A web-based reference tool and audit checklist for implementing CIS Critical Security Controls v8.1
The CIS Controls Audit Tool is an interactive web tool designed to help security professionals, auditors, and IT teams implement and audit against the CIS Critical Security Controls v8.1. This tool serves as both a reference guide and an audit management platform for anyone wanting to apply CIS Controls in their organization.
- ✅ Complete CIS Controls v8.1 Coverage - All 18 Controls and 153 Safeguards
- ✅ Interactive Audit Checklist - Track implementation progress with status indicators
- ✅ Implementation Group Guidance - Detailed information for IG1, IG2, and IG3
- ✅ Advanced Filtering - Filter by IG level, asset type, and security function
- ✅ Search Functionality - Quick search across all controls and safeguards
- ✅ Progress Tracking - Visual progress indicators and completion statistics
- ✅ Export Capabilities - Download audit reports for documentation
- ✅ CIS Benchmarks Reference - Information about 100+ technology benchmarks
- ✅ Framework Mapping - Alignment with NIST, ISO 27001, PCI-DSS
- ✅ Dark Mode - Eye-friendly interface for extended use
- ✅ Responsive Design - Works seamlessly on desktop, tablet, and mobile
- ✅ Offline Capable - Uses localStorage for data persistence
CIS-Audit-Tool/
├── docs/ # GitHub Pages site (web GUI)
│ ├── index.html # Main dashboard page
│ ├── controls.html # Controls explorer page
│ ├── audit.html # Audit checklist page
│ ├── implementation-groups.html # IG details page
│ ├── benchmarks.html # CIS Benchmarks reference
│ ├── resources.html # Resources and guides
│ ├── css/
│ │ ├── style.css # Main stylesheet
│ │ └── themes.css # Dark/light theme styles
│ ├── js/
│ │ ├── app.js # Main application logic
│ │ ├── data.js # CIS Controls data
│ │ ├── audit.js # Audit functionality
│ │ └── utils.js # Utility functions
│ ├── assets/
│ │ ├── images/ # Images and icons
│ │ └── fonts/ # Custom fonts
│ └── data/
│ └── cis-controls-v8.1.json # CIS Controls data
├── scripts/ # Automation scripts
│ ├── audit-templates/ # Audit templates
│ │ ├── audit-template.xlsx # Excel audit template
│ │ └── audit-template.csv # CSV audit template
│ └── generators/ # Report generators
│ └── generate-report.py # Python report generator
├── docs-content/ # Documentation
│ ├── GETTING-STARTED.md # Getting started guide
│ ├── IMPLEMENTATION-GUIDE.md # Implementation guidance
│ ├── API-REFERENCE.md # API documentation
│ └── CONTRIBUTING.md # Contribution guidelines
├── LICENSE # MIT License
└── README.md # This file
The CIS Critical Security Controls are a prioritized set of actions that collectively form a defense-in-depth set of best practices to mitigate the most common cyber attacks against systems and networks.
- 18 Controls organized into logical security domains
- 153 Safeguards providing specific implementation guidance
- 3 Implementation Groups (IG1, IG2, IG3) for prioritization based on organizational resources and risk
| Group | Safeguards | Target Audience |
|---|---|---|
| IG1 | 56 | Small/medium enterprises with limited cybersecurity expertise |
| IG2 | +74 (130 total) | Organizations with multiple departments and increased complexity |
| IG3 | +23 (153 total) | Enterprises with sensitive data and dedicated security teams |
- Inventory and Control of Enterprise Assets
- Inventory and Control of Software Assets
- Data Protection
- Secure Configuration of Enterprise Assets and Software
- Account Management
- Access Control Management
- Continuous Vulnerability Management
- Audit Log Management
- Email and Web Browser Protections
- Malware Defenses
- Data Recovery
- Network Infrastructure Management
- Network Monitoring and Defense
- Security Awareness and Skills Training
- Service Provider Management
- Application Software Security
- Incident Response Management
- Penetration Testing
No prerequisites needed! This is a static web application that runs entirely in the browser.
Simply visit the live demo to start using the tool immediately.
