What is CIS Control?

The CIS Controls (formerly known as the SANS Top 20 Critical Security Controls) are a prioritized set of actions that organizations can take to protect themselves from the most pervasive and dangerous cyber attacks. They are a consensus-driven, actionable set of best practices designed to improve an organization's cyber defense posture. Organizations use the CIS Controls as a framework to implement and manage their cybersecurity programs, often mapping them to other frameworks like NIST Cybersecurity Framework or ISO 27001. They are commonly used for vulnerability management, incident response, and secure configuration.