CIS Controls applied to AI systems

The other three frameworks in this course are about AI. The CIS Critical Security Controls are about everything, and that is their value here. A prompt-injection finding is often only as damaging as the missing basics around it: an unlogged tool call, an over-privileged token, an unknown application. CIS Controls give you a plain checklist of those basics, and in 2026 CIS extended them to AI directly.

CIS Controls v8.1 in brief

CIS describes v8.1 as an iterative update to version 8. It was guided by three principles, context, coexistence (alignment with other security frameworks) and consistency (continuity for existing users), and it realigned the NIST Cybersecurity Framework mappings to CSF 2.0, added the Govern function from CSF 2.0, revised asset classes and clarified some safeguard descriptions. The 18 controls are:

1. Inventory and Control of Enterprise Assets
2. Inventory and Control of Software Assets
3. Data Protection
4. Secure Configuration of Enterprise Assets and Software
5. Account Management
6. Access Control Management
7. Continuous Vulnerability Management
8. Audit Log Management
9. Email and Web Browser Protections
10. Defenses against harmful software
11. Data Recovery
12. Network Infrastructure Management
13. Network Monitoring and Defense
14. Security Awareness and Skills Training
15. Service Provider Management
16. Application Software Security
17. Incident Response Management
18. Penetration Testing

The AI companion guides

On 20 April 2026, CIS announced three companion guides for CIS Controls v8.1, released with Astrix Security and Cequence Security. They cover large language models, AI agents and the Model Context Protocol (MCP). The press release describes them as extending the Controls into AI systems and adapting them to AI-driven architectures. So the answer to the common question, “is there CIS guidance for AI?”, is yes, and you should read the guide that matches your system:

The LLM guide’s central message is useful to memorise. Many existing safeguards apply directly: asset management, secure configuration, identity, logging, vulnerability management and supplier governance. But implementation must account for prompt injection, retrieval poisoning, over-permissioned tool integrations and provider-driven model updates. It also highlights controls that are new in emphasis: prompt and guardrail change control, context boundary enforcement, model and dataset provenance, and containment levers to respond quickly when AI-driven workflows behave unexpectedly. The agents guide says each section interprets relevant safeguards in the context of agent behaviour, showing where traditional controls still apply and where new patterns must be considered.

A mapping you can use in a review

The table below is this course’s own illustration of how the control families translate to AI. It works at the level of control names; the companion guides map to individual safeguards, so consult them for numbered detail.

Control 18 is the entry point to the next lesson: red teaming is the AI-specific form of penetration testing. But it works best as the last check, after the earlier rows are answered. If you cannot list your agents (row 1) or tell what they did last night (row 8), a red team will mostly discover that.