shipped: the template import in Compliance Studio, and workflows that run over the documents you choose, record their sources and hold for approval before export.
Policies reviewed against the safeguards
Run Review controls over your policies for the imported safeguards. The run records every document it read; a control memo names the safeguards with gaps.
Evidence per safeguard
Evidence is held per safeguard with its status. Find missing evidence and Prepare audit checklist run over the evidence documents you select, exported once approved.
Next step
Start from the CIS Controls template on your own files.
Bring the policies you have and the last audit's request list. We will import the template, run the workflows with you and hand back the controls, the evidence on file and each run's sources.
Security
GDPR and CCPA compliant, ISO 27001 aligned, SOC 2 Type II in progress. Encrypted at rest and in transit. Your data never trains a model.
Security page