Those safeguards are also sufficiently advanced to resist or detect targeted skilled attackers, rather than the more general and opportunistic attacks countered by the basic safeguards. If we look at the implementation groups, group 1 is essentially for everyone, group 2 requires dedicated employees and some enterprise-grade solutions, and group 3 is for organizations with risk management, application security, penetration testing and other teams in-house. IG1 is intended to replace the earlier way of thinking about the controls, where the initial controls formed the priority rather than a width first approach, leading to some organizations getting stuck and never getting to bits such as having a working backup strategy and hence were unable to recover from a ransomware attack. One minor thing to notice is that those are also no longer referred to as sub-controls, but as safeguards. In version 7.1 CIS introduced Implementation Groups, abbreviated IG, which is a guidance in the recommended order of priority for implementing the different sub controls.

Critical security controls version 7