Most Canadian small and mid-sized businesses know they need cybersecurity. What they don’t have is a clear answer to one question: where do we start? The CIS Critical Security Controls answer that question directly. They tell you exactly what to do, in what order, based on the attacks that are actually happening — not theoretical risk models.

This guide explains what the CIS Controls are, how all 18 work, which implementation group applies to your organization, and how they map to PIPEDA, ISO 27001, and Canadian cyber insurance requirements in 2026. Whether you’re a law firm in Toronto, an accounting practice in Mississauga, or a healthcare-adjacent business anywhere in Ontario, this is the framework your security program should be built on.

What Are the CIS Controls?

The CIS Critical Security Controls (CIS Controls) are a prioritized set of cybersecurity safeguards developed and maintained by the Center for Internet Security (CIS), a non-profit organization that draws on a global community of security experts, government agencies, and threat intelligence data. Originally developed in 2008 as the SANS Top 20, the framework has been refined over nearly two decades based on what attacks are actually succeeding against real organizations.

The current version, CIS Controls v8.1, was published in June 2024. It organizes 153 individual safeguards across 18 controls and introduces alignment with NIST CSF 2.0’s new Govern security function. For Canadian SMBs, it is the most practical, implementable cybersecurity framework available — because it is prescriptive where other frameworks are descriptive. NIST CSF tells you what outcomes to achieve. CIS Controls tell you what to configure on Monday morning.

The 3 CIS Implementation Groups: Which One Applies to You?

CIS Controls are not one-size-fits-all. The framework uses Implementation Groups (IGs) to scale the controls to your organization’s size, resources, and risk profile. The groups are cumulative: every IG2 organization must first implement all IG1 safeguards, and every IG3 organization must implement all of IG1 and IG2.

For most Ontario SMBs: start with IG1. It covers 56 safeguards that prevent the vast majority of successful attacks — ransomware, credential theft, phishing, and supply chain compromise — without requiring a dedicated security team to operate.

All 18 CIS Controls Explained

Here is every CIS Control in plain English, with its implementation group assignment and why it matters for Canadian businesses.

CIS Control 1 — Inventory and Control of Enterprise Assets

You cannot protect what you don’t know exists. Control 1 requires maintaining an accurate, up-to-date inventory of every device that has authorization to connect to your network — laptops, desktops, servers, mobile devices, printers, and cloud instances. Unauthorized devices must be detected and blocked before they can access resources. IG1 requires an asset inventory with active discovery at least once per week.

CIS Control 2 — Inventory and Control of Software Assets

Know every application installed on every device. Unauthorized software — including shadow IT and personal apps on work devices — is a primary attack vector. Control 2 requires maintaining a software inventory and ensuring only authorized applications run on your endpoints. IG1 requires a software inventory maintained and reviewed at least monthly.

CIS Control 3 — Data Protection

Identify, classify, and protect sensitive data based on its sensitivity. For Ontario professional services firms, this means understanding where client SINs, financial records, litigation files, and personal health information live — and applying appropriate controls (encryption at rest, encryption in transit, access restrictions) to each category. Control 3 directly operationalizes PIPEDA’s Safeguards and Limiting Collection principles.

CIS Control 4 — Secure Configuration of Enterprise Assets and Software

Default configurations on operating systems, applications, and network devices are almost always insecure. Control 4 requires establishing and maintaining secure baseline configurations for every device type — removing unnecessary services, disabling unused ports, enforcing hardened settings. The CIS Benchmarks (companion documents to the Controls) provide specific hardening guidance for Windows, macOS, Linux, Microsoft 365, Azure, and dozens of other platforms.

CIS Control 5 — Account Management

Manage the lifecycle of every user and service account: creation, active use, and removal. Accounts belonging to departed employees that remain active are one of the most consistently exploited gaps in SMB environments. Control 5 requires processes for provisioning, reviewing, and deprovisioning accounts — with special attention to administrative and privileged accounts. IG1 requires reviewing administrative accounts at least quarterly.