# Clone the repository
git clone https://github.com/SiteQ8/CIS-Audit-Tool.git
# Navigate to the project directory
cd CIS-Audit-Tool
# Open the docs folder (this is your web GUI)
cd docs
# Open index.html in your browser
# On macOS:
open index.html
# On Linux:
xdg-open index.html
# On Windows:
start index.html
# Or use a local server (recommended):
python -m http.server 8000
# Then visit: http://localhost:8000- Fork this repository
- Go to Settings > Pages
- Select "main" branch and "/docs" folder as source
- Your site will be published at
https://[your-username].github.io/CIS-Audit-Tool/
- Navigate to Audit Checklist: Click on "Audit Checklist" in the sidebar
- Filter Safeguards: Use filters to focus on specific Implementation Groups
- Mark Progress: Click checkboxes and update status for each safeguard
- Track Progress: View real-time progress indicators
- Add Notes: Document findings and implementation details
- Export Results: Download your audit report in multiple formats
- Browse Controls: Navigate to "Controls Explorer"
- View Details: Click on any control to see detailed information
- Filter & Search: Use filters to find specific controls
- Reference Safeguards: See all associated safeguards for each control
- Select Your IG Level: Navigate to "Implementation Groups"
- Review Requirements: Understand which safeguards apply to you
- Access Resources: Visit "Resources" for implementation guides
- Check Benchmarks: Reference relevant CIS Benchmarks for your technologies
All audit progress is automatically saved to your browser's localStorage. Your work persists across sessions without requiring a database or server.
- JSON: Machine-readable format for integration
- CSV: Import into Excel or other tools
- HTML: Printable audit report
- PDF: Professional documentation (coming soon)
Advanced filtering options:
- Implementation Group: IG1, IG2, IG3
- Asset Type: Devices, Software, Data, Users, Network, Documentation
- Security Function: Identify, Protect, Detect, Respond, Recover, Governance
- Status: Not Started, In Progress, Completed, Not Applicable
We welcome contributions from the community! Here's how you can help:
- 🐛 Report Bugs: Found a bug? Open an issue
- 💡 Suggest Features: Have an idea? Start a discussion
- 📝 Improve Documentation: Help make the docs better
- 🔧 Submit Pull Requests: Fix bugs or add features
# Fork and clone the repository
git clone https://github.com/[your-username]/CIS-Audit-Tool.git
# Create a new branch
git checkout -b feature/your-feature-name
# Make your changes
# Test thoroughly
# Commit your changes
git commit -m "Add: your feature description"
# Push to your fork
git push origin feature/your-feature-name
# Open a Pull Request- Getting Started Guide - Quick start guide
- Implementation Guide - Detailed implementation guidance
- API Reference - Technical documentation
- FAQ - Frequently asked questions
- CIS Controls v8.1 - Official CIS Controls page
- CIS Benchmarks - Download CIS Benchmarks
- CIS-CAT Pro - Automated assessment tool
- CIS SecureSuite - CIS membership program
- CIS Community - Join the CIS community
- SANS SEC566 - CIS Controls training
- Center for Internet Security (CIS) - For developing and maintaining the CIS Controls
- CIS Community - For collaborative development of security best practices
- Contributors - Thank you to all who have contributed to this project
This project is licensed under the MIT License - see the LICENSE file for details.
- CIS Controls® is a registered trademark of the Center for Internet Security
- This tool is not officially endorsed by the Center for Internet Security
- All CIS Controls content is used in accordance with CIS licensing terms
This tool is provided for reference and educational purposes. While it aims to accurately represent the CIS Controls v8.1, users should:
- Refer to official CIS documentation for authoritative guidance
- Validate all implementations against your organization's requirements
- Consult with security professionals for critical implementations
- Keep the tool updated with the latest CIS Controls versions
Project Maintainer: @SiteQ8
- GitHub Issues: Report bugs or request features
- LinkedIn: Connect for professional inquiries
- ✅ Complete CIS Controls v8.1 coverage
- ✅ Interactive audit checklist
- ✅ Implementation Group guidance
- ✅ Dark mode support
- ✅ Export functionality
- ⏳ PDF export for audit reports
- ⏳ Multi-user collaboration features
- ⏳ Integration with CIS-CAT Pro
- ⏳ Automated compliance scoring
- ⏳ Evidence attachment support
- 🔮 Backend API for team collaboration
- 🔮 Role-based access control
- 🔮 Custom control frameworks
- 🔮 Integration with SIEM tools
- 🔮 Automated remediation suggestions
Built with ❤️ by cybersecurity professionals, for cybersecurity professionals
"Security is not a product, but a process." - Bruce Schneier
