Beyond the Checklist: How to Build a Real Security Strategy Using CIS 18
Moving from "Implementation Groups" to Business Value without getting stuck in Inventory Purgatory.
The CIS Critical Security Controls (CIS 18) are arguably the gold standard for technical defense. They are prescriptive, prioritized, and blissfully free of the vague “management speak” found in some other frameworks.
But let’s be clear: A list of controls is not a strategy.
If you hand your Board of Directors a spreadsheet showing progress on “Control 4.1: Establish and Maintain a Secure Configuration Process,” you have failed strategically. You are selling them ingredients when they ordered a meal.
Having built security programs from the ground up and remediated mature ones, I’ve found that the biggest challenge isn’t technical implementation—it’s strategic alignment. Here is how to turn the CIS 18 from a checklist into a viable security strategy, without drowning in the details.
1. The “IG1 Floor” vs. The Risk-Based Ceiling
The CIS framework organizes controls into Implementation Groups (IG1, IG2, IG3). The standard advice is to treat these linearly: finish IG1 (Cyber Hygiene), then unlock IG2, then IG3.
In the real world, it rarely works that cleanly.
Your approach should depend entirely on the maturity of your current environment:
For “Greenfield” (No Program): If you have little to no security program, IG1 is mandatory. You cannot implement advanced defenses if you don’t have the basics. Treat IG1 as the floor—the “must-haves” to simply exist safely on the internet.
For “Brownfield” (Existing Program): If you have a substantial environment, a linear approach is too slow. You need to “cherry-pick” based on risk. You need a baseline of Control 1 (Inventory) to perform risk management, but once that is established, you should jump ahead.
Strategy Tip: Don’t wait to perfect IG1 before grabbing high-value controls from IG2 or IG3 that address your specific threats (like Ransomware protection). Cross-reference your foundational controls against your highest risks.
2. Escaping “Inventory Paralysis”
Controls 1 (Hardware) and 2 (Software) are the graveyard of many well-intentioned security strategies. The logic is sound: “You can’t protect what you don’t know.”
However, many CISOs stall their entire roadmap trying to reach 100% asset inventory accuracy. You will never get to 100%. If you wait for perfection here, you will never get to Control 6 (Access Control Management) or Control 8 (Audit Logs).
The Strategic Unlock: Aim for “Good Enough to Manage.” Once you reach a confidence level where you can make consistent progress, stop treating inventory gaps as a Project Task and reclassify them as an Operational Compliance Violation.
This is a critical psychological shift for your team:
Project Task: “We can’t move on until engineering figures out what these 50 orphaned servers are.” (Stalls progress).
Operational Violation: “The project is complete. These 50 servers are now non-compliant tickets for the GRC/Ops team to chase down as BAU.” (Allows progress).
3. Translate “Controls” into “Business Objectives”
When presenting your strategy to leadership, never use the CIS Control names. Mapping controls to business outcomes is the only way to secure budget and buy-in.
Don’t tell the Board you are implementing “CIS Control 10 (Malware Defenses).” Tell them you are executing a strategy to “Reduce the risk of Ransomware halting production for 3+ days.”
Group the controls into buckets that match your business goals:
Protecting Customer Data (Data Protection, Access Control)
Ensuring System Uptime (Recovery, Infrastructure Defense)
Preventing IP Theft (DLP, Insider Threat)
4. The “Hybrid Metric” Scorecard
How do you measure success? A simple “85% Implemented” score is dangerous because it masks reality. You might be 90% deployed on a tool, but if the missing 10% represents your crown jewels, your risk is still maximum.
Use a hybrid metric: Quantitative % + Qualitative Narrative.
The Number: “We are 92% compliant on Endpoint Defense.”
The Narrative (The Real Gap): “However, the remaining 8% consists of legacy servers that process our most critical transactions. Therefore, despite the high score, the actual risk remains High.”
This approach forces honesty and highlights where the actual work remains.
5. A Final Caveat: It’s a Tool, Not a Religion
Finally, remember that CIS 18 is not always the right hammer for the nail.
While it is an excellent baseline, there are instances where following a different roadmap is more beneficial. If you are a defense contractor, you live and die by NIST 800-171. If you are highly regulated in Europe, ISO 27001 might be your primary driver.
Use CIS 18 to make your environment safer, but don’t follow it off a cliff if it conflicts with your business reality. The goal is a secure business, not a perfectly checked list.