Explained
HIPAA Technical Safeguards Explained for IT Teams
HIPAA technical safeguards are the 5 standards in 45 CFR 164.312. What each one requires, required vs addressable, and the device settings that meet it.
Explained
What Is CIS Compliance? Controls, Benchmarks and Proof
What is CIS compliance? There is no CIS certificate for companies. What it means for the CIS Controls and Benchmarks, and how to assess and show it.
- Written by
Atena LadchartabiContent writer, trio.so
- Published on
- Modified on
CIS compliance usually means one of two things. Either your organization has put the CIS Controls in place up to a chosen Implementation Group, or your systems are configured to a CIS Benchmark at Level 1 or Level 2. Often it means both. There is no official CIS certification for organizations: CIS certifies vendor products against its Benchmarks, but it does not issue a certificate that says a company is CIS compliant.
You show CIS compliance with evidence instead, such as a self-assessment against the Safeguards, configuration scan reports and records from the tools that enforce your settings. This guide covers both meanings, how a CIS Controls assessment works, the state laws that reward a CIS-based program, and which parts software can take over.
TL;DR
In short
- No organization can be CIS certified. CIS certifies products that check Benchmarks and, with CREST, accredits firms that assess the Controls.
- Controls compliance means implementing the Safeguards of an Implementation Group. In CIS Controls v8.1, IG1 has 56 Safeguards, IG2 130 and IG3 all 153.
- Benchmark compliance means your systems match a CIS Benchmark profile, Level 1 or Level 2, with documented exceptions.
- Assess the Controls with CIS CSAT and Benchmarks with CIS-CAT, and keep the evidence behind every answer.
- Ohio, Utah, Iowa, Connecticut and Texas give some legal protection in breach lawsuits to companies whose written security program follows a framework such as the CIS Controls.
Is There a CIS Certification?
Not for organizations. CIS publishes the Controls and the Benchmarks as voluntary guidance, and its own mapping and compliance pages make no certification claims for companies (CIS). What CIS does run is aimed at products and service providers:
| Program | Who it is for | What it confirms |
|---|---|---|
| CIS Benchmarks certification | Software vendors | The product can accurately assess, configure or remediate against a specific Benchmark. Renewed every year, and new Benchmark versions must be supported within 90 days. |
| CIS Controls Accreditation (with CREST) | Consulting and assessment firms | The firm is accredited to deliver CIS Controls implementation, audit or assessment services. |
| CIS SecureSuite membership | Organizations and vendors | Access to CIS-CAT Pro, Build Kits and other Benchmark formats, plus commercial-use rights. It is a subscription, not a certificate. |
So a vendor that calls its scanner CIS certified is talking about the scanner (CIS product certification). A customer who asks whether you are CIS compliant wants to know what you have implemented and what you can show for it.
What People Mean by CIS Compliance
CIS publishes two different things, and "CIS compliance" can refer to either.
| CIS Controls compliance | CIS Benchmark compliance | |
|---|---|---|
| Question it answers | Are we running the security practices CIS prioritizes? | Are our systems configured the way CIS recommends? |
| Unit | Safeguard (153 in v8.1) | Recommendation in the Benchmark for one product version |
| Tiers | Implementation Groups IG1, IG2, IG3 | Profiles Level 1, Level 2 (STIG on some) |
| Typical evidence | Self-assessment scores, policies, records, tool reports | Scan reports, device settings reports, an exceptions register |
| CIS tool | CSAT (Controls Self Assessment Tool) | CIS-CAT Lite or Pro |
When a questionnaire asks about CIS, check which one it means and answer that. "CIS Level 1" is a Benchmark profile; "IG1" is a set of Controls Safeguards.
CIS Controls Compliance: Implementation Groups
The current version is CIS Controls v8.1, released in June 2024, with a minor document revision (v8.1.2) in March 2025. It has 18 Controls and 153 Safeguards, and v8.1 added a Govern security function to line up with NIST CSF 2.0 (CIS Controls v8.1). Each Safeguard is tagged with the Implementation Groups it belongs to, and the groups are cumulative:
- IG1: 56 Safeguards. CIS calls this essential cyber hygiene and says every enterprise should apply it. It suits small teams with limited IT expertise and mostly employee and financial data.