CIS Control 6 — Access Control Management

Enforce least-privilege access: every user and system should have only the access they need to perform their function, and nothing more. Control 6 requires role-based access control (RBAC), documented access rights, and multi-factor authentication (MFA) on all administrative access. MFA on admin accounts is an IG1 requirement — and the single highest-leverage control for preventing account takeover.

CIS Control 7 — Continuous Vulnerability Management

Run regular vulnerability scans against your assets and remediate findings based on risk. Unpatched vulnerabilities are the second most common initial access vector in Canadian breaches after credential theft. Control 7 requires automated scanning, a documented remediation timeline (critical vulnerabilities patched within 14 days in IG1), and tracking of remediation progress. This control directly satisfies PIPEDA’s requirement for security measures appropriate to data sensitivity.

CIS Control 8 — Audit Log Management

Collect, protect, and review logs from all enterprise assets. Without logs, you cannot detect an intrusion in progress, reconstruct what happened during a breach, or satisfy mandatory breach notification requirements under PIPEDA. Control 8 requires centralized log collection, tamper-evident storage, and defined retention periods. IG1 requires log collection from all devices at minimum.

CIS Control 9 — Email and Web Browser Protections

Email and browsers are the two most common initial intrusion vectors. Control 9 requires deploying and maintaining DNS filtering, email filtering, anti-phishing controls, and browser-level protections. For Microsoft 365 environments — the dominant platform for Ontario professional services — this means properly configuring Defender for Office 365, including Safe Links, Safe Attachments, and anti-spoofing policies.

CIS Control 10 — Malware Defenses

Deploy and maintain anti-malware software across all endpoints, with regular signature updates and centralized management. In 2026, this means endpoint detection and response (EDR) rather than traditional antivirus — because legacy antivirus does not detect fileless malware, living-off-the-land attacks, or modern ransomware variants. EDR is now a cyber insurance underwriting requirement in Canada. Control 10 provides the implementation framework.

CIS Control 11 — Data Recovery

Maintain and test data recovery capabilities. Control 11 requires automated, tested backups with a documented recovery process. The critical requirements: backups must be stored separately from production systems (offline or immutable), tested at least quarterly, and capable of restoring operations within your organization’s recovery time objective. Insurers now require immutable backups specifically — backup systems that ransomware cannot encrypt or delete.

CIS Control 12 — Network Infrastructure Management

Securely manage and maintain network infrastructure: routers, switches, firewalls, and wireless access points. Control 12 requires documented network diagrams, regular configuration reviews, and network segmentation so that a compromise of one network segment does not automatically expose all others. For healthcare-adjacent organizations under PHIPA, network segmentation between clinical and administrative systems is a foundational control.

CIS Control 13 — Network Monitoring and Defense

Monitor network traffic for anomalies and attacks. Control 13 requires deploying network monitoring tools, establishing traffic baselines, and alerting on deviations. At IG2 and above, this means security information and event management (SIEM) or managed detection and response (MDR) services. For most Ontario SMBs at IG1, this starts with firewall logging and DNS monitoring.

CIS Control 14 — Security Awareness and Skills Training

Train all employees to recognize and resist social engineering, phishing, and security threats relevant to their roles. Control 14 requires a documented training program, role-based content, and phishing simulation exercises. The Verizon DBIR 2025 found that 68% of breaches involved a human element — phishing, credential theft, or social engineering. Training is not optional; it is the control with the highest per-dollar risk reduction at IG1.

The OPC has specifically cited inadequate employee training as a contributing factor in enforcement findings against Canadian professional services firms. Security awareness training simultaneously satisfies PIPEDA’s Safeguards Principle and reduces your insurance risk profile.

CIS Control 15 — Service Provider Management

Manage the security of third-party service providers that store, process, or transmit your data. Control 15 requires inventorying service providers, classifying them by data access level, and ensuring contractual privacy and security obligations. This control directly operationalizes PIPEDA’s accountability principle: your firm remains legally responsible for personal information even after it is transferred to a cloud provider, payroll processor, or IT vendor.

CIS Control 16 — Application Software Security

Manage the security lifecycle of internally developed or acquired software. For most Ontario SMBs that are not software developers, Control 16 primarily applies to vendor management (ensuring purchased software is properly updated and configured) and to secure development practices for any custom applications. IG1 requires maintaining an inventory of software and restricting installation of unauthorized applications.

