CIS Controls v8.1 Assessment for Australian SMBs
Self-assess your CIS Controls IG1 implementation. See your results by NIST CSF function. Free assessment, no account required.
What are the CIS Controls?
The CIS Controls (Center for Internet Security Controls) are a globally recognised set of prioritised cybersecurity actions, now in version 8.1. They are organised into three Implementation Groups: IG1 is the essential cyber hygiene baseline, covering 56 safeguards that address the most common attack vectors.
CIS Controls are widely referenced by cyber insurers, ISO 27001 auditors, and enterprise clients. The CISScore assessment scores your IG1 implementation and shows your results by NIST CSF function.
How it works
Three steps, about 15 minutes
Answer 45 questions
Covering all 56 CIS Controls v8.1 IG1 safeguards across 15 controls. No account, and you can mark a question not applicable where it does not apply to your business.
See your score
An overall score, a score for each control assessed, and a NIST CSF function view. Your biggest gaps are listed first.
Close the gaps
Optionally buy the policy bundle ($99) to get policies written around the gaps your assessment found, in PDF and Word.
Pricing
CIS Controls Assessment Pricing
for 24/7 monitoring and remediationSelf-assessment
Full CIS Controls v8.1 IG1 assessment with instant score across all 56 IG1 safeguards in the 15 controls that contain IG1 safeguards.
- All 56 IG1 safeguards
- Separate IG2 assessment available
- Gap analysis
- No account required
IG1 policy bundle
Pre-written policy templates aligned to CIS Controls IG1, ready to customise and implement.
- Policy templates for all IG1 controls
- Word format, fully editable
- Aligned to CIS v8.1
- Immediate download
Free assessment first, pay only when you want the policies.
All prices are in Australian dollars and include GST. One-time payments, no subscription.
Ready to assess your CIS Controls maturity?
Free assessment. No account required.
CIS Controls Assessment FAQs
What are the CIS Controls?
The CIS Controls are a prioritised set of cybersecurity actions organised into three Implementation Groups. IG1 is the essential cyber hygiene baseline covering 56 safeguards, appropriate for most SMBs and the most impactful starting point.
Is the CIS Controls assessment free?
Yes. The full CIS Controls v8.1 IG1 assessment is completely free with no account required. The paid option is the IG1 policy bundle ($99).
What is IG1 and do I need to do more?
IG1 (Implementation Group 1) covers 56 safeguards across the 15 controls that contain IG1 safeguards, the essential cyber hygiene baseline for most SMBs. IG2 and IG3 add more advanced controls for organisations with sensitive data or complex infrastructure.
How do CIS Controls relate to ISO 27001?
The CIS Controls map closely to ISO 27001 Annex A controls, so an IG1 assessment is useful groundwork for ISO work. Your results include a NIST CSF function view. We do not currently provide an ISO 27001 or PCI DSS mapping.
How do CIS Controls relate to the ACSC Essential Eight?
Both frameworks address similar threats from different angles. The Essential Eight is the Australian government standard; CIS Controls is the international best-practice framework. Many Australian SMBs complete both to satisfy different audiences, government clients typically require Essential Eight, enterprise clients often reference CIS Controls.
What do I get with the paid policy bundle?
The $99 IG1 policy bundle includes pre-written policy templates for all IG1 controls in Word format, fully editable and aligned to CIS v8.1 guidance, ready to implement immediately.