CIS Critical Security Controls v8 evidence at the per-Safeguard level — with the Implementation Group cumulative discipline auditors and cyber-insurance underwriters actually consume.
NSAuditor AI EE generates CIS Controls v8 (Center for Internet Security, May 2021; v8.1 errata June 2024) pre-audit gap reports mapped at the per-Safeguard level — the atomic, attestable unit. Signed artifacts, RFC 3161 trusted timestamps, SHA-256 chain-of-custody, suppression workflow, honest IG-cumulative framing (engine substrate is a SUBSET of each Implementation Group; the remainder is operator-side process/endpoint artifacts), no-certification-body attestation discipline — and Zero Data Exfiltration, so you can scan inside your own boundary without sending infrastructure data to a third-party SaaS scanner.
Per-Safeguard mapping at 17 covered + 21 partial + 115 OOS = 153 across 18 Controls — the atomic, attestable unit (coverage claimed at the SAFEGUARD level, never the Control level; Control-level roll-up is derived, never asserted as PASS). Engine substrate-evidences IG1 23-of-56 / IG2-cumulative 36-of-130 / IG3-cumulative 38-of-153; the remaining Safeguards are operator-side process/endpoint artifacts paired with your CSAT / CIS-CAT Pro self-attestation.
Implementation Group cumulative discipline — IG1 = 56 Safeguards (the cyber-insurance baseline; ~50-70% of mid-market policies require IG1 attestation), IG2 cumulative = 130 (IG1 + 74 IG2-only), IG3 cumulative = 153 (IG2 + 23 IG3-only). Smallest-IG-membership tagging per Safeguard; cumulative roll-up is the renderer's job. NEVER report IG2 as 74-of-74 in isolation — the IG1 base MUST be intact before any IG2/IG3 claim is valid.
No-certification-body attestation discipline — CIS Controls has no formal certification body (unlike ISO 27001's ISO/IEC 17021-1 bodies or PCI's QSAs). Engine output is INPUT to your CSAT / CIS-CAT Pro self-attestation OR a SOC 2 auditor cross-validating CIS scope OR CIS-SecureSuite peer review — NEVER "CIS certified."
CIS Controls v8 published May 2021 by the Center for Internet Security (v8.1 errata June 2024). Structure: 18 Controls decomposed into 153 Safeguards across 3 cumulative Implementation Groups (IG1 / IG2 / IG3). The most-requested next framework after SOC 2 + HIPAA + NIST CSF 2.0 + PCI DSS v4.0.1 + ISO 27001:2022 for SMB + mid-market + state/local-government + critical-infrastructure operators — and the baseline most cyber-insurance underwriters key IG1 attestation to. NSAuditor's engine is framework-agnostic — see the SOC 2, HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, and ISO/IEC 27001:2022 coverage matrices for the companion frameworks.
NSAuditor AI EE generates CIS Controls v8 per-Safeguard-level evidence — at the same institutional grade as SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, and ISO 27001.
It maps cloud infrastructure findings (AWS, Azure, GCP) and network scan results to specific Safeguards (3.3, 5.4, 8.2, 11.4, etc.), produces signed evidence artifacts (cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, RFC 3161 trusted-timestamps, cryptographic suppression signing), and ships CIS reports in machine-readable form suitable for CIS-aware GRC platform ingestion + CSAT / CIS-CAT Pro self-attestation workflow.
It is not a CIS certification (CIS has no certification body — engine output is INPUT to self-attestation). It is not an IG attestation (the IG1 base requires operator-side process/endpoint artifacts beyond infrastructure scanning). It is not a Security Awareness Training program (Control 14 — operator-side LMS). It is not an Incident Response program (Control 17 — operator-side). It is not a Penetration Testing engagement (Control 18 — operator-side). It is not a complete CIS Controls v8 attestation (153 Safeguards total; engine evidences 38 at conservative-MVP density).
