CIS Controls v8.1 Complete Program

The CIS Controls tell you which defensive actions stop real attacks and in what order. Implementation Group 1 is the baseline insurers and customers increasingly expect.

This is the whole program. Sixteen policies of 8 to 10 pages, each governance only and tool neutral, with its own CIS Controls v8.1 alignment table, and sixteen companion procedures of 12 to 16 pages that turn each policy into step-by-step technical execution, with configuration tables, placeholders for your tools and screenshots, records, metrics and troubleshooting. The program documents assessors ask for: CIS Controls Implementation Plan, Security Exception Request, Evidence Collection Procedure, and more. A program edition workbook that adds ten program metrics, a quarterly maturity history and a 90-day plan to the three-pillar assessment, roadmap and evidence register.

The worked example is a fully populated program for a fictional organization one quarter in, with honest scores, a roadmap with an overdue initiative, gaps in evidence and a walkthrough explaining what every flag means, so you can see what good looks like before you start.

What is included

1. Program Guide, Implementation Guide and Framework Reference (PDF).

2. Sixteen full policies (8 to 10 pages each) with document control, approval, RACI, numbered statements, organization-defined parameters, metrics and framework alignment (Word).

3. Sixteen companion procedures (12 to 16 pages each) with step-by-step technical instructions, configuration tables, screenshot placeholders, records and evidence, metrics and troubleshooting (Word).

4. Nine program documents: charter, plans, registers and report templates (Word).

5. CIS-Controls-v8-1-Program-Workbook.xlsx, program edition, with metrics, maturity history and the 90-day plan.

6. Example Completed Program: populated workbook and walkthrough (Excel and PDF).

Who it is for

IT managers, security leads, managed service providers and vCISOs at small and mid-sized organizations who want a prioritized, practical security baseline, need to prove CIS Controls implementation to an insurer, customer or auditor, or are working toward Implementation Group 1, 2 or 3.

Formats

16 policies, 16 procedures, 9 program documents.

About the framework text

Cites safeguards by number with our own labels and guidance. Download the official CIS Controls v8.1 free from cisecurity.org and keep it beside the workbook. Not affiliated with or endorsed by the Center for Internet Security.

License

License. Your purchase grants one organization a perpetual, non-exclusive license to use, copy, and modify these materials for its own internal security program, including sharing completed questionnaires and contract exhibits with its own vendors. You may not resell, sublicense, or redistribute the templates themselves, in original or modified form, as a product. Consultants and managed service providers who want to use the materials across multiple client organizations need a practitioner license; contact cyberauctoritas.com.

Disclaimer

This material is provided for general information and internal program building. It is not legal advice and does not certify compliance with any law, regulation, or framework. Contract language must be reviewed by qualified counsel before use. Adapt every document to your organization, your risk tolerance, and your obligations.