Updated October 2026: CIS Controls v8.1, released on June 25, 2024, is the current version: 18 Controls and 153 Safeguards, with 56 Safeguards in IG1, 130 in IG2, and all 153 in IG3, plus a new Govern security function aligned with NIST CSF 2.0. Implementation Groups are assigned per Safeguard rather than per Control, so this article now groups the Controls by number instead of by IG. CIS Benchmark recommendations are labeled Automated or Manual, and several cloud tools named in the original version have since been renamed or retired, for example Prisma Cloud (now Cortex Cloud) and Azure Automation State Configuration (retiring in September 2027).

In today’s rapidly evolving cybersecurity landscape, organizations need robust frameworks to protect their digital assets. The Center for Internet Security (CIS) framework has emerged as one of the most practical and widely-adopted cybersecurity standards, offering clear guidance for securing systems and networks. This comprehensive guide explores what the CIS framework is, its key components, and how to effectively implement it in public cloud environments.

What is the CIS Framework?

The Center for Internet Security (CIS) is a nonprofit organization that develops cybersecurity best practices and benchmarks to help organizations protect themselves against cyber threats. Founded in 2000, CIS has become a trusted authority in cybersecurity, working with government agencies, academic institutions, and private sector organizations worldwide.

The CIS framework consists of two primary components:

1. CIS Critical Security Controls (CIS Controls)

A prioritized set of actions designed to protect organizations from the most common cyber attack vectors.

2. CIS Benchmarks

Configuration guidelines for securely setting up systems and software applications.

Understanding the CIS Controls

The CIS Controls represent a defense-in-depth model that prioritizes cybersecurity activities based on their effectiveness against known attack patterns. The current version, v8.1 (June 2024), includes 18 Controls containing 153 Safeguards. Each Safeguard, not each Control, is assigned to an Implementation Group (IG): IG1 (essential cyber hygiene) has 56 Safeguards, IG2 adds 74 (130 in total), and IG3 adds 23 (all 153). IG1 Safeguards appear in 15 of the 18 Controls, so the groupings below follow the Control numbers rather than the IGs:

Controls 1–6

Foundational asset, data, configuration, and access controls; each includes IG1 Safeguards:

Control 1: Inventory and Control of Enterprise Assets

• Maintain accurate, up-to-date inventories of all enterprise assets
• Track authorized and unauthorized devices

Control 2: Inventory and Control of Software Assets

• Maintain software inventories and manage software licensing
• Remove unauthorized software

Control 3: Data Protection

• Identify, classify, and handle data according to protection requirements
• Implement data retention policies

Control 4: Secure Configuration of Enterprise Assets and Software

• Establish secure baseline configurations for all systems
• Use configuration management tools

Control 5: Account Management

• Manage lifecycle of system and application accounts
• Implement principle of least privilege

Control 6: Access Control Management

• Establish access control policies and procedures
• Manage remote access capabilities

Controls 7–12

Operational defenses; each of these Controls also includes IG1 Safeguards:

Control 7: Continuous Vulnerability Management

• Establish continuous vulnerability assessment and remediation processes
• Deploy automated patch management tools

Control 8: Audit Log Management

• Collect, alert, review, and retain audit logs
• Ensure log integrity and availability

Control 9: Email and Web Browser Protections

• Implement security controls for email systems and web browsers
• Deploy anti-malware solutions

Control 10: Malware Defenses

• Deploy anti-malware software and keep signatures updated
• Configure automatic updates

Control 11: Data Recovery

• Establish data backup processes and test recovery capabilities
• Implement business continuity planning

Control 12: Network Infrastructure Management

• Establish network segmentation and access controls
• Deploy network monitoring tools

Controls 13–18

Monitoring, people, suppliers, applications, and testing; Controls 13, 16, and 18 have no IG1 Safeguards and start at IG2:

Control 13: Network Monitoring and Defense

• Deploy network intrusion detection/prevention systems
• Implement security information and event management (SIEM)

Control 14: Security Awareness and Skills Training

• Provide cybersecurity awareness training to all personnel
• Conduct specialized training for security team members

Control 15: Service Provider Management

• Establish security requirements for service providers
• Monitor third-party security posture

Control 16: Application Software Security

• Manage security of in-house developed software
• Implement secure coding practices

