[Day 3] 1. CIS Critical Security Controls

CIS Critical Security Controls (CIS CSCs)

The CIS Critical Security Controls (CIS Controls) are a set of best practices for securing IT systems and data against cyber threats. Created by the Centre for Internet Security (CIS), these controls are designed to be practical and effective guidelines for organisations to reduce cyber risks. The controls are categorised into 18 key areas that cover all aspects of cybersecurity, such as inventory management, data protection, and incident response.

Implementation Groups (IGs)

The CIS Controls are divided into three Implementation Groups (IG1, IG2, IG3) based on the maturity, resources, and risk profile of an organisation. These groups allow organisations to prioritise controls that are most relevant to their specific needs.

IG1 (Basic Cyber Hygiene)

Focus: Fundamental controls for small organisations or those with limited cybersecurity expertise and resources.
Audience: Small businesses, low-risk organisations.
Goal: Protect against common, low-sophistication attacks like phishing or malware.
Examples: Asset inventory, secure configurations, basic access controls.

IG2 (Enhanced Security Measures)

Focus: Builds on IG1 with additional controls for medium-sized organisations that have moderate IT complexity and resources.
Audience: Medium-sized businesses or organisations with higher cybersecurity risks.
Goal: Defend against more sophisticated threats and support regulatory compliance.
Examples: Network monitoring, vulnerability management, incident detection, and response.

IG3 (Advanced Security Controls)

Focus: Comprehensive controls for large organisations or those in high-risk industries (e.g., finance, healthcare, government).
Audience: Enterprises with complex IT systems and robust cybersecurity teams.
Goal: Mitigate advanced persistent threats (APTs) and highly targeted attacks.
Examples: Penetration testing, advanced incident management, and tailored threat intelligence.

Summary

Organisations can implement the CIS Controls progressively, starting with IG1 and moving towards IG3 as their resources and security needs evolve. This tiered approach ensures scalability and relevance for all types of organizations.