CIS IG1 explained: the 56 safeguards a small firm starts with

What is CIS IG1 (Implementation Group 1)?

Implementation Group 1 (IG1) is the first of three tiers in the CIS Critical Security Controls, and it is the tier CIS says every organization should start with. The Center for Internet Security describes IG1 as "a foundational set of 56 cyber defense Safeguards" and defines it as essential cyber hygiene in both version 8 and version 8.1 of the Controls.

CIS built IG1 for firms that look like most professional practices: small to midsize, with limited in-house IT and security expertise, low tolerance for downtime, and data that is mostly employee and financial information. The safeguards are meant to be achievable with off-the-shelf hardware and software and without a dedicated security team. CIS's guide to the Implementation Groups states that IG1 "represents a minimum standard of information security" and that "Every enterprise should begin with IG1." IG2 and IG3 add safeguards on top of IG1 for firms with more complex environments or more sensitive data.

Why should a managing partner or COO care about IG1?

Because regulators and courts need a yardstick for "reasonable security," and the CIS Controls are one of the few public, specific ones. California's data security statute, Civil Code section 1798.81.5, requires businesses that own, license or maintain personal information about California residents to maintain reasonable security procedures and practices, but it does not define the term.

California's Attorney General filled part of that gap. In its February 2016 data breach report, the office recommended that organizations "Adopt the Center for Internet Security's Critical Security Controls as the start of a comprehensive information security program, since not doing so would be indicative of a failure to provide reasonable security." That report predates version 8 and the Implementation Groups, but IG1 is now how CIS defines the starting point. For a firm in Los Angeles or Orange County that holds client Social Security numbers, account numbers or tax data, IG1 is a defensible, documented baseline to point to after an incident, in front of a cyber insurer, or when a client's due diligence questionnaire arrives.

IG1 is also a useful translation layer. Its safeguards overlap with much of what the FTC Safeguards Rule, Regulation S-P and the IRS's written information security plan expectations ask for in practice, such as access controls, MFA, encryption, vendor oversight and incident response. A firm working through IG1 is building evidence it can reuse for each of them.

What do the 56 IG1 safeguards actually cover?

They cover the basics that stop most common, non-targeted attacks, grouped across 15 of the 18 CIS Controls. Network monitoring (Control 13), application software security (Control 16) and penetration testing (Control 18) have no IG1 safeguards. Here is how the 56 break down:

• Know what you have (5 safeguards): an inventory of enterprise assets, a process for unauthorized assets, a software inventory, confirmation that authorized software is still supported, and a process for unauthorized software (Controls 1 and 2).
• Protect the data itself (6): a data management process, a data inventory, access permissions, retention, secure disposal, and encryption on laptops and other end-user devices (Control 3).
• Configure securely (7): a secure configuration process for computers and network gear, automatic screen locking, firewalls on servers and end-user devices, secure administration, and handling of default accounts (Control 4).
• Control accounts and access (9): an account inventory, unique passwords, disabling dormant accounts, separate admin accounts, documented processes for granting and revoking access, and MFA (Controls 5 and 6).
• Patch and maintain (5): a vulnerability management process, a remediation process, automated operating system and application patching, and keeping network infrastructure up to date (Controls 7 and 12).
• Log, filter and defend (8): audit log collection and storage, supported browsers and email clients, DNS filtering, and anti-malware that updates itself (Controls 8, 9 and 10).
• Recover (4): a data recovery process, automated backups, protected backups, and an isolated copy of recovery data (Control 11).
• Train people (8): a security awareness program covering phishing and social engineering, authentication, data handling, accidental exposure, incident reporting, missed updates and insecure networks (Control 14).
• Manage vendors and incidents (4): an inventory of service providers, a named incident handler with a backup, current incident contact information, and a workforce reporting process (Controls 15 and 17).

Which IG1 safeguards carry the most weight?

MFA, patching and backups, because those three close the doors most attackers walk through. Control 6 requires MFA for all externally exposed applications where supported, for remote network access, and for all administrative accounts, including those "managed on-site or through a service provider."

Control 7 requires automated patching of operating systems and applications "on a monthly, or more frequent, basis." Control 11 requires automated backups, protection of that recovery data, and an isolated instance of it, which is the copy that survives when ransomware encrypts everything it can reach.

The asset inventory in Control 1 is less exciting but sits underneath all of it. Safeguard 1.1 asks for an inventory of every device that can store or process data, including mobile devices, network gear and cloud assets, reviewed "bi-annually, or more frequently." A firm cannot patch, encrypt or back up a laptop it does not know exists.

Does IG1 address the people and process side?

Yes. Eight of the 56 safeguards are training topics in Control 14, and three are incident response basics in Control 17. Safeguard 17.1 asks the firm to designate one person to manage incident handling, plus at least one backup. If a service provider does the hands-on work, CIS expects someone inside the firm to oversee it.

That point matters for firms that outsource IT. IG1 asks the firm to know who is accountable, how staff report a suspicious email, and who gets called (insurer, outside counsel, regulators) when something goes wrong.

How should a small firm work through IG1 this quarter?

Start by measuring, then fix the highest-impact gaps first. A practical sequence:

• Build or refresh the hardware and software inventories, and flag anything unsupported or unknown.
• Confirm MFA on email, remote access, every cloud application that holds client data, and every admin account.
• Verify that operating system and application patches deploy automatically each month, and check the report.
• Test a restore from backup, and confirm one backup copy is isolated from the network and from normal admin credentials.
• Turn on full-disk encryption and automatic screen lock on every laptop.
• Name the incident handler and a backup, write down the contact list, and tell staff how to report a problem.
• Schedule awareness training with a phishing simulation, and list every vendor that touches client data.
• Record which of the 56 safeguards are in place, partial or missing, and set dates for the gaps.

The record in that last step is what turns IG1 from a checklist into evidence. When an insurer, a client or an examiner asks how the firm protects data, a dated assessment against a public standard is a far stronger answer than a description of the tools you own.

How does s90 help?

s90 runs IG1 assessments for professional firms in Los Angeles and Orange County, maps the results to the regulations each firm answers to, and closes the gaps as part of ongoing managed IT. If you would like a clear view of where your firm stands against the 56 safeguards, we are happy to walk through it with you.