- IG2: 130 Safeguards (IG1 plus 74). For organizations with staff who manage IT, several departments with different risks, and sensitive or regulated data.
- IG3: all 153. For organizations with security specialists whose assets and data are under regulatory oversight.
Controls 13, 16 and 18 (network monitoring, application software security and penetration testing) have no IG1 Safeguards. Several IG1 Safeguards live on laptops and phones: 1.1 keeps an asset inventory, 3.6 encrypts data on end-user devices, 4.3 locks idle sessions (after no more than 15 minutes on computers and 2 minutes on mobile devices), and 7.3 patches operating systems automatically, at least monthly. The CIS Controls guide lists all 18 Controls.
CIS Benchmark Compliance: Configuration Levels
Benchmark compliance is narrower. It means a system matches a CIS Benchmark for its exact product version, at Level 1 or Level 2, with any deviations written down. Level 2 includes everything in Level 1. You measure it per device with a scan, so the result is a score per Benchmark rather than a yes or no for the company. Our guide to CIS Benchmarks covers the levels, the current device Benchmarks and how to apply one.
How to Show CIS Compliance: The CIS Controls Assessment
An assessment turns "we follow CIS" into something a customer, insurer or auditor can check. A workable sequence:
- Set the scope and the target Implementation Group. Start with IG1, which CIS says every enterprise should apply.
- Score each Safeguard in CIS CSAT, the free web-based Controls Self Assessment Tool. For every Safeguard it records whether you have a policy, how far it is implemented, automated and reported, and the evidence you upload, and it lets you assign users to Safeguards (CIS).
- Use the CIS Controls Assessment Specification to decide what to measure for each Safeguard (CIS). It gives inputs, measures and metrics, so two people scoring the same Safeguard reach the same answer.
- Scan configurations against the Benchmarks in your baseline with CIS-CAT or another assessment tool.
- Collect the evidence, and bring in an independent assessor if a customer or insurer wants one.
- Reassess on a schedule, and after big changes such as a new OS release or a new office.
| Safeguard area | Evidence to keep |
|---|---|
| Asset inventory (1.1) | Device inventory export with owner, OS version and last check-in |
| Software inventory (2.1) | Installed software list and your approved software list |
| Device encryption (3.6) | Encryption status for each laptop and phone |
| Secure configuration (4.1) | Baseline per platform, exceptions register, scan reports |
| Session locking (4.3) | Passcode and screen-lock policy settings |
| OS patching (7.3) | OS update status per device |
| Accounts and MFA (5, 6) | Account list, MFA settings from your identity provider |
| Training and incidents (14, 17) | Training records, incident contacts and process |
If you need to justify why you stopped at a Safeguard or an IG, CIS RAM, the free CIS Risk Assessment Method, gives you a structured way to define acceptable risk.
Who Asks for CIS Compliance
Customer security questionnaires often ask about CIS. So do cyber insurers: in November 2025 CIS and CyberAcuView launched Control Assist, which maps IG1 to common underwriting questions for small businesses (CIS).
Several US states also give some legal protection in data breach lawsuits to businesses whose written security program follows a recognized framework, and the CIS Controls are on each list (CIS):
| State | Law | What it gives | In force |
|---|---|---|---|
| Ohio | Data Protection Act (R.C. 1354) | Affirmative defense to tort claims after a data breach | November 2018 |
| Utah | Cybersecurity Affirmative Defense Act | Affirmative defense in breach lawsuits | May 2021 |
| Connecticut | Public Act 21-119 | No punitive damages in breach tort cases | October 2021 |
| Iowa | Code chapter 554G | Affirmative defense to tort claims | July 2023 |
| Texas | SB 2610 | No exemplary damages for businesses under 250 employees with a qualifying program; names CIS IG1 for businesses with 20 to 99 employees | September 2025 |
These laws offer a defense or a limit on damages, not immunity, and only for claims under that state's law (Ohio, Texas). The program has to be written down and kept current: Iowa, for example, expects it to follow a revised framework within one year of the revision. This is not legal advice; ask counsel how the law in your state applies.
