CIS Controls v8
The CIS Critical Security Controls v8 are a prioritized set of best practices for defending against the most common cyber attacks. Developed by the Center for Internet Security, they provide actionable guidance organized into 18 control groups covering inventory management, access control, data protection, and incident response.
Covered Controls
Controls that have explicit mappings to CIS v8 requirements.
Govern (3 controls)
Identify (5 controls)
Protect (21 controls)
Detect (6 controls)
Respond (5 controls)
Not Covered by CIS v8 (5 controls)
These controls are tracked by ControlMap but do not have explicit CIS v8 mappings. Organizations relying on CIS v8 should consider supplementing with additional frameworks to address these gaps.
CIS v8 vs Other Frameworks
CIS v8 provides 90% coverage of the 49 cybersecurity controls tracked by ControlMap. NIST CSF 2.0 covers 100%, ISO 27001 covers 100%, SOC 2 covers 100%, PCI DSS covers 100%, CMMC covers 94%, 800-53 covers 100%, HIPAA covers 94%, GDPR covers 96%. For maximum coverage, organizations often combine CIS v8 with complementary frameworks to address gaps in areas like supply chain risk, compliance, business environment.