CIS Controls v7.1 IG1

Deprecated

Best for: Organizations that adopted CIS Controls v7.1 IG1 as their security baseline and have not yet migrated to v8. IG1 targets small to medium enterprises with limited security staff, typically under 500 employees, that need minimum cyber hygiene standards without a full-time security team. Some cyber insurance providers and managed service providers still reference v7.1 in policy language or contractual obligations, making continued compliance necessary until those agreements are updated.

Mandatory?	Voluntary security baseline
Who validates?	Self-assessment or third-party
Renewal	No fixed cycle
Scope	All organizations; Implementation Group 1 (basic hygiene)
Governing body	Center for Internet Security (CIS), CIS Controls v7.1 IG1 (superseded by v8.0). Official source

Get started

Point the module source at the CIS Controls v7.1 IG1 endpoint and pin a version range you reviewed:

module "..." {
  source  = "cisv71ig1.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

cisv71ig1.compliance.tf lists every CIS Controls v7.1 IG1 module with its versions, inputs and outputs.

Enforce 1 CIS Controls v7.1 IG1 controls with one registry endpoint change.

Start free trial Get started

What compliance.tf covers and what you handle

Area	Compliance.tf automates	You handle
Access Control and Credential Hygiene	Evaluates IAM policies for wildcard service access and flagging access keys or console logins inactive beyond 45 or 90 days. Controls: iam_all_policy_no_service_wild_card, iam_user_access_key_unused_45, iam_user_console_access_unused_45, iam_user_unused_credentials_90.	Defining and enforcing an access review cadence, documenting role-based access control decisions, and handling credential revocation workflows when controls flag stale accounts.
Backup and Data Recovery	Checks AWS Backup plan configuration: a minimum 35-day retention, and encryption enabled on all recovery points. Controls: backup_plan_min_retention_35_days, backup_recovery_point_encryption_enabled.	Restore testing is on you. Document RTOs and RPOs, run periodic restore drills, and verify that recovered data passes integrity checks.
Logging and Monitoring	Checks whether S3 server access logging is enabled across buckets. Control: s3_bucket_logging_enabled.	Configuring log retention policies, setting up alerting on suspicious access patterns, and ensuring log destination buckets are secured and not publicly accessible.
Patch Management	Validates that SSM-managed instances report compliant patch status against your defined baselines. Control: ssm_managed_instance_compliance_patch_compliant.	Defining patch windows, approving patches through SSM patch baselines, ensuring all EC2 instances are registered with SSM, and documenting exceptions for instances that cannot be patched immediately.
Network Segmentation and Remote Access	Flags network ACLs that allow unrestricted inbound access on ports 22 and 3389. Control: vpc_network_acl_remote_administration.	Implementing VPN or bastion host architectures for administrative access, maintaining network diagrams, and reviewing security group rules (evaluated separately from NACLs).

Controls by category

1 of 2 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 1 are Mapped only: CIS Controls v7.1 IG1 lists them, no compliance.tf module checks them.

CIS Control 10: Data Recovery Capabilities

Organizations frequently fail here by relying on default backup settings that lack explicit retention configurations, or by leaving recovery point encryption disabled in dev and staging accounts. Auditors want to see backup plans with documented minimum retention (at least 35 days) and encryption enabled on all recovery points, not just production.

Control	Status
Backup plan rules should retain recovery points for at least 35 days	Mapped

CIS Control 6: Maintenance, Monitoring, and Analysis of Audit Logs

A common gap: CloudTrail is running for API-level activity, but S3 server access logging is off, leaving object-level read/write events unrecorded. Assessors specifically check logging on buckets handling sensitive data or serving as log destinations themselves.

Control	Status
S3 buckets should have logging enabled	Enforced

Framework	Control overlap	Note
Title 21 CFR Part 11	High 100%
FFIEC Cybersecurity Assessment Tool	High 100%
HIPAA Omnibus Rule 2013	High 100%

Frequently asked questions

CIS v7.1 has been superseded by v8. Should I still use this benchmark?

Only if you have a specific contractual or insurance requirement that references CIS v7.1 by version number. Otherwise, migrate to CIS v8 IG1. CIS publishes a v7.1-to-v8 migration guide with documented control mappings. If your cyber insurance policy says 'CIS Controls' without specifying a version, use v8.

What is the difference between IG1, IG2, and IG3?

Implementation Groups are cumulative tiers. IG1 (43 safeguards in v7.1) covers basic hygiene for organizations with limited security resources. IG2 adds safeguards for organizations with moderate risk and a dedicated IT team. IG3 covers all safeguards and targets organizations with mature security programs facing sophisticated threats. Each higher IG includes all safeguards from the tiers below it.

Does CIS require a formal audit or certification?

No. CIS Controls are voluntary and self-assessed, with no certification body or accredited auditor program. Organizations typically demonstrate compliance through internal assessments using the CIS CSAT tool or automated scanning results from tools like compliance.tf. Some industries and insurers accept CIS self-assessments as evidence of due diligence.

Why are so few controls mapped when IG1 has 43 safeguards?

Many IG1 safeguards address organizational processes (asset inventory, security awareness training, incident response planning) that cannot be verified through infrastructure-as-code scanning. The controls here cover the subset that can be technically validated against AWS resource configurations.

How long does it take to implement IG1 from scratch?

For a small AWS environment (under 50 accounts), the technical controls in this benchmark can typically be remediated in 1 to 2 weeks. The organizational safeguards not covered here (asset inventory, security training, incident response procedures) usually take 4 to 8 weeks to document and operationalize. Total IG1 implementation for a small enterprise generally runs 2 to 3 months.

Enforce 1 CIS Controls v7.1 IG1 controls with one module source change.