What it IS: the per-Safeguard technical-evidence layer covering Control 1-2 inventory substrate, Control 3 Data Protection (access control lists + encryption-in-transit + encryption-at-rest), Control 4 Secure Configuration (firewall + Config recorder + Hardened-Image credit), Control 5-6 Account + Access Management (IAM inventory + shadow-admin + MFA), Control 7 Continuous Vulnerability Management (Inspector2 substrate), Control 8 Audit Log Management (CloudTrail substrate), Control 11 Data Recovery (AWS Backup Logically Air-Gapped Vault), Control 12-13 Network Infrastructure + Monitoring (Security Group + VPC + GuardDuty), and Control 16 Application Software Security (CI/CD guardrails + WAF) — complete and self-attestation-ready. Honest about what infrastructure scanning fundamentally cannot evidence (security-awareness training, endpoint EDR, incident-response execution, penetration testing) — saves you from the textbook CIS-canonical overclaim.
The market split: CIS-aware GRC platforms (Drata CIS Controls, Vanta CIS Controls, AuditBoard CIS) automate the self-attestation workflow + continuous evidence collection but lack deep cloud-infrastructure scanning at the per-Safeguard-evidence level. Legacy compliance scanners produce voluminous CVE reports but don't map findings to Safeguards at the IG-cumulative level. NSAuditor's wedge is the bridge — deep cloud + network scanning + CIS v8 per-Safeguard-mapped output + same Zero Data Exfiltration architecture used for the five companion frameworks.
Why per-Safeguard-level mapping
CIS Controls v8 has a 2-level hierarchy:
Control (18 — e.g., Control 3 Data Protection, Control 5 Account Management) — the top-level grouping.
Safeguard (153 — e.g., 3.3 Configure Data Access Control Lists, 5.4 Restrict Administrator Privileges, 11.4 Establish an Isolated Instance of Recovery Data) — the atomic, attestable unit each Implementation Group is defined over.
Self-attestation (CSAT / CIS-CAT Pro), SOC 2 auditor CIS cross-validation, and cyber-insurance underwriters all consume coverage at the SAFEGUARD level. Claiming "Control 4 covered" when only 3 of Control 4's 12 Safeguards are evidenced is auditor-detectable overclaim — Control-level roll-up is derived (e.g., "Control 4: 3 of 12 Safeguards evidenced"), never asserted as PASS.
NSAuditor maps at the per-Safeguard level. Per-Safeguard fields in data/compliance/cis-v8.json:
Field
Type
Purpose
safeguardId
string
Safeguard ID in canonical CIS form: N.M (e.g., 3.3, 11.4); N = Control 1-18.
controlNumber / controlTitle
int / string
Parent Control (1-18) + title (e.g., 3 / "Data Protection").
implementationGroup
enum
Smallest-IG-membership: IG1 / IG2 / IG3 — the FIRST IG that includes this Safeguard. Drives the IG-cumulative coverage summary.
securityFunction
enum
One of identify / protect / detect / respond / recover — 5 Functions (NOT 6 like NIST CSF 2.0; no Govern).
assetType
enum
One of devices / software / data / users / network / applications — the 6 CIS v8 asset types.
The 11 load-bearing schema enrichments defend against the 16 ship-blocker classes surfaced by the EE 0.13.0 P0 skill-research synthesis (Skill #19 audit-cis-controls-v8-implementation-group-perspective + the 5 companion-framework audit-skill lenses applied PRE-author at tasks/audit-cis-v8-2026-05-24.md). The reviewer pass found 0 ship-blockers — a clean ship. Every titlePattern inherits from soc2.json's grep-verified set; where no pattern matches a Safeguard, it is marked OOS (no fabricated patterns).
Implementation Group cumulative discipline
The Implementation Groups are cumulative — this is THE central institutional mechanism of CIS Controls v8, the lens cyber-insurance underwriters + CIS-CAT self-attestation + CIS-SecureSuite peer reviewers all consume IG claims through:
Cumulative means: claiming "we're IG2" = ALL 56 IG1 Safeguards AND ALL 74 IG2-only = 130 total (NEVER 74-of-74 in isolation). Claiming "we're IG3" = ALL 130 IG2-cumulative AND ALL 23 IG3-only = 153 total. The IG1 base MUST be intact before any IG2/IG3 claim is valid — operators who skip IG1 Safeguards while pursuing IG2/IG3 depth are NOT IG2/IG3 compliant (cyber-insurance underwriters reject the claim + re-classify as incomplete IG1, potentially declining or limiting coverage).
