CIS Controls v8.1: What Changed and How to Map Existing Work

Q: Were Safeguards added or removed?

No. CIS states there are 153 Safeguards in CIS Controls v8 and v8.1. Implementation Groups were not modified; Safeguard intent remains the same. Use the official v8.1 Change Log for wording-level diffs.

CIS released Controls v8.1 as an iterative update to v8. Per CIS, the update emphasises context, coexistence, and consistency — with little structural change for teams already on v8.

Verified against CIS primary sources (June 2024): Realigned NIST CSF security function mappings to CSF 2.0; new/expanded glossary definitions; revised Asset Classes and Safeguard mappings; typo fixes; clarification of thin Safeguard descriptions; addition of the Govern security function alignment with NIST CSF 2.0. CIS presents v8.1 as retaining continuity for existing users. Primary sources are cited next to each claim below.

Primary CIS sources

CIS Controls Version 8.1 — product page and “So what’s new?” list
CIS Critical Security Controls v8.1 Change Log — published 25 June 2024; downloadable spreadsheet of v8→v8.1 diffs
CIS press release: CIS Controls v8.1 — 25 June 2024 launch; iterative update; new asset classes; Govern function
CIS blog: The Ongoing Evolution of the CIS Critical Security Controls — design principles; IG continuity; Safeguard spirit unchanged
CIS Implementation Groups — “153 Safeguards in CIS Controls v8 and v8.1”

What did not change (structure)

CIS documents the same 18 Controls and 153 Safeguards for both v8 and v8.1 — v8.1 is not a renumbering event (CIS Implementation Groups; Ongoing Evolution blog). For line-level Safeguard wording diffs, use the official v8.1 Change Log (or the Excel bundled with your CIS download).

What CIS lists as new in v8.1

Realigned NIST CSF security function mappings to match NIST CSF 2.0 — CIS Controls v8.1
New and expanded glossary definitions (e.g., plan, process, sensitive data) — CIS Controls v8.1
Revised Asset Classes, with updated mappings to Safeguards — CIS Controls v8.1; CIS press release (25 June 2024)
Minor typo fixes in Safeguard descriptions — CIS Controls v8.1
Clarification of a few thin (“anemic”) Safeguard descriptions — CIS Controls v8.1
Addition of Govern-oriented alignment with NIST CSF 2.0’s Govern function — CIS Controls v8.1; CIS press release
Release / change-log date: 25 June 2024 — v8.1 Change Log; press release
No IG recomposition; Safeguard intent retained — Ongoing Evolution blog

How to map existing v8 work

Keep Implementation Group targets (IG1/IG2/IG3) unless your risk profile changed
Refresh framework crosswalks that referenced CSF 1.1 function labels
Re-read clarified Safeguard text for any control you evidence manually
Update asset inventories if you adopt the revised Documentation asset class concepts

How CyberSilo Helps

Evidence mapping in CyberSilo CSA
Detection and logging proof with ThreatHawk SIEM
Advisory scoping — contact CyberSilo

Talk to CyberSilo

Map evidence and operations with CyberSilo CSA and ThreatHawk.

Talk to CyberSilo CIS Controls hub

Frequently Asked Questions

Were Safeguards added or removed?

No. CIS states there are 153 Safeguards in CIS Controls v8 and v8.1 (Implementation Groups). The Ongoing Evolution blog notes IGs were not modified and Safeguard intent remains the same. Use the v8.1 Change Log for wording-level diffs.

Must we re-implement everything?

Usually no — focus on mapping, glossary, and clarified Safeguard wording.

v8 vs v8.1 for audits?

Tell assessors which version your crosswalks and evidence claim. Prefer v8.1 for new CSF 2.0-aligned mappings.

CIS Controls v8.1: What Changed and How to Map Existing Work

Primary CIS sources

What did not change (structure)

What CIS lists as new in v8.1

How to map existing v8 work