ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
CIS Controls implementation cost has no fixed component at all: the Controls are free to download, CIS CSAT is free to use for self-assessment, and there is no certification body to pay. What costs money is doing the Safeguards — 56 of them for IG1, 130 for IG2, 153 for IG3 — and the cost is set by how many enterprise assets and people the Safeguards have to cover, how much of the tooling already exists, and how much of the work is done by staff who already have other jobs. What follows is our own estimate, labelled as such and built the way we build every cost guide on this site: the drivers first, then the cost by Implementation Group for a typical organisation at each size, broken into tooling, staff time and external help, then a worked example and the ways the total comes down. None of the figures are CIS figures; CIS does not publish implementation cost, and the right number for any organisation is the one its own gap assessment produces.
| Driver | Effect | What you control |
|---|---|---|
| Implementation Group | IG1 is 56 Safeguards, most satisfiable with existing platforms; IG2 adds 74 that mostly need tooling; IG3 adds 23 that need specialist tools and people | Assessing honestly against the IG that fits the risk profile |
| Asset and user count | Licences for endpoint, identity, backup, logging and patching tools are per device or per user | Scope — and retiring the assets Control 1 finds that nobody needs |
| Existing platform | Microsoft 365, Google Workspace and mainstream EDR and MDM already cover many IG1 Safeguards if configured | Turning on what is licensed before buying |
| Starting gap | A CSAT score of 20% and one of 60% against IG1 are very different projects | Nothing — but the assessment tells you which one you have |
| Frequencies | Safeguards carry cycles — weekly unauthorised-asset handling, monthly patching, bi-annual inventory review — that are ongoing staff time | Automation (the third CSAT dimension) reduces recurring cost |
| Who does the work | Internal staff, an MSP or MSSP, or consultants | The sourcing model |
Our guide to the CIS Controls v8.1 covers the three groups; the CIS Controls assessment guide covers the CSAT score that sets the starting gap.
Year-one figures for an organisation starting from a typical unmanaged position — some antivirus, some backups, no inventory, no documented processes — with existing mainstream productivity and endpoint platforms. Tooling is annual licence cost for what the IG adds; staff time is internal days at a loaded rate; external help is optional consulting or managed service.
| IG1 — small organisation (25–100 users) | IG2 — mid-size (100–1,000 users) | IG3 — large or high-risk (1,000+ users) | |
|---|---|---|---|
| Safeguards in scope | 56 | 130 | 153 |
| Tooling added (annual) | $2,000 – $15,000: MFA, backup with isolated copy, DNS filtering, patch automation, disk encryption — much of it already licensed | $40,000 – $200,000: SIEM or log platform, vulnerability scanner, network monitoring, application security testing, MDM, password/identity platform | $200,000 – $1,000,000+: DLP, IDS/IPS, application allowlisting, PAM, security orchestration, penetration testing programme |
| Internal staff time (year one) | 40 – 100 days | 200 – 500 days | 1,000 – 3,000 days (a security team) |
| External help (optional) | $5,000 – $25,000 for a gap assessment, policies and configuration | $25,000 – $120,000 consulting or MSSP onboarding | $100,000 – $500,000+ for architecture, tooling deployment and testing |
| Year-one total, indicative | $15,000 – $80,000 including staff time | $150,000 – $600,000 | $800,000 – $3,000,000+ |
| Ongoing (year two on) | $10,000 – $40,000 | $100,000 – $400,000 | $600,000 – $2,000,000+ |
The CIS Controls implementation cost ranges are wide because the starting position dominates. An organisation already on a managed Microsoft 365 or Google tenancy with EDR and MDM deployed can reach most of IG1 by configuration and process for a few thousand dollars in tooling and 40 days of work; one with unmanaged endpoints and no identity platform is buying both.
