CIS Controls (IG1)
In one sentence
A prioritized list of security safeguards; Implementation Group 1 is the 'essential cyber hygiene' set for small organizations.
The CIS Critical Security Controls are a prioritized set of defensive actions. Implementation Group 1 (IG1), 56 safeguards, is defined as essential cyber hygiene for small organizations with limited IT staff, making it the practical remediation menu.
Why it's on your cyber insurance application
Carrier questions trace to these safeguards more directly than to anything else, which is why our Check cites a CIS clause next to each question. Saying you work to IG1, and meaning it, is a credible answer to an underwriter.
What this looks like in practice
If you want a to-do list rather than a philosophy, this is the one to use. Implementation Group 1 is written for organizations with no dedicated security staff, and most of it is configuration rather than purchasing. Working down IG1 covers the large majority of what a cyber application will ask you about.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
- Application-Mapping Guide: Which Document Answers Which Question (preview its opening sections)
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.