CIS Control 17 — Incident Response Management

Establish and maintain an incident response program. Control 17 requires a documented incident response plan, defined roles and escalation paths, and regular testing through tabletop exercises. For PIPEDA compliance specifically, you need an incident response process that can detect a breach, assess whether it creates a real risk of significant harm, and trigger OPC notification within a defensible timeframe (in practice, 72 hours). No incident response plan = no ability to meet mandatory breach notification obligations.

CIS Control 18 — Penetration Testing

Conduct regular penetration testing to identify and validate security gaps before attackers do. Control 18 is an IG2 and IG3 requirement. At IG1, the equivalent activity is regular vulnerability scanning and remediation (Control 7). For Ontario professional services firms handling large volumes of sensitive personal data, annual penetration testing is a best practice even if not yet a formal IG1 safeguard.

CIS Controls vs. ISO 27001: How They Work Together

A common question: do we need CIS Controls or ISO 27001? The answer is that they serve different purposes and are most powerful when used together.

CIS Controls v8.1 are prescriptive and threat-driven. They tell you exactly what to configure, based on what attacks are actually succeeding. You can start implementing them immediately — no formal risk assessment required to begin. They directly answer the controls your cyber insurer is asking about (MFA, EDR, immutable backups, incident response) and satisfy the security questionnaires your enterprise clients send.

ISO 27001:2022 is a certifiable management system standard. It is risk-driven and governance-focused — it requires a formal risk assessment, a Statement of Applicability, and third-party audit before you earn the certificate. That certificate wins enterprise contracts and regulatory recognition in ways that CIS Controls alone cannot.

The practical approach for Ontario SMBs: use CIS Controls IG1 as your operational implementation layer, and pursue ISO 27001 certification as your governance and market differentiation layer. CIS Controls implement the technical controls that ISO 27001 Annex A requires. They are complementary — not competing.

CIS Controls vs. NIST CSF 2.0

NIST Cybersecurity Framework 2.0 organizes security activities into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. CIS Controls v8.1 explicitly maps to these functions — every safeguard is tagged to its NIST CSF 2.0 function. The key distinction: NIST CSF tells you what outcomes to achieve; CIS Controls tell you how to achieve them. For Canadian SMBs without dedicated security architects, CIS Controls provide the operationalizable implementation that NIST CSF alone does not.

CIS Controls and Canadian Compliance Frameworks

CIS Controls are not a Canadian-specific framework, but they map directly onto every compliance obligation Ontario businesses face in 2026.

CIS Controls and PIPEDA

PIPEDA’s Safeguards Principle requires security measures “appropriate to the sensitivity” of the personal information you hold. CIS Controls IG1 defines exactly what appropriate means in practice — asset inventory, secure configuration, MFA, EDR, encrypted backups, and incident response. A documented CIS IG1 implementation is defensible evidence that you have met the PIPEDA Safeguards Principle.

CIS Controls and the Canadian Centre for Cyber Security (CCCS)

The CCCS Baseline Cyber Security Controls for Small and Medium Organizations overlaps approximately 90% with CIS IG1. The two frameworks are functionally interchangeable at the SMB level. Organizations that implement CIS IG1 simultaneously satisfy CCCS baseline guidance without running a separate compliance program.

CIS Controls and Bill C-8

Bill C-8 (the Critical Cyber Systems Protection Act) received Royal Assent on June 16, 2026. It applies directly to designated operators in federally regulated sectors. However, supply chain obligations mean vendors and service providers to designated operators will face security questionnaires tied to recognized frameworks. A CIS Controls IG2 implementation provides the documented, assessable security program those questionnaires require.

CIS Controls and Cyber Insurance in Canada

Canadian cyber insurers do not require CIS Controls certification — but the controls insurers demand in 2026 map almost exactly onto CIS IG1. MFA (Control 6), EDR (Control 10), immutable backups (Control 11), incident response plan (Control 17), and employee training (Control 14) are all IG1 safeguards. An organization that has implemented CIS IG1 can complete a cyber insurance questionnaire with documented evidence rather than attestations that cannot survive a post-claim investigation.

