URGENT MESSAGE: Log4j Zero-Day Vulnerability Response| Learn more
Why CIS Solutions Join CIS Resources
CIS WorkBench Sign-in CIS WorkBench Sign In CIS Hardened Images CIS Hardened Images Support CIS Support


Who We Are

CIS is an independent, nonprofit organization with a mission to create confidence in the connected world

About Us Leadership Principles Testimonials


secure your organization
Secure Your Organization

secure specific platforms
Secure Specific Platforms

cis securesuite CIS SecureSuite® Learn More      Apply Now  
u s state local tribal and territorial governments
U.S. State, Local, Tribal & Territorial Governments

View All Products & Services  

Join CIS

Get Involved

Join CIS as a member, partner, or volunteer - or explore our career opportunities

CIS SecureSuite® Membership Multi-State ISAC (MS-ISAC®) Elections Infrastructure ISAC (EI-ISAC®) CIS CyberMarket® Vendors CIS Communities Careers




filter by topic
Filter by Topic

View All Resources  
CIS Logo Show Search Expand Menu

CIS Critical Security Controls Version 8 is Coming Spring 2021


We strive to keep the CIS Critical Security Controls relevant by updating them based on your feedback, evolving technology, and the ever-changing threat landscape. As we saw more organizations move towards cloud services and remote work, we felt it was time to revisit the CIS Controls and supporting Safeguards (which you knew as Sub-Controls in previous versions) to make sure our recommendations still provide an effective cyber defense. The result is CIS Controls Version 8. In CIS Controls v8 you will see updated recommendations for:

  • Cloud-based computing
  • Mobile environments
  • Changing attacker tactics

CIS Controls v8 combines and consolidates the Controls by activities, rather than by who manages the devices. Physical devices, fixed boundaries, and discrete islands of security implementation are less important; this is reflected in v8 through revised terminology and grouping of Safeguards. The result is a decrease of Controls and Safeguards to 18 Controls (from 20) composed of 153 Safeguards (from 171).

Each Safeguard asks for “one thing,” wherever possible, in a way that is clear and requires minimal interpretation. Additionally, each Safeguard is focused on measurable actions, and defines the measurement as part of the process. We know that it’s important for enterprises to keep track of CIS Controls implementation. Towards this end, we will be updating the CIS Controls Self Assessment Tool (CSAT) to support v8. We also realize that many of you will still be on Controls v7.1 so we will support both versions to give you time to migrate to v8.

CIS Controls v8 will be released mid-May of 2021. Please keep coming back to get updates and more information on upcoming webinars, podcasts, and blogs about CIS Controls v8 and supporting tools.