CIS Controls IG1, the essential minimum
The first implementation group of the CIS Controls: the safeguards every company should have, in order of effectiveness. In Dottor Box almost all the answers come from the data collected, not from a questionnaire.
IG1: for small and medium-sized businesses
The CIS Controls are a set of cybersecurity controls developed by the Center for Internet Security, a non-profit organisation. They have one advantage over other lists: they are ordered by priority, so they also tell you where to start.
They are divided into three Implementation Groups (IG). IG1 is designed for companies with limited IT resources, often without staff dedicated to security, that handle office, customer and employee data. CIS defines it as essential cyber hygiene: the minimum level everyone should have, regardless of size and sector.
In version 8 of the CIS Controls, IG1 comprises 56 safeguards. The groups are cumulative: IG2 adds further safeguards to IG1, and IG3 includes them all.
The basic cyber hygiene checklist
Nothing exotic: the things that, when missing, make an attacker's life easy. It is also the heart of the "cyber hygiene practices" required by NIS2.
- Inventory of company devices
- Software inventory and removal of unauthorised software
- Data protection and retention
- Secure configuration of devices and services
- Account and access management, with MFA
- Continuous vulnerability and update management
- Log collection and retention
- Email protection and malware defences
- Data backup and recovery
- Staff training, suppliers and incident response
CIS Controls IG1 with real data
It is the framework the platform covers most directly: knowing which machines you have, what software runs on them, which vulnerabilities are open, who has access, whether the backups work.
| CIS Control | How Dottor Box covers it |
|---|---|
| 1 · Asset inventory | Asset Management: a unified inventory of devices and software, populated by the agents and the scans |
| 2 · Software inventory | Authorised software: installed software compared with the approved list |
| 3 · Data protection | Open shares: network folders that the wrong people can read or write |
| 4, 5, 6 · Configurations and accounts | Microsoft Entra ID and Google Workspace: privileges, MFA, guest accounts and settings |
| 7 · Vulnerability management | Internal and external Vulnerability Assessment, with history and comparison between scans |
| 8 · Logs | System administrator access logs, collected and retained |
| 10 · Malware defences | Cyber Agent on endpoints, with security events and file integrity |
| 11 · Backup | Business continuity: a questionnaire to check backup and recovery |
| 14 · Training | Training and Cyber Awareness with simulated phishing run by Dottor Marc |
| 15, 17 · Suppliers and incidents | Supply Chain and Incident Response |
A self-assessment that is not based on intentions
Where to start
The safeguards in order of effectiveness: you know what to do first.
Automatic inventories
Hardware and software recorded by the agents, not copied by hand into a spreadsheet.
Continuous vulnerability checks
Scans at a configurable frequency, with the contractual service level as the minimum commitment.
Answers with proof
Many answers are already in the data collected by the platform.
IG1, IG2, IG3: which one is right for you
IG1 · this page
Essential cyber hygiene: for every company, even without a structured IT department.
IG2
For organisations with structured IT, several sites or departments and sensitive data to protect.
Go to IG2IG3
For organisations that must withstand targeted, sophisticated attackers, with dedicated security experts.
Go to IG3CIS Controls IG1: frequently asked questions
Is IG1 enough to be safe?
No, and no framework promises that. IG1 is the floor you should not go below: it reduces exposure to the most common, opportunistic attacks, which are the majority of those suffered by SMEs.
How does IG1 relate to NIS2?
NIS2 requires basic cyber hygiene practices: IG1 is one of the most concrete and widely used ways of putting them into practice. Assessing it is a good way to prepare for NIS2 compliance.
How much of the self-assessment is self-declared?
Less than for other frameworks: inventories, vulnerabilities, access and cloud configurations are data the platform collects itself, so many answers already have proof behind them.
The modules that work for IG1
Asset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn more SeeAuthorised software
Installed software compared with the approved list, to find what should not be there.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more SeeCyber Agent
The endpoint agent: security events, file integrity and clear, readable alerts.
Learn more GovernTraining
E-learning for your staff, with a record of completed courses ready to show.
Learn more GovernBusiness continuity
Business Impact Analysis, continuity plan and backup checks, guided by questionnaires.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.