How CIS Maps to Other Frameworks
CIS publishes mappings from CIS Controls v8.1 to NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 (Rev. 2 and Rev. 3), PCI DSS v4.0, HIPAA and ISO/IEC 27001:2022 (CIS mappings). They show where one piece of work counts toward several frameworks. A mapping does not replace the other framework's own requirements or audit. If you are weighing CIS against NIST, see NIST vs CIS; for ISO, the ISO 27001 checklist.
CIS Compliance Software: What It Automates and What Stays With Your Team
CIS compliance software is a loose label. It helps to sort tools by the job they do: configuration assessment (CIS-CAT and scanners certified for Benchmark assessment), device management (enforcing and reporting device settings), assessment and GRC platforms (tracking Safeguards and evidence), and the tools behind specific Controls, such as log management, backup and malware protection.
| Area | Software can | Your team owns |
|---|---|---|
| Inventory | Find enrolled devices and installed apps, and export the lists | Deciding what is authorized and what to do about unknown devices |
| Secure configuration | Enforce settings by policy and check devices against Level 1 or Level 2 templates | Choosing the profile for each device group and accepting exceptions |
| Encryption and patching | Enforce disk encryption and OS updates, and report status per device | How long updates may be deferred, and what to do with devices that can't update |
| Assessment | Track Safeguard status, store evidence and schedule reviews | Scoring honestly and choosing the Implementation Group |
| Configuration scans | Scan systems against Benchmarks and produce reports | Reading the results and deciding what to fix first |
| People and process | Deliver training, track completions, store plans and contracts | Training content, vendor decisions, running an incident |
A green dashboard shows that settings match a template. It doesn't show that you picked the right Implementation Group, that your exceptions are justified, or that people know what to do in an incident.
More CIS guides for IT teams
Where trio.so Fits
trio.so is device management software. On Windows, Mac, iOS and Android, from one console, it enforces and reports the device settings behind several CIS Safeguards:
- Device inventory: hardware and software details for every enrolled device, which supports Controls 1 and 2.
- App allow and block lists, so unapproved software stays off company devices (Control 2).
- Encryption: BitLocker on Windows and FileVault on Mac, with FileVault recovery key escrow, plus encryption on iOS and Android phones, with encryption status shown per device (Safeguard 3.6).
- Passcode and screen-lock policies, including inactivity locking (Safeguard 4.3).
- OS update management on Windows, macOS, iOS and Android (Safeguard 7.3).
- Lock for lost Macs, iPhones and Android devices, and wipe for company-owned devices (Safeguard 4.11).
- A compliance engine that includes CIS Level 1 and Level 2 templates that check device settings, and evidence you can export for an assessor or a customer questionnaire.
trio.so does not make you CIS compliant, and CIS does not certify organizations. Your team still owns the decisions: which profile fits each device group, which exceptions you accept, and the Controls that live outside devices, such as training, service providers, incident response and penetration testing. Learn more about compliance automation.
Plans start at $5 per device.
14-day free trial. No credit card required.
More CIS guides: the CIS Controls v8.1 guide, what CIS Benchmarks are and how to apply them, and NIST vs CIS. For the evidence side, see continuous compliance monitoring.
Sources. Last reviewed October 2026. This article is guidance, not legal or audit advice. CIS Controls® and CIS Benchmarks™ are marks of the Center for Internet Security, Inc.; trio.so is not affiliated with or endorsed by CIS. Safeguard titles are paraphrased.
- CIS Controls v8.1
- Mapping and compliance with the CIS Controls
- CIS Benchmark Assessment certification for product vendors
- CIS CSAT, the CIS Controls Self Assessment Tool
- CIS Controls Assessment Specification
- Laws, regulations and other endorsements of the CIS Controls
- Ohio Revised Code 1354.03
- Texas SB 2610 (89th Legislature), enrolled text
- CIS and CyberAcuView: Control Assist for SMB cyber insurance (Nov 2025)
- CIS Benchmarks, Center for Internet Security
Start your free trial
No credit card required
Full access to all features
Get Ahead of the Curve
Every organization today needs a solution to automate time-consuming tasks and strengthen security. Without the right tools, manual processes drain resources and leave gaps in protection. trio.so is designed to solve this problem, automating key tasks, boosting security, and ensuring compliance with ease.
