Data Structure Overview
Hierarchical Structure
Core Components
1. Controls (18 total)
Purpose: High-level security control categories
Contains safeguards 1.1, 1.2, 1.3, 1.4, 1.5
Fields: Number, Title, Description, "Why Critical" explanation
2. Safeguards (153 total)
Purpose: Specific, actionable security requirements
Asset Class: Devices | Security Function: Identify | Implementation Groups: 1, 2, 3
Fields: Number, Title, Description, Asset Class, Security Function, IG1/IG2/IG3 flags
Assessment Components (Per Safeguard)
| Component | Purpose | Example | Typical Count |
|---|---|---|---|
| Assessment Inputs | Data sources needed for assessment | GV1: Enterprise Asset Inventory | 2-4 per safeguard |
| Assessment Operations | Steps to perform the assessment | 1. Compare current inventory to discovered assets | 3-6 per safeguard |
| Assessment Measures | Metrics to calculate | M1 = Count of enterprise assets | 4-8 per safeguard |
| Assessment Metrics | Final scores and ratios | Accuracy Score = M3 / M2 | 1-3 per safeguard |
Assessment Process Flow
How CIS Assessment Works
- Gather Inputs: Collect required data sources (asset inventories, logs, etc.)
- Execute Operations: Follow step-by-step assessment procedures
- Calculate Measures: Compute intermediate metrics (M1, M2, M3...)
- Derive Metrics: Calculate final scores using measure formulas
- Determine Compliance: Compare scores against thresholds
Real Example: Safeguard 1.1
Input: Enterprise Asset Inventory (GV1)
Operation: Compare GV1 to discovered assets, identify missing items
Measures: M1 = Asset count, M2 = Discovered count, M3 = Matching count
Metric: Accuracy Score = M3 / M2 (percentage of discovered assets in inventory)
Implementation Tracking
Safeguard Implementations
Purpose: Track your organization's progress on each safeguard
Status Options:
- Not Applicable: Safeguard doesn't apply to your environment
- Planned: Safeguard is planned but not started
- In Progress: Currently implementing
- Implemented: Fully implemented
- Monitored: Implemented and actively monitored
Additional Fields: Owner, evidence, due dates, assessment scores
Implementation Groups (IG)
| Group | Target Organizations | Safeguard Count | Description |
|---|---|---|---|
| IG1 | Small businesses, limited IT resources | 56 safeguards | Essential cyber hygiene, foundational controls |
| IG2 | Medium enterprises | 74 additional safeguards | Risk-informed controls, builds on IG1 |
| IG3 | Large enterprises, high-risk organizations | 23 additional safeguards | Advanced security measures, all 153 safeguards |
Next Steps
Before You Proceed:
- Review the data: Explore the admin interface to understand the imported information
- Verify safeguards: Confirm all 153 safeguards are present and correctly categorized
- Check dependencies: Review safeguard dependencies for your implementation planning
- Plan your approach: Decide which Implementation Group fits your organization
- Start tracking: Begin creating Safeguard Implementations for your organization
Recommended Starting Point
1. Review all IG1 safeguards (56 total) - these are your foundational controls
2. Create Safeguard Implementations for IG1 safeguards with status "Planned"
3. Assign owners and set due dates for priority safeguards
4. Begin implementing safeguards that have no dependencies