Control 17: Incident Response Management

• Establish incident response capabilities
• Conduct regular incident response exercises

Control 18: Penetration Testing

• Conduct regular penetration tests
• Perform red team exercises

CIS Benchmarks: Configuration Standards

CIS Benchmarks provide detailed configuration recommendations for over 100 technologies, including:

• Operating systems (Windows, Linux, macOS)
• Cloud platforms (AWS, Azure, Google Cloud)
• Network devices (Cisco, Juniper)
• Applications (Apache, Microsoft Office, Docker)
• Mobile devices (iOS, Android)

Each benchmark includes:

• Profile Levels: Level 1 (basic security) and Level 2 (enhanced security)
• Assessment Status: Each recommendation is marked Automated or Manual (formerly Scored or Not Scored), with audit steps to verify it
• Remediation Steps: Detailed instructions for implementation

Implementing CIS Framework in Public Cloud

Public cloud environments present unique challenges and opportunities for implementing the CIS framework. Here’s a comprehensive approach to implementation:

Phase 1: Assessment and Planning

1. Cloud Asset Inventory (Control 1 & 2)

• Document all cloud resources across subscriptions/accounts
• Implement cloud asset management tools (AWS Config, Azure Resource Graph, GCP Asset Inventory)
• Create automated discovery processes
• Establish asset tagging standards

2. Risk Assessment

• Evaluate current security posture against CIS Controls
• Identify gaps between current state and desired Implementation Group level
• Prioritize controls based on risk and business impact
• Create implementation roadmap

3. Governance Framework

• Establish cloud security policies aligned with CIS Controls
• Define roles and responsibilities
• Create approval processes for cloud resources
• Implement change management procedures

Phase 2: Foundation Controls Implementation

Secure Configuration Management (Control 4)

AWS Implementation:

• Use AWS Systems Manager for configuration management
• Implement AWS Config rules for compliance monitoring
• Deploy AWS Security Hub for centralized security findings
• Use AWS CloudFormation/CDK for infrastructure as code

Azure Implementation:

• Leverage Azure Policy for governance and compliance
• Use Microsoft Defender for Cloud for security posture management
• Implement Azure Resource Manager templates
• Use Azure Machine Configuration for configuration management (Azure Automation State Configuration retires on September 30, 2027)

Google Cloud Implementation:

• Use Google Cloud Asset Inventory for resource tracking
• Implement Organization Policy Service for governance
• Deploy Security Command Center
• Use Google Cloud Infrastructure Manager for infrastructure automation

Identity and Access Management (Controls 5 & 6)

• Best Practices
  • Implement single sign-on (SSO) with multi-factor authentication
  • Use cloud-native identity providers (AWS IAM, Microsoft Entra ID, Google Cloud Identity)
  • Apply principle of least privilege
  • Regularly review and audit access permissions
  • Implement just-in-time access for privileged operations
  • Use service accounts with minimal permissions for applications

Data Protection (Control 3)

Encryption Implementation:

• Enable encryption at rest for all storage services
• Implement encryption in transit using TLS/SSL
• Use cloud key management services (AWS KMS, Azure Key Vault, Google Cloud KMS)
• Implement data classification and labeling

Data Loss Prevention:

• Deploy cloud-native DLP solutions
• Implement data retention policies
• Monitor data access and movement
• Establish data backup and recovery procedures

Phase 3: Advanced Security Controls

Continuous Monitoring (Controls 7, 8, 13)

Vulnerability Management:

• Deploy vulnerability scanners for cloud workloads
• Implement automated patch management
• Use cloud security scanning tools:
  • Amazon Inspector and GuardDuty
  • Microsoft Defender for Cloud and Sentinel
  • Google Web Security Scanner and Google Security Operations
• Establish vulnerability remediation SLAs

Log Management and SIEM:

• Centralize log collection from all cloud services
• Implement log retention policies
• Deploy cloud-native SIEM solutions:
  • Amazon Security Lake with Amazon Detective
  • Microsoft Sentinel
  • Google Security Operations
• Create automated alerting and response workflows

Network Security (Control 12)

Network Segmentation:

• Implement Virtual Private Clouds (VPCs) with proper subnet design
• Use security groups and network ACLs for micro-segmentation
• Deploy web application firewalls (WAF)
• Implement network flow monitoring

Zero Trust Architecture:

