CIS Community Defense Model (CDM) v3.0
Published on September 18, 2026
How effective are your cybersecurity defenses against the attacks enterprises face every day?
Data-backed Defense for Today's Most Common Cyber Attacks
The CIS Community Defense Model (CDM) v3.0 uses real-world threat intelligence, breach data, and MITRE ATT&CK® mappings to measure how the CIS Critical Security Controls® (CIS Controls) v8.1 defend against the five most prevalent cyber attack types: System Intrusion, Social Engineering, Basic Web Application Attacks, Privilege Misuse, and Denial of Service (DoS).
New Defender-focused Framework: CIS Controls Active Defense Lifecycle
A new addition in v3 of the CIS CDM is the CIS Controls Active Defense Lifecycle™. This defender-focused capability shows where CIS Safeguards can interrupt attacks across the attack lifecycle, to help enterprises prioritize security investments and strengthen defense-in-depth.
Download CDM v3.0 to Learn:
- Which CIS Safeguards provide the highest security value against today's most common attacks
- How the CIS Controls map to MITRE ATT&CK Enterprise v16.1
- Why essential cyber hygiene (IG1) remains a powerful foundation for cyber defense
- Where attacks can be disrupted using the new Active Defense Lifecycle
- How to prioritize security improvements using real-world attack data
- Key findings from updated threat intelligence and cybersecurity research
Start by downloading the CDM v3.0 White Paper for an overview of the model, its methodology, and key recommendations. If you'd like to explore the underlying data and resources in greater depth, download the CDM v3.0 Resource Package (ZIP).
The ZIP file contains:
- Supporting Excel spreadsheets and mappings
- Controls Defense Lifecycle resources
- ATT&CK mapping data and supporting analysis files
- Additional implementation resources referenced throughout the model
Whether you're building a cybersecurity program, prioritizing safeguards, or validating security investments, CDM v3.0 provides actionable, data-driven guidance to help strengthen your organization's defenses against today's most prevalent threats.
As of June 23, 2025, the MS-ISAC has introduced a fee-based membership. Any potential reference to no-cost MS-ISAC services no longer applies.