What the CIS Controls are
The Center for Internet Security publishes eighteen Controls, each broken into safeguards: specific actions such as keeping an inventory of devices, configuring them securely, managing vulnerabilities, controlling admin rights, keeping audit logs, protecting e-mail and browsers, defending against malware, recovering data, training staff, managing service providers, testing applications, responding to incidents and running penetration tests. Version 8.1, from 2024, aligned the safeguards with the NIST Cybersecurity Framework 2.0 and added governance as a function.
The safeguards are sorted into three Implementation Groups. IG1 is the baseline every organisation should meet. IG2 adds what an organisation with sensitive data and its own IT staff needs. IG3 is for organisations facing determined attackers.
What a CIS-based questionnaire asks
Customers who use the CIS Controls, often in the public sector, healthcare and US companies, ask questions that read like a checklist: do you keep an inventory of all company devices and software, how fast are critical patches applied, is multi-factor authentication required for remote and admin access, are audit logs kept and for how long, are backups isolated and tested, which Implementation Group do you meet. The questions are concrete, and so are the answers they expect.
Answering as a vendor
Answer each safeguard with what is done, how and how often, and where the evidence is. "Critical patches within 14 days, tracked in the vulnerability scanner, exceptions approved by the CTO" answers a patching question. If you assess yourself against the Controls, say which Implementation Group you meet and attach the assessment; the CIS publishes a free tool for it. Where a safeguard belongs to your hosting provider, such as the physical servers, say so and cite their certification.
The technical answers overlap with almost every other questionnaire. The same facts about patching, access, logging and backups answer ISO 27001, SOC 2 and the SIG, so keep them in one place.
In Responsemate
Each safeguard's answer lives once in the knowledge base, with the evidence and its expiry date attached, and every questionnaire is drafted from it with the sources shown on the row. Knowledge in Responsemate.
Questions people ask
Can we be certified against the CIS Controls?
No. There is no CIS certification. Customers ask which Implementation Group you meet and for evidence of the safeguards, and some auditors assess against the controls as part of other work.
Which Implementation Group should a small SaaS vendor aim for?
Implementation Group 1 at least, which the Center for Internet Security calls essential cyber hygiene. Most customers who use the CIS Controls expect a SaaS vendor to meet IG1 fully and parts of IG2.