| Control | IG1 Safeguards | Typical cost driver | Our estimate (small organisation) |
|---|---|---|---|
| 1–2 Asset and software inventory | 5 | Staff time to build and review; discovery via existing MDM/EDR | 10–15 staff days; $0–2,000 tooling |
| 3 Data protection | 6 | Data management process, inventory, ACLs, retention, disposal, endpoint encryption | 8–12 staff days; encryption usually licensed |
| 4 Secure configuration | 7 | Configuration baselines (CIS Benchmarks), session lock, host firewalls, default accounts | 8–15 staff days; $0–5,000 for configuration tooling |
| 5–6 Accounts and access | 9 | Account inventory, dormant-account process, dedicated admin accounts, MFA everywhere externally exposed, remote and administrative | 6–10 staff days; MFA $0–3 per user per month if not included |
| 7 Vulnerability management | 4 | Process plus automated OS and application patching monthly | 4–8 staff days; patch tooling $0–5 per device per year |
| 8 Audit logs | 3 | Log process, collection, storage | 3–6 staff days; storage cost small at IG1 |
| 9–10 Browser, email, malware | 5 | Supported clients, DNS filtering, anti-malware with auto-updates, autorun off | 3–5 staff days; DNS filtering $1–3 per user per month |
| 11 Data recovery | 4 | Process, automated backups, protected and isolated copy | 4–8 staff days; backup $2–10 per device per month |
| 12 Network infrastructure | 1 | Keep infrastructure current | 2–4 staff days; hardware refresh if end-of-life |
| 14 Awareness training | 8 | Programme plus seven topic areas | 4–8 staff days; platform $1–4 per user per month |
| 15 Service providers | 1 | Inventory | 1–2 staff days |
| 17 Incident response | 3 | Named personnel, contacts, reporting process | 2–4 staff days |
Controls 13, 16 and 18 have no IG1 Safeguards, which is why network monitoring, application security and penetration testing appear in the IG2 and IG3 columns and not before. Our guide to CIS Controls implementation sequences the IG1 work.
A 60-user professional services firm on Microsoft 365 Business Premium with Intune and Defender already licensed, no inventory, ad hoc backups, no MFA on VPN — implementing IG1, our estimate, illustrative only:
| Line | Basis | Estimate |
|---|---|---|
| Gap assessment in CIS CSAT | Internal, 3 days | $1,200 staff time |
| Tooling added | Backup with isolated copy ($6/device/month × 70), DNS filtering ($2/user/month × 60) | $6,480 per year |
| Configuration and process work | Inventory, baselines, MFA, patching, logging, recovery process, incident contacts — 50 staff days at $400 loaded | $20,000 |
| Policies and awareness programme | Documentation toolkit plus training platform ($2/user/month) | $1,900 |
| External review | Consultant validation of the CSAT evidence, 3 days | $4,500 |
| Year-one total | $34,080 | |
| Ongoing per year | Licences plus ~20 staff days for the frequencies | $16,400 |
How much does it cost to implement the CIS Controls?
Our estimate for year one: $15,000–80,000 for IG1 in a small organisation (mostly staff time), $150,000–600,000 for IG2 in a mid-size one, and $800,000–3 million or more for IG3 in a large or high-risk one — driven by asset count, existing tooling and the starting gap. The Controls themselves and CIS CSAT are free.
Is IG1 expensive?
Usually not. Its 56 Safeguards are mostly process and configuration on platforms most organisations already license; the typical additions are backup with an isolated copy, DNS filtering, MFA where it is not included, and an awareness platform.
What is the biggest cost at IG2?
Tooling for the Controls that have no IG1 Safeguards or few of them: log management and SIEM (8), vulnerability scanning (7), network monitoring (13), application security (16) and mobile device management — plus the staff to run them.
Are there certification or audit fees?
No. There is no CIS Controls certification; assessment is self-assessment in CSAT, optionally validated by a consultant at consulting rates.
What does ongoing compliance cost?
The frequencies: weekly unauthorised-asset handling, monthly patching and software review, bi-annual inventory reviews, annual process reviews. Our estimate is $10,000–40,000 a year for IG1 in a small organisation, rising with the IG; automation is what brings it down.
Budget the CIS Controls implementation cost as Safeguards times assets times starting gap: assess in CSAT first, finish IG1 by configuring what you already own before buying anything, automate the frequencies so the ongoing cost falls, and add IG2 tooling in Control order — because the Controls are free and the only expensive mistake is implementing the wrong group or buying tools before turning on the ones you have.
The 18 Control policies, the process documents the IG1 Safeguards require, the Safeguard-level tracker with Implementation Group filter and the budget model are in the CIS Controls v8.1 Toolkit, or start with the free templates.
September 21, 2026
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026