Security Controls: The CIS Controls

Security controls are measures or safeguards implemented to protect an organization's information assets — its systems, data, equipment, facilities, people, and processes — from harm, danger, or malicious activity. Before examining the CIS Controls specifically, it is useful to review the general vocabulary used to classify controls, since this vocabulary recurs throughout the CIS Controls framework.

These control functions can overlap. For example, a data backup could reasonably be classified as both a recovery control (it restores lost data) and a preventative control (it prevents permanent data loss). Rather than trying to force every control into a single, rigid function, treat these categories as descriptive labels that can apply in combination.

The CIS Controls are a comprehensive set of security controls promoted by the Center for Internet Security (CIS) that organizations use to secure their information assets — systems, data, and more. The CIS Controls are one of two components of the CIS Best Security Practices; the other component is the CIS Benchmarks (covered later in this document).