CIS Controls IG3, the full level
The third implementation group includes all the safeguards of the CIS Controls. It is the level for organisations that must withstand sophisticated attackers and cannot afford long outages.
IG3: high exposure, critical data
IG3 is the third and last implementation group of the CIS Controls. It includes all the safeguards of IG1 and IG2 and adds those designed to defend against targeted and sophisticated attacks: in version 8, 153 safeguards in total.
It is the reference for organisations that handle critical data or services, are subject to strict regulation, and where a compromise would have serious consequences for customers or for society. They usually have dedicated security specialists: risk management, penetration testing, application analysis, incident response.
For many medium-sized companies IG3 is not an immediate goal, but it is still useful as a map: it measures how much is missing and in which functions.
The safeguards for withstanding advanced attacks
The focus moves from managing the controls to making them hard to get around for a patient, skilled attacker.
- All the IG1 and IG2 safeguards
- Data loss prevention
- Tight control of the software and scripts that are allowed to run
- Advanced network traffic segmentation and filtering
- Anomaly detection and continuous monitoring
- Application security analysis throughout the development life cycle
- Incident response exercises
- Internal penetration testing and verification of defensive controls
The foundations measured, the rest planned
The IG3 self-assessment covers every safeguard. The platform provides the continuous evidence on which the advanced controls rest, and the simulation tells you how much each service would contribute.
| IG3 area | How Dottor Box covers it |
|---|---|
| Measuring the gap | Gap analysis on every safeguard, with a score by function and a simulation |
| Software control | Authorised software: what is installed compared with what is approved |
| Endpoint monitoring | Cyber Agent: security events and file integrity, with alerts in Italian and English |
| External exposure | Attack Surface with new subdomains suggested every night, and Dark Web Monitoring |
| Access and identity | Microsoft Entra ID: sign-in log and suggested account blocking, always on confirmation by a person |
| Targeted threats | Threat Intelligence on the technologies and suppliers you use |
| Incident response | Incident Response: a CSIRT with fifteen predefined roles and tracked phases |
| Risk management | Risk Assessment with residual risk and an owner for every risk |
Penetration testing, red teaming and data loss prevention are specialist activities and tools that the platform does not replace. Dottor Box measures whether they are in place in the self-assessment and documents their foundations.
Why account blocking is not automatic
When the Microsoft 365 sign-in log detects an anomaly, the platform suggests blocking the account, but only does so after a person confirms it. It is a design choice: if blocking were triggered automatically by failed attempts, anyone who knew the company's email addresses could lock employees out at will.
At IG3 level, the attackers are precisely the ones capable of turning your defences against you.
A person decides
Every block is a conscious, recorded decision.
No blind spots
An indicator with no data shows as "not assessable", not as passed.
IG1, IG2, IG3: from the minimum to the full set
IG1
Essential cyber hygiene, for every company.
Go to IG1IG2
IG1 plus the safeguards for structured IT and sensitive data.
Go to IG2IG3 · this page
All the safeguards, for high exposure.
CIS Controls IG3: frequently asked questions
Does a medium-sized company need IG3?
Usually not as an immediate goal: IG2 is the realistic target. IG3 becomes relevant if you handle critical data or services, if you are a likely target of targeted attacks or if a customer requires it.
Can I assess IG3 without having completed IG2?
Yes. The self-assessment covers every safeguard and the score shows where you stand: the comparison with IG2 helps you decide on priorities.
The modules that work for IG3
Cyber Agent
The endpoint agent: security events, file integrity and clear, readable alerts.
Learn more SeeAttack Surface
A reasoned register of the networks, addresses, applications and domains to protect, with how critical each one is.
Learn more SeeThreat Intelligence
News and threats that concern your industry and your suppliers, gathered into a digest.
Learn more SeeDark Web Monitoring
Compromised company credentials and mentions of your brand on leak and ransomware sites.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more GovernRisk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.