CIS IG1 Implementation Checklist for Ontario SMBs

These are the foundational CIS IG1 safeguards every Ontario professional services firm should implement first — in roughly this sequence, based on risk reduction per dollar of effort.

• Establish and maintain an asset inventory of all devices on your network (Control 1)
• Establish and maintain a software inventory; block unauthorized applications (Control 2)
• Identify and classify your sensitive data; encrypt client files at rest and in transit (Control 3)
• Apply CIS Benchmark hardening to all Windows, macOS, and Microsoft 365 configurations (Control 4)
• Disable and remove all accounts for departed staff within 24 hours of departure (Control 5)
• Enable MFA on all accounts — admin and standard users — without exception (Control 6)
• Run automated vulnerability scans monthly; patch critical findings within 14 days (Control 7)
• Enable centralized logging on all devices and retain logs for a minimum of 90 days (Control 8)
• Deploy DNS filtering and configure email anti-phishing protections in Microsoft 365 (Control 9)
• Deploy EDR on all endpoints — not legacy antivirus; EDR is the 2026 minimum (Control 10)
• Implement automated, tested, immutable backups with offsite or cloud storage (Control 11)
• Document your network topology; implement firewall rules and wireless security (Control 12)
• Conduct phishing simulation training annually; document participation and results (Control 14)
• Audit your cloud and IT vendors; add privacy and security clauses to vendor agreements (Control 15)
• Document and test your incident response plan; include a PIPEDA breach notification trigger (Control 17)

Common CIS Controls Implementation Mistakes in Canadian SMBs

1. Starting with too many controls at once

Organizations read the full list of 153 safeguards and attempt a comprehensive implementation simultaneously. The result is shallow coverage across everything rather than full coverage of the most critical controls. The IG model exists precisely to prevent this. Start with IG1’s 56 safeguards. Complete them fully. Then layer IG2.

2. Treating MFA as optional for non-admin users

Many Ontario SMBs enable MFA for administrators but leave standard user accounts unprotected. Insurers are now conducting post-claim investigations that examine actual MFA logs — not policy documents. If standard accounts accessed sensitive data without MFA, a claim can be denied. CIS Control 6 requires MFA on all accounts.

3. Confusing antivirus with EDR

Legacy antivirus (signature-based detection) does not detect modern ransomware, which uses fileless execution, living-off-the-land techniques, and legitimate system tools as attack vectors. CIS Control 10 requires EDR specifically — endpoint detection with behavioral analysis and response capability. Microsoft Defender for Endpoint at Plan 1 or Plan 2 meets this requirement for Microsoft 365 organizations.

4. Backups that aren’t actually immutable

Ransomware operators specifically target backup systems. If your backups are connected to your production network and accessible from a compromised workstation, they will be encrypted or deleted. CIS Control 11 requires backups to be protected from modification and tested for recoverability. Immutable storage (Azure Immutable Blob Storage, or offline tape/cold storage) is the standard.

5. No documented incident response plan

CIS Control 17 requires a written, tested incident response plan before a breach occurs — not improvised after one. Under PIPEDA, your ability to assess whether a breach creates a “real risk of significant harm” and notify the OPC in a defensible timeframe depends entirely on having a plan that defines who makes that decision and how quickly. Organizations without a documented IR plan consistently fail post-breach regulatory reviews.

---

Frequently Asked Questions

What is the difference between CIS Controls and CIS Benchmarks?

CIS Controls are the high-level framework of 18 controls and 153 safeguards that define what security activities your organization should perform. CIS Benchmarks are the detailed, platform-specific configuration guides that tell you how to implement those controls on specific systems — Windows 11, macOS Sequoia, Microsoft 365, Azure, Ubuntu, and dozens of others. The Controls are the strategy; the Benchmarks are the technical playbook.

Are CIS Controls mandatory in Canada?