• Implement identity-based access controls
• Use software-defined perimeters
• Deploy endpoint detection and response (EDR) solutions
• Implement conditional access policies

Phase 4: Operational Excellence

Incident Response (Control 17)

• Cloud-Specific Incident Response
  1. Develop cloud incident response playbooks
  2. Implement automated incident detection and alerting
  3. Create forensics capabilities for cloud environments
  4. Establish communication procedures with cloud providers
  5. Conduct regular tabletop exercises

Security Awareness (Control 14)

• Provide cloud-specific security training
• Educate developers on secure coding practices
• Train operations teams on cloud security best practices
• Implement security champions programs

Implementation Tools and Technologies

Cloud-Native Security Services

AWS Security Services:

• AWS Config (compliance monitoring)
• AWS CloudTrail (audit logging)
• Amazon GuardDuty (threat detection)
• AWS Security Hub CSPM (security posture management)
• AWS Systems Manager (patch management)

Azure Security Services:

• Microsoft Defender for Cloud (security posture management)
• Microsoft Sentinel (SIEM/SOAR)
• Azure Policy (governance and compliance)
• Azure Monitor (logging and monitoring)
• Azure Update Manager (patch management)

Google Cloud Security Services:

• Google Security Command Center (security analytics)
• Google Cloud Asset Inventory (asset management)
• Cloud Logging (centralized logging)
• Google Security Operations (security analytics platform)
• Web Security Scanner (vulnerability scanning)

Third-Party Solutions

Configuration Management:

• Terraform with security modules
• Ansible with CIS-hardened playbooks
• Chef/Puppet with compliance cookbooks
• CloudFormation Guard for policy as code

Continuous Compliance:

• Cortex Cloud, formerly Prisma Cloud (comprehensive cloud security)
• Wiz (cloud posture management; Check Point moved its Dome9-based CloudGuard CNAPP customers to Wiz in 2025)
• Qualys VMDR (vulnerability management)
• Rapid7 InsightCloudSec (cloud security)

Best Practices for CIS Implementation in Cloud

1. Start with Implementation Group 1

Begin with basic controls to establish a strong foundation before advancing to more sophisticated security measures.

2. Automate Everything

Leverage Infrastructure as Code (IaC) and automation tools to ensure consistent implementation and reduce human error.

3. Implement Defense in Depth

Don’t rely on a single security control; implement multiple layers of security across your cloud environment.

4. Regular Assessment and Monitoring

Continuously monitor your compliance with CIS Controls and adjust your implementation as needed.

5. Cloud Provider Integration

Take advantage of cloud provider native security services that align with CIS Controls for better integration and cost-effectiveness.

6. Skills Development

Invest in training your team on both CIS frameworks and cloud security best practices.

Measuring Success and Continuous Improvement

Key Performance Indicators (KPIs)

Security Metrics:

• Percentage of assets with known configurations
• Mean time to patch critical vulnerabilities
• Number of security incidents and their resolution time
• Compliance score against CIS Benchmarks

Operational Metrics:

• Automation coverage percentage
• Security control coverage across cloud environments
• Time to deploy security controls
• Cost optimization through security automation

Continuous Improvement Process

1. Regular Assessments: Conduct quarterly CIS Controls assessments
2. Gap Analysis: Identify and prioritize security gaps
3. Technology Updates: Stay current with new CIS Benchmarks and cloud services
4. Threat Intelligence: Incorporate threat intelligence into control prioritization
5. Lessons Learned: Document and share lessons from security incidents

Conclusion

The CIS framework provides a practical, prioritized approach to cybersecurity that translates well to public cloud environments. By implementing CIS Controls and Benchmarks, organizations can significantly improve their security posture while maintaining operational efficiency.

Success in implementing the CIS framework in the cloud requires a systematic approach that combines technology, processes, and people. Start with basic controls, leverage automation, and continuously improve your security posture through regular assessment and adjustment.

Sources

• CIS Critical Security Controls v8.1 – CIS
• CIS Controls Implementation Groups – CIS
• CIS releases CIS Controls v8.1 with new governance recommendations – CIS press release
• Changes to CIS Benchmark assessment/recommendation scoring – CIS
• Azure Automation State Configuration overview – Microsoft Learn
• Palo Alto Networks introduces Cortex Cloud – press release

Last reviewed: October 2026.