A 40-person company with no security team adopts CIS Controls v8.1 — what are Implementation Groups, and why start with IG1?

## The problem Implementation Groups solve The **CIS Critical Security Controls v8.1** contain **153 Safeguards** across 18 Controls. A small company cannot implement all of them at once, and a list of 153 items gives no hint which matter most. **Implementation Groups (IGs)** are CIS's answer: its recommended guidance for prioritizing implementation. CIS divides them into three groups based on the **risk profile** and the **resources** an enterprise has available. ## The three groups | Group | What CIS says | Relationship | |---|---|---| | **IG1** | Essential cyber hygiene: the foundational set of cyber defense Safeguards every enterprise should apply to guard against the most common attacks | Starting point for everyone | | **IG2** | Builds upon IG1 | IG1 plus additional Safeguards | | **IG3** | Comprises all the Controls and Safeguards | The complete set | Three properties follow from those definitions: - The groups are **cumulative**. An organization at IG2 has done IG1; IG3 includes everything. - The groups are **not tied to company size alone**. Risk profile matters: a small firm holding very sensitive data may need more than IG1. - Controls do **not** contribute equally to every group. Each IG identifies the Safeguards it needs, and CIS tabulates how many Safeguards of each Control apply to each IG. ## Applying it to a 40-person company The company has no security team, a handful of laptops, some cloud services and perhaps a few servers. The reasoning for IG1: 1. **CIS's own instruction** - every enterprise should start with IG1. 2. **Threat fit** - IG1 targets the most common attacks, which is what a small company actually faces. 3. **Resource fit** - IG1 is the foundational set CIS expects every enterprise to apply, whatever its resources. 4. **Foundation for later work** - IG2 and IG3 build on IG1, so nothing done now is wasted. A practical IG1 programme for this company would focus on: - an inventory of devices and software, so unmanaged assets are found (Controls 1 and 2); - a secure configuration standard for laptops and servers (Control 4); - account and access management, including removing unused accounts (Controls 5 and 6); - patching known vulnerabilities (Control 7); - backups that can actually restore data (Control 11); - basic security awareness training (Control 14). ## When to move up Moving to **IG2** is a risk decision, not a calendar milestone. Signals include: - the company starts handling more sensitive data, or customers demand stronger assurance; - it hires IT or security staff who can operate more technical Safeguards; - its environment grows in complexity (more networks, more custom software). **IG3** is for organizations whose risk profile calls for the complete set of Controls and Safeguards. ## Tracking progress Implementation Groups also give the company a simple way to report progress. For each IG1 Safeguard it records an owner, a status (implemented, partial, not started) and the evidence that shows it working, such as an inventory export or a restore test. Leadership then sees a single, honest measure - how much of essential cyber hygiene is actually in place - instead of a list of tools bought. When the IG1 list is substantially complete, the same format extends naturally to the additional Safeguards IG2 brings. Because the groups are cumulative, the IG1 records stay valid and are simply kept current as the company moves up. ## Common mistakes - **Treating IG1 as "basic, therefore optional".** CIS positions it as the minimum every enterprise should apply. - **Skipping to IG3 items** such as advanced testing before IG1 is complete, leaving common attack paths open. - **Treating IGs as maturity levels to be certified.** They are prioritization guidance; CIS does not certify an organization as "IG2". - **Choosing an IG by headcount alone**, ignoring the sensitivity of the data held. A strong answer defines IGs as cumulative prioritization groups based on risk and resources, quotes IG1 as essential cyber hygiene, and justifies IG1 for the small company by both CIS's instruction and the threat and resource fit.