A cyber defense baseline for mid-size companies: the CIS Controls IG1 safeguards
Most attacks on mid-size companies use well-known methods. CIS's Implementation Group 1 is a list of 56 safeguards built to stop them.
A company with a small IT team can't do everything security frameworks describe. It needs a short list of what matters most. The Center for Internet Security's Critical Security Controls provide one through Implementation Group 1, or IG1: 56 safeguards that CIS describes as essential cyber hygiene and an emerging minimum standard for all enterprises.
What IG1 covers
The safeguards are grouped under the CIS Controls. For a mid-size company, they fall into a few practical areas:
| Area | What IG1 asks for |
|---|---|
| Know what you have | Inventory of hardware and software, remove what's unauthorized |
| Protect data | Know where sensitive data is, encrypt it on laptops and mobile devices |
| Secure configuration | Hardened settings, firewalls on, default accounts changed, screen locks |
| Accounts and access | Account inventory, unique passwords, MFA for remote and admin access, remove unused accounts |
| Vulnerabilities | Automated patching of operating systems and applications |
| Logging | Collect audit logs and keep them |
| Email and browsers | Supported browsers and email clients, DNS filtering |
| Malware | Anti-malware on all devices, updated automatically |
| Recovery | Automated backups, with one copy isolated |
| People and process | Security awareness training, an incident response process, service provider inventory |
Why this order works
Attackers mostly use known routes. Verizon's 2026 Data Breach Investigations Report found that exploited vulnerabilities are now the top way into a network, followed by stolen credentials, and that ransomware appears in 48% of breaches. IG1's patching, MFA and backup safeguards address those three directly.
Getting it done
Start with an honest self-assessment against the 56 safeguards. CIS provides a free tool for this. Most companies find the inventory safeguards are the weakest, and they matter because you can't patch or protect what you don't know you have.
Many safeguards are settings in tools you already own, such as Microsoft 365 or Google Workspace security features, device management and backup software. The work is turning them on and checking they stay on.
What IT teams should do
- Score your company against the 56 IG1 safeguards and share the result with leadership.
- Fix inventory gaps first: devices, software and accounts.
- Turn on MFA for all remote and admin access.
- Confirm one backup copy is isolated from the network and test restoring it.