A business reaches the size where somebody asks what its security posture is. Sometimes it is a customer's procurement questionnaire, sometimes an insurer, sometimes a director who read something. The request that comes down is almost always the same: give us a checklist.
What comes back from a search is dozens of them, most published by vendors, most ending in a form, and most ordered by what the publisher sells rather than by what stops attacks. Two checklists will contradict each other on what matters first, and neither will say which items are genuinely difficult.
There is no need to write another one. A free, maintained, independently produced checklist already exists, ordered by evidence, and used by organisations far larger than the ones asking. This article does the only part that is missing: mapping it onto what a growing business actually runs, and saying plainly which items are cheap and which are not.
Why the ordering is the valuable part
Every business with a security budget faces the same problem: the list of possible controls is effectively unbounded, and the budget is not. The question is never what could be done. It is what to do first.
This is where most checklists fail. They present twenty items as a flat list, which implicitly claims all twenty matter equally. They do not. A business with no asset inventory and no MFA gains far more from those two than from a penetration test, and the penetration test will mostly tell it that it has no asset inventory and no MFA.
The CIS Controls solve this by grouping 153 safeguards across 18 controls into three Implementation Groups. IG1 is the baseline every organisation should implement. IG2 and IG3 add safeguards for organisations with greater resources and higher risk. The grouping is the product; the list of controls is available anywhere.
The complementary framework, NIST's Cybersecurity Framework, reached version 2.0 in February 2024, and that revision explicitly widened its scope to any organisation regardless of size, sector or maturity — it is no longer positioned as a critical-infrastructure document. Where CIS gives you an ordered list of things to do, CSF gives you a structure for governing and reporting on the programme. Small organisations generally need the first and adopt the second when someone starts asking for evidence.
The 18 controls, and what each means for a business your size
Below is the full v8.1 control list in its published order, with what implementing the IG1 portion actually involves for a business running a mix of cloud services, a few servers, and laptops.
| # | Control | What this means for you | Difficulty |
|---|---|---|---|
| 1 | Inventory and Control of Enterprise Assets | Know every device that connects. Not a spreadsheet from last year — something that detects what is actually on the network. | Medium |
| 2 | Inventory and Control of Software Assets | Know what is installed and remove what nobody uses. Unused software is unpatched software. | Medium |
| 3 | Data Protection | Know what data you hold, where it lives, and how long you keep it. | Hard |
| 4 | Secure Configuration of Enterprise Assets and Software | Change defaults. No default admin passwords, no unnecessary services listening. | Low |
| 5 | Account Management | One account per person, no shared logins, and a record of who has what. | Low |
| 6 | Access Control Management | Grant on joining, revoke on leaving, review periodically. Enforce MFA. | Low to medium |
| 7 | Continuous Vulnerability Management | Patch on a schedule, and know what is unpatched between schedules. | Medium |
| 8 | Audit Log Management | Collect logs somewhere the attacker cannot delete them, and keep them long enough to investigate. | Medium |
| 9 | Email and Web Browser Protections | Filtering, and blocking the file types that carry payloads. | Low |
| 10 | Malware Defenses | Endpoint protection deployed everywhere and actually reporting in. | Low |
| 11 | Data Recovery | Backups that are tested, and at least one copy an attacker with your admin credentials cannot reach. | Medium |
| 12 | Network Infrastructure Management | Keep network devices patched and configured deliberately, not by accretion. | Medium |
| 13 | Network Monitoring and Defense | Know what normal traffic looks like well enough to notice abnormal. | Hard |
| 14 | Security Awareness and Skills Training | People are targeted directly. Training them is a control, not a formality. | Low |
| 15 | Service Provider Management | Your suppliers' access to your systems is your exposure. | Medium |
| 16 | Application Software Security | If you build software, secure the way you build it. | Hard |
| 17 | Incident Response Management | A written plan, and named people, decided before the incident. | Low to medium |
| 18 | Penetration Testing | Verification that the above works. Last, deliberately. | Medium |
The order to actually work in
The controls are numbered, but a business implementing them from nothing gets more from a sequence that front-loads the items which are cheap and which close the routes attackers actually use.
First: the things that are cheap and stop the common cases
- 1
MFA on everything external
Email, VPN, remote desktop, admin consoles, and any SaaS holding customer data. This is the single highest-value item on the list relative to cost, because credential theft is the entry point for a large share of intrusions and MFA breaks it. The choice of factor matters and not all of them are equivalent.
- 2
One account per person
Shared logins destroy every control downstream. You cannot revoke access for a leaver, attribute an action in a log, or apply least privilege to an account three people use.
- 3
Change every default credential
Firewalls, switches, NAS units, printers, cameras, the PBX. Internet-facing scanners try default credentials continuously because it keeps working.
- 4
Get one backup out of reach
Backups reachable with the same admin credentials as production are not backups against ransomware — they are the second thing encrypted. At least one copy must be offline, immutable, or in a separate trust domain.
- 5
Turn on endpoint protection and verify it reports
Deployed and unreporting is the common failure. A console showing 40 of 55 machines checked in means 15 machines are unprotected and nobody knows which.
Second: the things that need a process rather than a purchase
- 1
Asset inventory that maintains itself
A manual inventory is out of date the week it is written. Something has to discover devices automatically, because the asset you did not know about is the one nobody patched.
- 2
A patch schedule with a named owner
Monthly for workstations, defined windows for servers, and an emergency path for advisories that cannot wait. The schedule is less important than the fact that a specific person owns it.
- 3
Joiner, mover and leaver process
Access granted on a start date and revoked on a leaving date, with the revocation covering every system rather than just the email account.
