CIS Controls, by Implementation Group
The CIS Critical Security Controls are prioritised controls broken into safeguards. Implementation groups tell you which safeguards to tackle first.
CAPA-21Inventory of Enterprise AssetsIn progressCAPA-24Data ProtectionOverdueHow CIS Controls Is Organised in Arbor
CIS Controls loads with its controls, ready to assign and assess.
- 01Inventory of Enterprise Assets
- 02Inventory of Software Assets
- 03Data Protection
- 04Secure Configuration
- 05Account Management
- 06Access Control Management
- 07Vulnerability Management
- 08Audit Log Management
- 09Email and Web Browser Protections
- 10Malware Defences
- 11Data Recovery
- 12Network Infrastructure Management
- 13Network Monitoring and Defence
- 14Security Awareness Training
- 15Service Provider Management
- 16Application Software Security
- 17Incident Response Management
- 18Penetration Testing
What Arbor Does with CIS Controls
- All controls and safeguards loaded
- Progress tracked by implementation group
- Mapped to your other frameworks
No Clause Numbers to Memorise
Arbor AI suggests the CIS Controls requirements that apply as you work.
CIS Controls in Four Steps
Load
CIS Controls loads with its full structure, kept up to date by our team.
Set Scope
Decide what applies and record the reason.
Assess
Assign owners, score each requirement and link evidence.
Prove
Close gaps with corrective actions and report with confidence.
Do the Work Once for CIS Controls
Where controls overlap, shared evidence counts toward related frameworks, so nothing is done twice.
Frequently Asked Questions
Is CIS Controls Kept Up to Date?
Yes. Our team loads CIS Controls and updates it when the standard changes.
Can We Import Our Existing CIS Controls Assessment?
Yes. Use the Excel template and Arbor checks every row before it loads.
Can CIS Controls Share Evidence with Other Frameworks?
Yes. Evidence is uploaded once and linked to every requirement it supports.
See CIS Controls in Arbor GRC
Bring your current risk register. We can import it from Excel during the demo, so you see your own risks in Arbor, not ours.