CIS Controls v8 dropped the count from 20 to 18 in May 2021. Version 8.1 published on 24 June 2024. I opened the 18-control list on 22 August 2026.In v8.1 that work is Control 8. Penetration Testing is Control 18, not 20.
CIS’s own history page says the set began as the SANS Top 20 in 2008, moved to CIS in 2015 with Version 6, gained Implementation Groups in v7.1, then became 18 activity-centered controls in v8. v8.1 is an iterative update: glossary, asset classes, NIST CSF 2.0 function mappings, a Governance function in those mappings. The official IG page still says 153 Safeguards in v8 and v8.1. Pair host config with the Ubuntu guide. Pair inventory of libraries with vulnerable versus malicious dependencies. Pair request data with input validation.
The name is wrong: not Top 20
Call them CIS Controls, or CIS Critical Security Controls, version 8.1. Do not call them CIS Top 20 in a 2026 policy. That name is the v7-era count and the older SANS poster. A questionnaire that still asks “do you perform Control 20, Penetration Tests and Red Team Exercises” is asking the v7.1 number. The current row is Control 18, Penetration Testing. Wireless Access Control, a full v7 control, was folded into other activities. If your tracker still has a Control 15 named wireless, you are on the old list.
Basic, Foundational, and Organizational were the v7 chapter labels. v8 groups by activity and tells you to prioritize with IG1, then IG2, then IG3. Keep the old labels only in a migration note.
| v7.1 number people still cite | v8.1 number to write down |
|---|---|
| 1 Hardware inventory | 1 Enterprise assets |
| 2 Software inventory | 2 Software assets |
| 3 Vulnerability management | 7 Continuous vulnerability management |
| 4 Admin privileges | 5 Accounts, 6 Access control |
| 5 Secure configuration | 4 Secure configuration |
| 6 Audit logs | 8 Audit log management |
| 13 Data protection | 3 Data protection |
| 16 Account monitoring | 5 Account management |
| 18 Application security | 16 Application software security |
| 19 Incident response | 17 Incident response management |
| 20 Pen tests / red team | 18 Penetration testing |
I built that remap from the official v8.1 titles I opened and from the v7.1 names the previous page printed. It is a practitioner cheat sheet, not a CIS-signed crosswalk PDF. Use CIS’s own navigator when you need a line-by-line Safeguard map. If your GRC tool still ships a “CSC 20” catalog, export it and diff the titles before the next audit. The cheapest error is scoring Control 6 as audit logs when your assessor is reading v8.1 and expects Control 8.
v8.1 numbering you can open
These are the 18 titles on the list page I opened, in order:
- Inventory and Control of Enterprise Assets
- Inventory and Control of Software Assets
- Data Protection
- Secure Configuration of Enterprise Assets and Software
- Account Management
- Access Control Management
- Continuous Vulnerability Management
- Audit Log Management
- Email and Web Browser Protections
- Malware Defenses
- Data Recovery
- Network Infrastructure Management
- Network Monitoring and Defense
- Security Awareness and Skills Training
- Service Provider Management
- Application Software Security
- Incident Response Management
- Penetration Testing
Control 1 now includes cloud and IoT in the official blurb, not only a switch closet. Control 15 is Service Provider Management, a v8 addition that v7 did not number this way. Control 16 is the software you write or buy, which is why this site’s checklist sits there, not under Control 18.
Control 3, Data Protection, moved forward in the list. In v7 it was 13. If your data map still lives in a slide named “Foundational 13,” rename it. Control 11 is Data Recovery, the restore you can actually run, not a tape label. Control 9 and 10 are still email, browser, and malware. They did not vanish when the count dropped. The two that left as standalone numbers were the device-role splits and wireless as its own control. Their work sits inside assets, config, and network now.
Safeguards replaced Sub-Controls. Each Safeguard is meant to be one action. Do not invent a “Control 19” in v8.1. There isn’t one.
Start at IG1, not 153 boxes
The Implementation Groups page I opened defines IG1 as essential cyber hygiene, the set every enterprise should apply first. IG2 builds on it. IG3 is all Safeguards. Total count: 153 in both v8 and v8.1. I am not inventing a per-group headcount I did not see on that page. If you need the exact IG1 list, download the v8.1 IG 4-pager from CIS, not a blog table from 2019.
