1. Start with inventory
You cannot protect what you cannot see. Controls 1–2 (asset and software inventory) come first.
2. Essential hygiene (IG1)
- Secure configuration and account/access management.
- Continuous vulnerability management and patching.
- Malware defenses, backups and audit logging.
- Security-awareness training.
3. It counts elsewhere
CIS maps to NIST CSF, ISO 27001 and PCI DSS, so the work advances multiple goals at once.
How CyberSigma helps
We baseline you against the CIS Controls at the right Implementation Group and turn gaps into a prioritised hygiene programme.
This guide is educational and not legal advice. Requirements evolve — validate specifics against the current standard or regulation for your situation.