SMB, limited IT/security expertise; untargeted-attack threat model
IG2 — Foundational Cyber Hygiene (cumulative)
130
36 (28%)
Mid-market, dedicated security team, regulatory exposure; targeted-attack threat model
IG3 — Organizational Cyber Hygiene (cumulative)
153
38 (25%)
Large org, critical infrastructure, mature program; nation-state APT threat model
The engine substrate covers a SUBSET of each IG. The remaining Safeguards are operator-side process/endpoint artifacts (security-awareness LMS training, endpoint EDR, incident-response program, third-party-risk management) that pair with your CSAT / CIS-CAT Pro self-attestation. This report is INPUT to that attestation — for each covered/partial Safeguard, your self-attestation cites this report as documentation evidence; for the operator-side remainder, your self-attestation cites your LMS / EDR / IR / TPRM platform evidence.
No-certification-body attestation discipline
CIS Controls v8 has no formal certification body (unlike ISO 27001's ISO/IEC 17021-1 accredited bodies or PCI's QSAs). This report is INPUT to one of 3 operator-side validation paths — never a "CIS certification":
Validation path
What it is
When to use
1. Self-attestation
CSAT (CIS Controls Self Assessment Tool — lighter-weight) or CIS-CAT Pro Assessor (benchmark-automated, more rigorous)
Most operators; cyber-insurance renewal; customer security questionnaires
2. SOC 2 auditor cross-validation
SOC 2 Type II auditor folds CIS Controls scope into the SOC 2 evidence package (CC6/CC7/CC8 substrate)
Operators already pursuing SOC 2 — most common path
3. CIS-SecureSuite peer review
Informal community validation from comparable-organization members
CIS-SecureSuite members seeking community baseline
Never represent this report as "CIS certified" or "CIS Controls certification" — there is no such certification. Represent it as "substrate evidence supporting CIS Controls v8 IG[N] self-attestation." Overclaiming certification is the textbook CIS-canonical misrepresentation.
Coverage matrix by Control
Source of truth is data/compliance/cis-v8.json; this matrix mirrors it. The anchor-drift defense test asserts every (source, titlePattern) pair in cis-v8.json exists in soc2.json (inheritance contract — closes the silent false-CLEAN class at the CIS mapping layer, parallel to the HIPAA + NIST CSF + PCI DSS + ISO 27001 inheritance defenses).
Control
Safeguards
Covered
Partial
OOS
1 Inventory Enterprise Assets
5
0
1
4
2 Inventory Software Assets
7
1
1
5
3 Data Protection
14
3
4
7
4 Secure Configuration
12
1
5
6
5 Account Management
6
2
1
3
6 Access Control Management
8
2
0
6
7 Continuous Vulnerability Mgmt
7
2
0
5
8 Audit Log Management
12
1
3
8
9 Email & Web Browser Protections
7
0
0
7
10 Malware Defenses
7
0
0
7
11 Data Recovery
5
3
2
0
12 Network Infrastructure Mgmt
8
1
1
6
13 Network Monitoring & Defense
11
1
2
8
14 Security Awareness Training
9
0
0
9
15 Service Provider Management
7
0
0
7
16 Application Software Security
14
0
1
13
17 Incident Response Management
9
0
0
9
18 Penetration Testing
5
0
0
5
TOTAL
153
17
21
115
Conservative-MVP density: substrate-evidenceable Safeguards concentrate in Controls 1-8 + 11-13 + 16 (cloud-API-enumerable). Controls 9 + 10 + 14 + 15 + 17 + 18 are entirely operator-side (endpoint / LMS / IR / TPRM / pentest). Density expansion is deferred to EE 0.13.1+ patches.
Implementation Group Coverage Summary — IG1 / IG2-cumulative / IG3-cumulative engine-substrate table with cyber-insurance-baseline framing (the central CIS cover-page section)
Attestation-discipline disclaimer — explicit "no certification body; INPUT to CSAT / CIS-CAT Pro" prompt
Live detection (AMI-ID / image-publisher = center-for-internet-security-inc / image-project = cis-public / container-label org.cis.benchmark.profile) is a forward engine capability (EE 0.13.1+); the cisHardenedImageCredit schema field + this renderer section ship now so operators already running Hardened-Images know which Safeguards earn credit toward their self-attestation.
