The CIS Controls gap: why only 49 of 153 safeguards have a published crosswalk
The CIS Controls are among the most practical security baselines, yet only a third of their safeguards appear in the crosswalk CIS published to NIST CSF 2.0. Here's what that means if you map CIS to anything else.
The CIS Critical Security Controls are a favourite of practitioners because they say exactly what to do: inventory your assets with automated discovery, allowlist software, collect command-line audit logs. Version 8.1 has 18 controls and 153 safeguards, prioritised into three Implementation Groups. Mapping them to other frameworks should be easy, and CIS itself published a crosswalk to NIST CSF 2.0 in NIST's OLIR catalogue.
That crosswalk covers 49 safeguards. The other 104 have no published link in it.
What the 49 cover
The safeguards in CIS's OLIR submission are spread across the controls, with an emphasis on those that most directly support a CSF outcome. Many of the specific technical safeguards (individual log types, particular anti-malware settings, separate scanning of internal and external assets) aren't in it, presumably because CIS mapped at the level where a clear one-to-one link existed. CIS's fuller mapping is on its own website behind a download form, and its licence (CC BY-NC-ND) limits how others can reuse it.
How we handled the other 104
Rather than leave two thirds of CIS unmapped, ControlMapping placed every remaining safeguard into the topic it obviously belongs to (vulnerability scans into vulnerability management, audit-log safeguards into logging, workforce training into awareness), each labelled editorial with a one-line reason. The result:
Of the 153 CIS v8.1 safeguards, 153 (100%) map to something in NIST CSF 2.0, 0 are only loosely related and 0 have no mapping in our data. Open the gap report →
Every CIS safeguard now maps to a CSF-defined topic. But most of those links are our judgement, not CIS's, and you should treat them that way.
Why "mapped" looks so easy for CIS
CIS safeguards are narrow and technical, so almost any broad framework touches each one at topic level. ISO 27001's logging control relates to every CIS logging safeguard; NIST's vulnerability outcomes relate to every scanning safeguard. That makes CIS look almost completely covered by anything else, as our framework starting-point analysis found. In practice the CIS safeguard is usually the more demanding requirement: ISO asks you to log, CIS tells you which logs.
The other direction
Of the 106 NIST CSF 2.0 subcategories, 59 (56%) map to something in CIS v8.1, 9 are only loosely related and 38 have no mapping in our data. Open the gap report →
Going from CIS to CSF 2.0, the gaps are mostly governance: CIS v8.1 is an operational baseline and says little about organisational context, risk strategy or supply-chain programmes, which make up CSF's Govern function.
Key takeaways
- CIS's openly available crosswalk to NIST CSF 2.0 covers 49 of the 153 CIS Controls v8.1 safeguards; the rest are mapped by judgement here, each with a reason.
- Because CIS safeguards are narrow and technical, almost any broader framework appears to cover them. In practice the CIS safeguard is usually the more demanding requirement.
- Going from CIS to other frameworks, the main gap is governance: risk strategy, oversight and supply-chain programmes.
- Use CIS as the implementation detail under ISO 27001 or CSF, and get CIS's full mapping if an audit needs an authoritative link.
How to use CIS with another framework
- Use CIS as the implementation detail under a broader framework: ISO 27001 or CSF says what to achieve, CIS IG1 and IG2 say how.
- Treat editorial links as starting points. Our requirement pages show which CIS links are crosswalk-backed and which are ours; CIS Controls v8.1 lists all 153 safeguards with both.
- Get CIS's full mapping if you need an authoritative CIS-to-CSF link for an audit.
The NIST CSF vs CIS comparison and the ISO 27001 vs CIS comparison cover both directions.
Questions
Does CIS publish a full mapping to NIST CSF 2.0?
CIS publishes a fuller mapping on its own website behind a download form. The openly available crosswalk in NIST's OLIR catalogue covers 49 of the 153 CIS Controls v8.1 safeguards.
Are ControlMapping's CIS links reliable?
The 49 crosswalk-backed links are CIS's own. The rest are ControlMapping editorial, placed into topics with a stated reason; check them against CIS's full mapping before relying on them.
What are CIS Implementation Groups?
Three tiers of CIS safeguards: IG1 is essential cyber hygiene for every organisation, IG2 adds safeguards for organisations with more complex environments, and IG3 adds those for organisations facing sophisticated attacks.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.