What is CIS in cybersecurity?

Direct Answer

CIS generally refers to the Center for Internet Security, renowned for its Critical Security Controls (CSC) and CIS Benchmarks:

CIS Controls: A prioritized list (IG1-IG3) of 18 technical defense mechanisms (e.g., inventory management, secure configurations, data protection). These are mapped across frameworks like NIST CSF and NIST SP 800 53.
CIS Benchmarks: Consensus-based hardening guidelines for operating systems, applications, network devices and cloud workloads.

The current version of CIS CSC contains eighteen (18) primary controls that originated from the “SANS Top 20” that focused on controls to address the top twenty (20) critical security vulnerabilities that organizations face. The SANS Top 20 was transferred to CIS in 2015 and rebranded as the CSC.

Keep Exploring

Relevant ComplianceForge Resources

ComplianceForge Start Here guide
ComplianceForge cybersecurity documentation templates

References

Authoritative Sources

NIST SP 800-53 Rev. 5
NIST SP 800-53B control baselines
NIST Cybersecurity Framework (CSF) 2.0
NIST Privacy Framework