Sector baselines — MS-ISAC / EI-ISAC / H-ISAC
The Cloud Companion Guide v8 cross-references sector-specific baseline requirements; each Safeguard carries sectorBaselineApplicability:
CIS Controls v8 uses 5 Security Functions — Identify / Protect / Detect / Respond / Recover. NOT 6 like NIST CSF 2.0: NIST added Govern as a 6th Function in 2024, but CIS Controls v8 (published May 2021) retains the original 5-function model. The engine's per-Safeguard securityFunction field strictly rejects govern; a schema-level test asserts no Govern value leaks into the CIS securityFunction attribute (defending against cross-framework drift from the NIST CSF engine).
Each Safeguard also applies to one of 6 Asset Types — Devices / Software / Data / Users / Network / Applications. Engine substrate is strongest for Devices / Software / Data / Network (cloud-API-enumerable); weakest for Users (partial — IAM principals only) and operator-process Safeguards (OOS).
v7.1-to-v8 transition discipline
CIS v7.1 had 20 Controls + 171 Sub-Controls; v8 consolidated to 18 Controls + 153 Safeguards ("Sub-Controls" renamed to "Safeguards"). Each covered/partial Safeguard carries a v71Source field for migration cross-reference.
Migration pitfalls:
Control numbering changed (20 → 18) — Controls 19 (Incident Response) + 20 (Penetration Tests) folded into v8 Controls 17 + 18; v7.1 Control 19/20 IDs are stale and rejected at the schema layer.
Some Sub-Controls merged; terminology renamed Sub-Control → Safeguard.
5 brand-new Safeguards added in v8 (no v7.1 source).
~20 Sub-Controls changed IG assignment across versions — re-verify your IG scoping.
For the comprehensive v7.1-to-v8 mapping table, refer to CIS's published CIS Controls v7.1 to v8 Mapping document.
Cyber-insurance IG1 baseline
~50-70% of mid-market cyber-insurance policies require IG1 attestation as a coverage prerequisite (as of 2024+). IG1 is the "essential cyber hygiene" baseline. The engine evidences 23 of the 56 IG1 Safeguards via infrastructure scanning; the remaining 33 are operator-side (unique-passwords / IdP policy, endpoint encryption / MDM, security-awareness LMS, access-granting/revoking process, IR designation).
IG1 gaps are commercial-impact findings — potential coverage-invalidation, not just compliance findings. Verify the full IG1 base (engine substrate + operator-side process artifacts) is intact BEFORE submitting a cyber-insurance attestation. Underwriters commonly ask: "Show me your IG1 attestation" (must be 100% 56/56 for most policies); "How many IG1 Safeguards are in-progress vs covered?" (in-progress count as gaps for coverage-prerequisite purposes); "What's your remediation timeline for IG1 gaps?" (90-day or 180-day plan with named owner expected).
Zero Data Exfiltration — operator-controlled boundary
NSAuditor AI EE inherits the same Zero Data Exfiltration architecture across all 6 supported frameworks:
Local-only scanning — no scan data leaves the operator's environment; no SaaS dependency
Local-only AI — Claude API integration is OPTIONAL (operator-configured); air-gapped fallback for federal-contractor + classified-data scope
This architecture matters for CIS Controls v8 because Control 3 Data Protection + Control 15 Service Provider Management scrutinize where sensitive data flows — a SaaS compliance tool that ingests scan data into a third-party cloud environment introduces a new service provider per Control 15 that the operator must inventory, classify, assess, and monitor (Safeguards 15.1-15.6). Zero Data Exfiltration sidesteps that service-provider expansion entirely.
Positioning: NSAuditor + CIS-aware GRC platform (or CIS-CAT Pro) = full CIS Controls v8 coverage. NSAuditor handles the cloud-infrastructure substrate-evidence dimension where it's strongest (per-Safeguard technical configuration across AWS / Azure / GCP + signed evidence + IG-cumulative framing); the GRC platform / CIS-CAT handles host-level benchmark assessment + the self-attestation workflow + the operator-side process Safeguards (awareness training, IR, TPRM). The bundle is institutionally complete; each tool standalone leaves gaps the other fills.