- 4
Centralised logging
Logs on the machine that was compromised are logs the attacker can edit. Ship them somewhere else, and keep them long enough to be useful — intrusions are frequently discovered long after they begin.
- 5
A written incident response plan
Who decides to disconnect, who calls the insurer, who talks to customers, where the offline copy of the plan is. Deciding this during an incident is how the first hours get wasted.
Third: the architectural work
- 1
Segment the network
A flat network means one compromised laptop can reach the finance server, the backup target and the PBX. Segmentation limits how far an intrusion travels.
- 2
Remove standing access where you can
Move from network-position trust to identity-and-device trust. This is a direction of travel rather than a project with an end date.
- 3
Take secrets out of code and config files
Credentials in a repository or a plaintext configuration file are credentials with no expiry and no audit trail.
- 4
Write down what data you hold and for how long
Data you do not hold cannot be stolen. Retention is a security control before it is a compliance one.
The items that are genuinely hard, said plainly
Marked Hard in the table above are three controls, and it is worth being direct about why, because a checklist that presents them as equivalent to changing a default password is misleading.
- Data Protection (3). Knowing what data you hold and where it lives requires discovery across systems that were never designed to report it, and it tends to surface copies nobody knew existed. It is worth doing and it is not a week's work.
- Network Monitoring and Defense (13). Detecting abnormal traffic requires knowing what normal looks like, which requires a baseline period and someone who reads the output. Bought as a product and left unread, it produces cost without detection.
- Application Software Security (16). Only applies if you build software, but if you do, it is a discipline across the whole development process rather than a tool you install.
A reasonable position for a growing business is to complete the low and medium items thoroughly and address these three with staged, honest partial progress. Partial and acknowledged beats a tick-box claim that fails under any examination.
How to use this with a customer questionnaire
If the reason this came up is a procurement questionnaire or an insurance form, one practical note. Answering yes to a control you have not implemented is worse than answering no. Insurance claims are assessed against the answers given, and a customer discovering the gap after an incident is a commercial problem on top of a security one.
Answering with the honest position — implemented, partially implemented with a stated plan and date, or not implemented — is accepted far more often than businesses expect, and it converts the questionnaire into a roadmap rather than a test to pass.
How many cybersecurity controls does a small business actually need?
The CIS Critical Security Controls v8.1 define 153 safeguards across 18 controls, grouped into three Implementation Groups. CIS recommends every enterprise begin with Implementation Group 1, which it describes as essential cyber hygiene. IG1 is the defensible baseline for a small or growing business; IG2 and IG3 add safeguards for organisations with greater resources and higher risk exposure.
What is the single most valuable security control to implement first?
Multi-factor authentication on every externally reachable system — email, VPN, remote access, administrative consoles and any SaaS holding customer data. Credential theft is the entry route for a large share of intrusions, and MFA breaks that route at a cost far below its benefit. The choice of second factor matters, as not all factors resist the same attacks.
Should we get a penetration test?
Eventually, but not first. Penetration testing is the eighteenth control in the CIS list because it verifies that controls already in place work. Commissioning one before implementing asset inventory, account management, patching and endpoint protection produces a report enumerating those absences, at consultancy rates, without fixing any of them.
Is the CIS Controls list free?
Yes. The Center for Internet Security publishes the Critical Security Controls and their Implementation Group mappings at no cost. There is no requirement to buy a framework, and no advantage in a vendor-authored checklist over the published list.
What is the difference between CIS Controls and the NIST Cybersecurity Framework?
They answer different questions. CIS Controls give a prioritised, ordered list of specific safeguards to implement, which is what an organisation starting from nothing needs. The NIST Cybersecurity Framework, at version 2.0 since February 2024, provides a structure for governing, assessing and communicating cybersecurity risk across an organisation. Most businesses implement CIS first and adopt CSF when they need to report on the programme rather than build it.
Sources and further reading
- MFA strategy for business— control 6 — which factors resist which attacks, and why recovery is the hard part
- Access control and offboarding— controls 5 and 6 — joiner, mover and leaver in practice
- Network segmentation for growing businesses— controls 12 and 13 — limiting how far an intrusion travels
- Firewall strategy for growing businesses— control 12, and the configuration discipline behind it
- Secrets management for business systems— controls 3 and 5 — credentials out of code and configuration
- Data retention and archiving for growing businesses— control 3 — data you do not hold cannot be stolen
- Zero trust architecture for growing businesses— the architectural direction behind removing standing access
- Secure remote access architecture— control 6 applied to the external perimeter
- Infrastructure monitoring that works— control 8 — logs somewhere an attacker cannot edit them
- High availability for business systems— control 11 — why a cluster is not a backup
- Endpoint protection: beyond having antivirus— control 10, and why control 1 has to come first
- Security auditing: what the words actually mean— control 18, and the three engagements people confuse it with
- Hardening Cisco network devices— control 12 applied to the switches and routers themselves
- Centralised logging with Loki— control 8 — logs off the machine, before an attacker edits them
- pfSense in a business network— control 12 at the perimeter, on an open-source platform
- An IT roadmap for a growing business— the order to implement these controls in, and what each depends on
- IT for banking and financial services— the same controls where they must also be evidenced
- IT for healthcare providers— controls 6 and 13 where an emergency must never be blocked
- CIS Critical Security Controls— the 18 controls in their published order, currently v8.1
- CIS Implementation Groups— IG1, IG2 and IG3, and why every enterprise should start with IG1
- NIST Cybersecurity Framework— CSF 2.0, released February 2024, applicable to organisations of any size or sector
Services This Relates To
Written by KYCONNECTS Engineering. Client names are withheld under confidentiality.