/safeguard-list

description: List applicable CIS Controls v8 safeguards by Implementation Group

> _CIS Controls v8 content used under CC BY-SA 4.0 from the Center for Internet Security. This command's CIS-derived content is CC BY-SA 4.0. See [LICENSE-CIS.md](../LICENSE-CIS.md)._

CIS Controls Safeguard List

Provides comprehensive listing of CIS Controls v8 safeguards organized by Implementation Group (IG1, IG2, IG3).

Arguments

• `$1` - Implementation Group (required: IG1, IG2, or IG3)
• `$2` - Control filter (optional: control number 1-18 or "all")

Safeguard Distribution

| Implementation Group | Total Safeguards | Incremental | Cumulative | |---------------------|------------------|-------------|------------| | **IG1** | 56 | 56 new | 56 total | | **IG2** | 72 additional | 72 new | 128 total | | **IG3** | 25 additional | 25 new | 153 total |

IG1 - Essential Cyber Hygiene (56 Safeguards)

Foundational Controls

These 56 safeguards represent the minimum baseline for cybersecurity. All organizations should implement IG1 regardless of size or industry.

**Controls Introduced at IG1**:

• Control 1: Inventory and Control of Enterprise Assets (5 safeguards)
• Control 2: Inventory and Control of Software Assets (4 safeguards)
• Control 3: Data Protection (3 safeguards)
• Control 4: Secure Configuration (5 safeguards)
• Control 5: Account Management (4 safeguards)
• Control 6: Access Control Management (3 safeguards)
• Control 7: Continuous Vulnerability Management (3 safeguards)
• Control 8: Audit Log Management (5 safeguards)
• Control 9: Email and Web Browser Protections (4 safeguards)
• Control 10: Malware Defenses (2 safeguards)
• Control 11: Data Recovery (4 safeguards)
• Control 14: Security Awareness and Skills Training (3 safeguards)
• Control 15: Service Provider Management (2 safeguards)
• Control 17: Incident Response Management (4 safeguards)

**Key IG1 Safeguards** (High Priority):

**1.1** - Establish and Maintain Detailed Enterprise Asset Inventory

• Track all hardware assets
• Include workstations, servers, network devices, IoT
• Document owner, location, function

**2.1** - Establish and Maintain Software Inventory

• Track all authorized software
• Include applications, operating systems, firmware
• Version tracking and support status

**3.1** - Establish and Maintain Data Management Process

• Data handling procedures
• Classification guidelines
• Retention and disposal

**4.1** - Establish and Maintain Secure Configuration Process

• Configuration baselines
• Hardening standards (CIS Benchmarks)
• Change control

**5.1** - Establish and Maintain Inventory of Accounts

• All user and service accounts
• Privileged account tracking
• Regular review process

**5.3** - Disable Dormant Accounts

• Identify inactive accounts (45-90 days)
• Automated detection
• Disable or delete process

**5.4** - Restrict Administrator Privileges to Dedicated Accounts

• Separate admin and user accounts
• Privileged access management
• Principle of least privilege

**6.1** - Establish Access Granting Process

• Formal access request/approval
• Manager authorization
• Documentation

**6.2** - Establish Access Revoking Process

• Termination procedures
• Role change procedures
• Regular access reviews

**7.1** - Establish and Maintain Vulnerability Management Process

• Scanning schedule
• Prioritization criteria
• Remediation SLAs

**7.3** - Perform Automated Operating System Patch Management

• Automated OS patching
• Critical patches within 30 days
• Regular patch cycles

**8.2** - Collect Audit Logs

• System and application logs
• Authentication events
• Administrative actions

**9.2** - Use DNS Filtering Services

• Block malicious domains
• Threat intelligence feeds
• Real-time protection

**10.1** - Deploy and Maintain Anti-Malware Software

• All endpoints protected
• Real-time scanning
• Centrally managed

**11.2** - Perform Automated Backups

• Automated backup schedule
• Critical data identified
• 3-2-1 backup rule

**11.3** - Protect Recovery Data

• Backup encryption
• Access controls
• Offsite/offline storage

**14.1** - Establish and Maintain Security Awareness Program

• Annual training
• Phishing awareness
• Policy acknowledgment

**17.1** - Designate Personnel to Manage Incident Handling

• Incident response team
• Clear roles and responsibilities
• 24/7 contact information

IG2 - Enterprise Security (Additional 72 Safeguards, 128 Total)

Enterprise-Grade Controls

IG2 adds 72 safeguards for organizations with dedicated IT staff and moderate risk profiles.

**New Controls at IG2**:

• Control 12: Network Infrastructure Management (6 safeguards at IG2)
• Control 13: Network Monitoring and Defense (8 safeguards at IG2)
• Control 16: Application Software Security (10 safeguards at IG2)
• Control 18: Penetration Testing (3 safeguards at IG2)

**Expanded Controls at IG2**:

• Control 2: +2 safeguards (software allowlisting)
• Control 3: +8 safeguards (encryption, classification)
• Control 4: +5 safeguards (DMZ, hardening)
• Control 5: +2 safeguards (MFA, centralized management)
• Control 6: +3 safeguards (RBAC, centralized access)
• Control 7: +3 safeguards (automated scanning, remediation)
• Control 8: +5 safeguards (centralized logs, retention)
• Control 9: +2 safeguards (DMARC, file blocking)
• Control 10: +3 safeguards (centralized AV, anti-exploit)
• Control 11: +1 safeguard (backup testing)
• Control 14: +4 safeguards (advanced training)
• Control 15: +3 safeguards (vendor assessments)
• Control 17: +3 safeguards (IR exercises, playbooks)

**Key IG2 Safeguards** (High Value):

**3.6** - Encrypt Data on End-User Devices

• Full disk encryption (BitLocker, FileVault)
• Mobile device encryption
• Encryption key management

**3.10** - Encrypt Sensitive Data in Transit

• TLS 1.2+ for web traffic
• VPN for remote access
• Email encryption (S/MIME, PGP)

**3.11** - Encrypt Sensitive Data at Rest

• Database encryption
• File/folder encryption
• Cloud storage encry