CIS Controls auditor FAQ
Is this report a CIS certification?
No. CIS Controls v8 has no formal certification body. This report is INPUT to one of 3 operator-side validation paths: (1) self-attestation via CSAT or CIS-CAT Pro Assessor; (2) a SOC 2 Type II auditor cross-validating CIS scope; (3) CIS-SecureSuite peer review. Represent it as "substrate evidence supporting CIS Controls v8 IG[N] self-attestation."
Does NSAuditor map at the Control or per-Safeguard level?
Per-Safeguard — the atomic, attestable unit. 18 Controls decompose into 153 Safeguards; coverage is claimed at the SAFEGUARD level (3.3, 5.4, 11.4). Control-level roll-up is derived ("Control 4: 3 of 12 Safeguards evidenced"), never asserted as PASS.
What does "IG2 cumulative = 130" mean?
The Implementation Groups are cumulative. Claiming IG2 means ALL 56 IG1 Safeguards AND ALL 74 IG2-only = 130 total — never 74-of-74 in isolation. The IG1 base must be intact before any IG2/IG3 claim. Operators who skip IG1 while pursuing IG2/IG3 depth are NOT IG2/IG3 compliant — cyber-insurance underwriters re-classify them as incomplete IG1.
Why does CIS v8 have 5 Security Functions and not 6 like NIST CSF 2.0?
CIS Controls v8 (published May 2021) retains the original 5 Functions (Identify / Protect / Detect / Respond / Recover). NIST CSF 2.0 added Govern as a 6th Function in 2024 — but that's NIST CSF, not CIS. The engine's securityFunction field rejects govern; a schema-level test asserts no Govern value leaks into the CIS attribute.
We run CIS-Hardened-Images. Do we earn substrate-evidence credit?
Yes — for Safeguards 4.1, 4.2 (partial), and 4.6. Operators running CIS-Hardened-Images from AWS / Azure / GCP Marketplace or Docker Hub earn substantial substrate-evidence credit. The cisHardenedImageCredit field surfaces this. Live detection is a forward capability (EE 0.13.1+); the schema field + renderer section ship now.
How does IG1 coverage affect our cyber-insurance?
~50-70% of mid-market cyber-insurance policies require IG1 attestation as a coverage prerequisite (2024+). The engine evidences 23 of 56 IG1 Safeguards; the remaining 33 are operator-side. IG1 gaps are commercial-impact findings — potential coverage-invalidation. Verify the full IG1 base is intact before submitting a cyber-insurance attestation.
We're on CIS v7.1. How do we migrate to v8?
v7.1 had 20 Controls + 171 Sub-Controls; v8 has 18 Controls + 153 Safeguards. Each covered/partial Safeguard carries a v71Source field. Pitfalls: Controls 19/20 are v7.1-stale (rejected at schema layer); some Sub-Controls merged; 5 brand-new Safeguards in v8; ~20 changed IG assignment. Refer to CIS's published "CIS Controls v7.1 to v8 Mapping" document.
Can NSAuditor evidence Control 14 (Security Awareness Training), Control 17 (Incident Response), or Control 18 (Penetration Testing)?
No — these are entirely operator-side and OOS-by-design for any infrastructure scanner. Control 14 = LMS (KnowBe4 / Proofpoint / SANS); Control 17 = IR program (pair with SOAR — TheHive / Cortex XSOAR / Splunk SOAR); Control 18 = independent pentest engagement. The engine enumerates these as OOS with named operator-side platform pairings so your self-attestation knows exactly what to attach.
What's the difference between the engine substrate and a full IG attestation?
The engine substrate-evidences the cloud-infrastructure-observable Safeguards within each IG (IG1 23/56, IG2-cumulative 36/130, IG3-cumulative 38/153). A full IG attestation also requires the operator-side process/endpoint Safeguards (training, EDR, IR, TPRM) that infrastructure scanning fundamentally cannot observe. Pair the engine substrate with your CSAT / CIS-CAT Pro self-attestation for the complete IG picture.