A seven-person shop that tries to close 153 rows will write fiction. IG1 is the honest start: know the assets, know the software, configure what you have, manage accounts, patch, keep logs. That is Controls 1, 2, 4, 5, 7, and 8 in practice, plus the IG1 Safeguards CIS marked under the others. Do not skip 5 so you can buy a Control 18 exercise.
CIS Benchmarks are companion config guides for one OS or one cloud product. They use Level 1 and Level 2. bartman’s March 2026 comment is useful and also the mix-up: he praised v8.1, then described Benchmark levels. Apply a Level 1 Ubuntu Benchmark after you can name the sshd drop-in. Do not score Benchmark Level 2 and claim IG3.
Map three surfaces you can run
A control without an owner and a command is a poster. Identifiers stay app-a, 00-hardening.conf, 00-hardening.rules, deploy.
# cis-ig1-host.sh names only. Run on app-a you admin.
# Control 1 / 2: what is this box, what is installed
hostnamectl
dpkg-query -W -f '${Package}\t${Version}\n' | tee /var/log/cis/software-inventory.txt
# Control 4: secure configuration. See the Ubuntu page for the file body.
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication'
test -f /etc/ssh/sshd_config.d/00-hardening.conf
# Control 5: accounts. root is not a daily login.
getent passwd deploy
sudo sshd -T | grep allowusers
# Control 7: vulnerability window. security pocket on.
systemctl is-enabled unattended-upgrades
apt-get --just-print upgrade
# Control 8: audit log management
sudo systemctl is-active auditd
sudo auditctl -l | grep -E 'sshd_dropin|identity'
Control 4 on a Linux web host is the Ubuntu drop-in, not a 400-page dump you have not read. Control 2 on an app repo is a lockfile and a review of what you import, which is the dependencies page, not only dpkg. Control 16 on a web API is parameterization, object-level auth, and a deny on unexpected operators, which is the checklist and the validation page.
# cis-ig1-app.sh Control 16 owners, in CI, not a slogan
# Fail the build if the escape hatches land without review.
git grep -n -E 'queryRawUnsafe|Sequelize[.]literal|whereRaw|innerHTML' -- '*.ts' '*.js' || true
npm audit --omit=dev
Control 5 and 6 in a cloud directory are “no standing Owner” and a time-bounded activate. That is a grant you can list, not a poster about least privilege. Control 12 and 13 are the packet path: deny Internet to 22, know who can reach the data subnet. I am not pasting an Azure cookbook here. The command is still “list the allow that says 22 from * and delete it.”
IG1 first C1 assets hostnamectl, cloud inventory C2 software dpkg / lockfile C4 config 00-hardening.conf C5 accounts deploy, no daily root C7 patch unattended-upgrades -security C8 logs 00-hardening.rules THEN C16 app checklist, validation C17 IR named on-call, not a binder LAST C18 test scoped, on a range you own
Control 18 is last on purpose
The official v8.1 blurb for Control 18 is: test effectiveness by identifying and exploiting weaknesses, and by simulating attacker objectives. That is a paid, scoped exercise on assets you listed under Control 1. It is not a reason to keep this site’s old Kali tutorial, and it is not a substitute for Control 4. If sshd still accepts a password, you do not need a red team to learn that. You need sshd -T.
Hire testers after the IG1 proofs are green. Give them a range, a window, and a stop-at-proof rule. Ask them to start at Control 16, the app, because the host should already be dull. Map their report back to Safeguards you missed. Do not map it back to a v7 number you copied from a 2019 PDF.
v8.1 also realigned mappings to NIST CSF 2.0 and marked Governance functions. That does not make CIS a certification. There is no badge on cisecurity.org that says you “passed CIS 18.” Claiming compliance means you can show the Safeguard, the owner, and the evidence command. A dashboard skin is not that row.
Questions we keep getting
Are we failing if we still say Top 20 internally?
You are failing a version check. People will implement the wrong number. Rename the tracker to v8.1, remap the rows in the table above, and retire Control 20 as a label. Keep a footnote for auditors who still speak v7.
Do CIS Benchmarks replace the 18 controls?
No. A Benchmark is a configuration guide for one product. The 18 controls are the program. Apply Ubuntu Level 1 after Control 4 has an owner. Do not score a Benchmark and skip Control 16 on the app you wrote.
Is IG1 enough for a regulated buyer?
IG1 is the start CIS named essential hygiene. A buyer who asks for SOC 2 or PCI will want more, and CIS publishes mappings for several of those. Add IG2 Safeguards when you have owners for them. Do not invent a complete IG3 program on a seven-person team.