Don't let inefficiencies hold you back.
Every organization today needs a solution to automate time-consuming tasks and strengthen security. Without the right tools, manual processes drain resources and leave gaps in protection. trio.so is designed to solve this problem, automating key tasks, boosting security, and ensuring compliance with ease.
Frequently Asked Questions (FAQ)
Have questions? We've got answers. This section covers some of the most commonly asked questions related to this topic.
CIS compliance means following guidance from the Center for Internet Security: implementing the CIS Controls up to an Implementation Group, configuring systems to CIS Benchmarks at Level 1 or Level 2, or both. It is self-declared and backed by evidence; there is no official certificate for organizations.
No. CIS certifies vendor products that assess or configure against its Benchmarks, and with CREST it accredits firms that assess the CIS Controls. It does not certify organizations.
Controls compliance is about which security practices you run, measured Safeguard by Safeguard against Implementation Group 1, 2 or 3. Benchmark compliance is about how a specific system is configured, measured by scanning it against a Benchmark's Level 1 or Level 2 profile.
Pick a target Implementation Group, then score each of its Safeguards, for example in CIS's free CSAT tool, using the CIS Controls Assessment Specification as a guide to what to measure. Attach evidence for each Safeguard and repeat the assessment on a schedule.
For most private companies, no; the CIS Controls are voluntary. Ohio, Utah, Iowa, Connecticut and Texas give some legal protection in data breach lawsuits to organizations whose written security program follows a recognized framework such as the CIS Controls, and Texas names CIS IG1 for businesses with 20 to 99 employees.
Software that helps you implement or show CIS guidance: assessment tools such as CIS CSAT and CIS-CAT, device management that enforces and reports device settings, and GRC platforms that track Safeguards and evidence. Decisions such as your Implementation Group and your exceptions stay with your team.
Start with IG1, the 56 Safeguards CIS calls essential cyber hygiene, which CIS says every enterprise should apply. Move to IG2 (130 Safeguards) if you have dedicated IT staff and sensitive or regulated data, and to IG3 (all 153) if you employ security specialists and face regulatory oversight.
Yes. CIS publishes mappings from CIS Controls v8.1 to NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIST SP 800-171, PCI DSS v4.0, HIPAA and ISO/IEC 27001:2022. A mapping shows where the frameworks overlap; it does not replace the other framework's own requirements or audit.
Related
From the blog
The related industry news, interviews, technologies, and resources.
ExplainedHow to Detect Shadow AI in Your OrganizationShadow AI breaches average $4.63M. Here is how to detect shadow AI using DNS logs, OAuth audits, and your endpoint inventory, step by step.
ExplainedDeclarative Device Management: A Complete GuideDeclarative device management is Apple's answer to MDM polling delays and unreliable compliance data — here's how it works and how to start using it.
ExplainedAPNS Certificate: Setup, Renewal, and Best PracticesAn APNS certificate is what lets your MDM platform send commands to iPhones, iPads, and Macs — here's how to create, renew, and protect it.
ExplainedDevice Location History: Android, iPhone, and MDM GuideDevice location history works differently on Android, iPhone, and MDM platforms. Here's what each one actually stores and how to access it.
ExplainedPer-App VPN: How It Works on iOS, macOS, and AndroidUnlike full-device VPN, per-app VPN tunnels only the apps you choose — and without MDM enforcement, users can bypass it entirely on unmanaged devices.
ExplainedRemote Wipe Mac: Methods and Setup Guide for ITA remote wipe on a Mac is only possible if the right tools are in place first — here is how MDM, Find My, and native macOS each handle device erasure.
ExplainedSOC 2 Type 1 vs Type 2: What's the Difference?Compare SOC 2 Type 1 and Type 2 audits. Discover key differences, audit scope, duration, and how to choose for compliance needs.