Framework import
A prioritised set of safeguards for cyber defence. Version 8 has 18 controls and 153 safeguards, grouped into three implementation groups by organisation size and risk.
Import from a spreadsheet
Your safeguard list becomes CIS Controls.
One row per safeguard, one control per row
| Your column | Becomes |
|---|---|
| Control IdentifierThe default name; you choose the column | The control's identifier |
| Control NameThe default name; you choose the column | Its title |
| Control Family NameThe default name; you choose the column | Its category |
| ControlRead when the file has it | Its description |
| Added by the import | Status, owner, due date and evidence count |
Center for Internet Security Critical Security Controls
Import from a spreadsheet
In practice
CIS Controls are a benchmark rather than a regulation. Implementation Group 1 is essential cyber hygiene; groups 2 and 3 add safeguards for larger or higher-risk environments. Many organisations use it as the working control set beneath a SOC 2 or ISO 27001 programme.
Requirements
01
Asset and software inventory, data protection, secure configuration, account management and access control.
02
Email and browser protection, malware defence, data recovery, network infrastructure management and awareness training.
03
Application security, incident response, penetration testing and security service provider management.
How the Desk helps
Each step below is shipped: the template import in Compliance Studio, and workflows that run over the documents you choose, record their sources and hold for approval before export.
CIS Controls is not a bundled template. Bring the safeguard list as a spreadsheet and import it as a framework; each safeguard becomes a control with a status and an owner.
Run Review controls over your policies for the imported safeguards. The run records every document it read; a control memo names the safeguards with gaps.
Evidence is held per safeguard with its status. Find missing evidence and Prepare audit checklist run over the evidence documents you select, exported once approved.
Next step
Bring the policies you have and the last audit's request list. We will import the template, run the workflows with you and hand back the controls, the evidence on file and each run's sources.
Security
Encrypted at rest (AES-256) and in transit (TLS 1.3), hosted with a SOC 2 attested cloud provider. Your data never trains a model.
Security page