Confirm CIS Controls applies and what it asks
Who it covers, what it asks for in plain words, and the dates that matter. The regulator has the final say; we read it with you.
Security · Center for Internet Security
CIS Critical Security Controls v8.1
Fully implemented, the Controls defend against roughly 86% of MITRE ATT&CK techniques (CIS CDM v2.0). Our free checks score against IG1.
Rather skip the call? Get a fixed-fee CIS Controls quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry CIS Controls, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Healthcare & DentalFinancial ServicesLaw FirmsAccounting & Tax FirmsAI & Technology CompaniesArchitecture, Engineering & ConstructionRetail & Multi-Location StoresManufacturing & Machine ShopsReal Estate Brokerages & TitleRestaurants, Hotels & HospitalityPrivate Schools & Tutoring
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no CIS Controls package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the CIS Controls-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what CIS Controls expects you to have in place.
- Implementation Group 1 firstThe essential cyber hygiene set that every organization should have, which our free Cyber Hygiene Test scores against.
- Inventory of assets and softwareControls 1 and 2: know what you have, remove what you do not use.
- Data protection and secure configurationControls 3 and 4: classify, encrypt, dispose, and harden by default.
- Account and access managementControls 5 and 6: unique accounts, MFA, least privilege, access removed on exit.
- Vulnerability and log managementControls 7 and 8: patch on a rhythm, log enough to investigate.
- Email, malware, recovery, training, incident responseControls 9, 10, 11, 14 and 17: the ones that decide whether a Tuesday morning click becomes a bad month.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for CIS Controls
The CIS Controls are the most practical list in security: what to do, in what order, sized by implementation group. IG1 is 56 safeguards a 12-person business can reach in a quarter.
We score you against IG1, fix the gaps with your IT provider, and map the same evidence to NIST CSF, HIPAA and the insurance form.
Where are you: tick what you already do
Tick what applies and we show which IG1 safeguards matter most for you.
The steps
Six steps from "does CIS Controls apply to us?" to evidence you can show
The whole CIS Controls journey, short version. We handle every step with you.
Scope it
Which systems, data, people and vendors are in. A clear boundary is a smaller job and a cleaner answer.
With AccuSights: we scope it with you from the intake form and put it in writing.
Run the gap assessment
What you have versus what the rule expects: tooling, configurations, policies and the records that prove each one.
With AccuSights: your engineer tells you how far each control needs to go.
Fix and document
Most gaps are in the policies and workflows nobody wrote down, not the firewall.
With AccuSights: remediation is in-house or with your IT provider, verified in your real environment.
Stay continuously compliant
Controls drift between reviews. Someone has to notice.
- Laptops encryptedPassing
- MFA on every accountPassing
- Backups restored this quarterPassing
- Access reviewed this quarterPassing
With AccuSights: our endpoint agent and monitoring catch the drift and flag it to your engineer.
Report, renew, reuse
The evidence that proves it, filed where the next inspector, auditor or customer can find it, and mapped to the next framework you need.
With AccuSights: evidence keeps collecting itself, so next year is a renewal and not a rerun.
Why AccuSights
Why small teams pick AccuSights for CIS Controls
Most compliance platforms assume you have a security team. We built this for the companies that do not.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Written once, read everywhere
One control set is mapped to every framework you carry, so evidence is produced once and reused.
What it costs
What CIS Controls costs, in plain numbers
Here is what is published, with who published it and when.
$0The Controls themselves. CIS publishes v8.1 and the IG1 safeguards free of charge, and our Cyber Hygiene Test scores against them free.Source: Center for Internet Security, CIS Controls v8.1 (2024)
A fixed feeReadiness and the fixes, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on CIS Controls, in plain words.
Questions
CIS Controls questions we get every week
What is Implementation Group 1?
IG1 is the set of safeguards CIS calls essential cyber hygiene: the minimum every organization should have, written for a small team without security specialists. It covers knowing your devices and software, secure settings, account and access management, backups you can restore, malware defense, training and an incident plan.Source: Center for Internet Security, CIS Controls v8.1
How much of a typical attack do the Controls stop?
CIS modelled it in its Community Defense Model v2.0: IG1 safeguards defend against about 77 percent of the MITRE ATT&CK techniques studied, and the full set of Controls against about 86 percent. That is why our free test and our assessments start from IG1 and then rank what is missing.Source: CIS Community Defense Model v2.0
How do the CIS Controls relate to HIPAA, CMMC or NIST CSF?
They are specific where those are broad. CIS publishes mappings from the Controls to NIST CSF 2.0 and other frameworks, so evidence for a CIS safeguard often answers a HIPAA, NIST SP 800-171 or SOC 2 question too. We keep one control set built on CIS v8.1 and map it to each framework you owe.Source: Center for Internet Security, CIS Controls v8.1
Is the CIS benchmark the same as the CIS Controls?
No. The CIS Controls say what to do across the business. The CIS Benchmarks are detailed secure configuration guides for specific systems, such as Windows, Microsoft 365 or a firewall. The Controls point to the Benchmarks for safeguard 4, secure configuration. We use both when we harden your systems.Source: Center for Internet Security, CIS Benchmarks
Can we get certified against the CIS Controls?
There is no CIS certification for a business. The Controls are a recognized standard of care, and some state laws and insurers point to them. What you can have is an independent assessment that scores you against IG1 or IG2, with evidence, which is what our risk assessment produces.
Do you certify CIS Controls compliance?
No. We do not certify, and the regulator, examiner or independent auditor for CIS Controls has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with CIS Controls?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do CIS Controls separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Security: SOC 2 · NIST CSF 2.0 · ISO 27001 · NIS2 · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for CIS Controls.
Book the demo and see how one control set carries CIS Controls and everything else you owe. Or leave your details and an engineer replies within one business day.