CIS Controls are not legislatively mandated in Canada. However, they are the framework that Canadian cyber insurance underwriters most commonly reference when assessing control maturity, and they align with CCCS baseline guidance that the federal government recommends for SMBs. For organizations subject to PIPEDA, implementing CIS IG1 is one of the strongest defensible demonstrations of compliance with the Safeguards Principle. Under Bill C-8, designated operators will need to demonstrate security programs aligned to recognized frameworks — CIS Controls explicitly qualifies.

Can a small Ontario business implement CIS Controls without a dedicated IT team?

Yes — CIS IG1 is designed for organizations with limited IT and security resources. Many IG1 safeguards can be implemented and maintained by a managed service provider (MSP) without dedicated internal security staff. The controls that require the most internal attention are process-oriented: maintaining an asset inventory, reviewing accounts quarterly, documenting an incident response plan, and conducting annual security training. The technical controls (EDR, MFA, DNS filtering, backup) are typically MSP-operated.

How long does it take to implement CIS Controls IG1?

For a typical Ontario SMB of 10–50 users in a Microsoft 365 environment, a focused IG1 implementation takes 4–8 weeks when led by an experienced consultant or MSP with security expertise. The largest time investment is initial asset discovery, hardening configuration deployment, and documentation of the incident response plan. Organizations that already have MFA and EDR deployed can complete IG1 documentation and gap closure in as little as 2–3 weeks.

How do CIS Controls map to ISO 27001 Annex A controls?

CIS publishes official crosswalk documents mapping every safeguard to its corresponding ISO 27001:2022 Annex A control. The relationship is generally: CIS Controls implement the technical controls that ISO 27001 governance requires. For example, CIS Control 6 (MFA, account management) maps to ISO Annex A controls A.5.15, A.5.16, A.5.17, and A.8.2. An organization that has implemented CIS IG1 or IG2 will have fulfilled the technical implementation requirements for a significant portion of ISO 27001’s 93 Annex A controls.

What is the difference between CIS IG1, IG2, and IG3?

Implementation Groups are risk-based tiers. IG1 (56 safeguards) is the essential cyber hygiene baseline for any organization — it prevents the most common attacks and is the minimum defensible security posture. IG2 (130 safeguards) adds foundational controls for organizations with more sensitive data, dedicated IT staff, or higher regulatory exposure. IG3 (all 153 safeguards) is for organizations with security teams, critical data, and advanced threat exposure. The groups are cumulative: you complete IG1 before adding IG2 safeguards.

Do CIS Controls cover cloud environments like Microsoft 365 and Azure?

Yes. CIS Controls v8 was explicitly redesigned for cloud, hybrid, and remote-first environments. Rather than defining controls by asset location, v8 uses the concept of enterprise assets and enterprise software that apply regardless of where workloads run. The companion CIS Benchmarks for Microsoft 365 and Azure provide specific hardening configurations for cloud environments. For Ontario SMBs running Microsoft 365, the CIS Microsoft 365 Foundations Benchmark is the most relevant starting point.

How do CIS Controls help with a cyber insurance renewal in Ontario?

Canadian cyber insurance questionnaires in 2026 ask about MFA, EDR, immutable backups, vulnerability management, incident response plans, and employee training — all of which are CIS IG1 controls. An organization that has implemented CIS IG1 can answer each question with documented evidence (configuration records, training logs, backup test records) rather than policy attestations. This distinction matters: insurers are now conducting post-claim investigations that examine actual implementation, not just stated policies. Documented CIS IG1 controls protect your claim.

---

Next Steps: Assessing Your CIS Controls Posture

The most common finding in our gap assessments of Ontario professional services firms is not a single catastrophic gap — it is a collection of IG1 safeguards that are partially implemented, undocumented, or inconsistently applied across the organization. EDR deployed on workstations but not servers. MFA enabled for most accounts but not for a legacy application used by three partners. Backups running nightly but never tested for recoverability.

A structured CIS Controls assessment identifies exactly which IG1 safeguards are fully implemented, partially implemented, or absent — and delivers a prioritized remediation roadmap that closes the highest-risk gaps first. The output gives you defensible documentation for your insurer, your enterprise clients, and the OPC if a breach ever occurs.