Explainer · 5 min read

CIS Controls IG1, explained for nonprofits

If your organization has never followed a security framework, CIS Controls Implementation Group 1 (IG1) is the place to start. It was written with small organizations in mind, focuses on the attacks that actually happen, and doesn’t require a security team.

What the CIS Controls are

The CIS Critical Security Controls are a prioritized set of security practices published by the Center for Internet Security, a nonprofit. Version 8 organizes them into 18 controls, each made up of specific “safeguards.” The controls are split into three Implementation Groups (IG1, IG2, IG3), so organizations can start with the essentials and add more as they grow.

What IG1 is

IG1 is the first group: the safeguards CIS considers essential cyber hygiene, the minimum every organization should have in place. It’s designed for organizations with limited IT and security expertise, where the main goal is protecting everyday operations and data from common attacks like phishing and ransomware.

What IG1 covers, in plain language

• Know what you have: keep a list of your computers, phones, and software, and remove what you don’t use.
• Protect your data: know where sensitive data lives, who can access it, and how it’s disposed of.
• Configure securely: change default settings, use screen locks, and turn on firewalls and encryption.
• Manage accounts and access: unique passwords, MFA, separate admin accounts, and prompt removal of access.
• Keep things updated: install security updates on a schedule.
• Defend email and browsers: use supported browsers and email clients, and filter malicious content.
• Block malware: run anti-malware on every device.
• Back up and recover: automated backups, kept separate, and tested.
• Train people: security awareness for everyone, including how to spot phishing.
• Manage vendors and incidents: know who holds your data, and have a plan for when something goes wrong.

Why it’s a good fit for nonprofits

• Practical: most safeguards use tools you already have, like Microsoft 365 or Google Workspace settings.
• Prioritized: it focuses on what stops real attacks, not paperwork.
• Recognized: funders, insurers, and partners understand it, and it maps to larger frameworks like NIST CSF 2.0, so the work carries forward if you need more later.
• Free: the controls are freely available from CIS.

How to get started

1. Start with the security essentials checklist. It covers many of the highest-impact IG1 safeguards.
2. Download the CIS Controls from the Center for Internet Security, and read the IG1 safeguards for each control.
3. Mark each safeguard as in place, partly in place, or missing, and fix the missing ones in order of risk.

If you’d like a clear, scored baseline, a CIS Controls IG1 gap assessment gives you a control-by-control report and a roadmap. Book a free intro call to talk it through.

CIS Controls is a trademark of the Center for Internet Security. Mission Assurance Group is independent and not affiliated with CIS.