CIS Controls IG2, for structured IT
The second implementation group: all of IG1, plus the safeguards for organisations managing several sites, several departments and sensitive data. With evidence that comes from the scans.
IG2: the company with an IT department
The CIS Controls from the Center for Internet Security are divided into three cumulative implementation groups. IG2 includes all the safeguards of IG1 and adds others, designed for a different profile.
It is the level for organisations that have dedicated IT staff managing and protecting the infrastructure, several sites or departments with different needs, and that handle sensitive data about customers or employees. A service outage affects customer trust, and a breach has serious consequences.
In version 8 of the CIS Controls, IG2 reaches 130 safeguards in total. Organisations that need to defend themselves against targeted attackers go on to IG3.
Beyond basic hygiene: manage, measure, monitor
IG1 asks you to have the controls. IG2 asks you to manage them in a structured way across a more complex infrastructure.
- All the IG1 safeguards
- Automated tools for asset and software inventory
- Data classification and protection of sensitive data
- Centralised account and privilege management
- Automated vulnerability assessment, internal and external
- Centralised logs and periodic review
- Network infrastructure management and monitoring
- Security of applications developed in-house or purchased
- Role-specific training
- Periodic penetration testing
IG2 safeguards with automatic evidence
The IG2 self-assessment measures the gap. The safeguards that call for automated tools are precisely the ones the platform carries out itself.
| IG2 area | How Dottor Box covers it |
|---|---|
| Automatic inventories | Asset Management with the graph map of the network, and Authorised software |
| Sensitive data | Open shares and the Records of processing findings on data to review |
| Accounts and privileges | Microsoft Entra ID across 72 indicators and Google Workspace across 35 |
| Internal and external vulnerabilities | Internal network from the on-site probe and External network from the perimeter |
| Network infrastructure | Cyber Drill: the probe that analyses the internal network, with no firewall ports to open |
| Centralised logs | Access logs and Cyber Agent on endpoints |
| Application security | Web application: more than 6,500 specific checks on websites and online applications |
| Role-based training | Training with a record, and Cyber Awareness |
The penetration test required by IG2 is a manual activity carried out by specialists: vulnerability assessments are its foundation and narrow its scope, but they do not replace it.
Complex IT, a single view
Every site
Internal network, perimeter and cloud in the same platform and the same score.
History and comparison
Every scan stays in the archive: you see what has been fixed and what has come back.
False positives that stay gone
A finding that has been reviewed and closed does not reappear at the next scan.
Score by function
The IG2 gap read across Identify, Protect, Detect, Respond and Recover.
IG1, IG2, IG3: the groups are cumulative
IG1
Essential cyber hygiene: the starting point for every SME, included in IG2.
Go to IG1IG2 · this page
IG1 plus the safeguards for structured IT, several sites and sensitive data.
IG3
All the safeguards, for organisations that must withstand targeted attackers.
Go to IG3CIS Controls IG2: frequently asked questions
Do I have to complete IG1 before IG2?
Yes, in the logic of the CIS Controls the groups are cumulative: IG2 assumes the IG1 safeguards are in place. In Dottor Box you can assess both and see how much is missing for each.
How do I know whether I am IG1 or IG2?
If you have dedicated IT staff, several sites or departments with different needs and you handle sensitive data, IG2 is probably your reference. If IT is in the hands of one person or an external provider, start with IG1.
Are the CIS Controls useful for NIS2?
They are not required by name, but many of the measures required by NIS2, from cyber hygiene to vulnerability handling, find a concrete technical translation in the CIS Controls.
The modules that work for IG2
Internal network
Your LAN scanned by the on-site probe, the way malware that is already inside would see it.
Learn more SeeWeb application
Website, CRM and online applications tested with more than 6,500 specific checks.
Learn more SeeCyber Drill
The probe installed on site that analyses your internal network. No firewall ports to open.
Learn more SeeAsset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn more SeeMicrosoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more SeeAccess logs
System administrator logins collected and retained as the Italian Data Protection Authority requires.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.