CIS18 Framework Now Available in .legal Platform

CIS18 is an international cybersecurity framework developed by the Center for Internet Security. It consists of 18 concrete security controls that help organisations protect against common cyber threats. The controls cover hardware and software management, data protection, security incident handling, and penetration testing. The framework is continuously updated to address emerging threats and provides a structured approach to prioritising cybersecurity work.

CIS18 uses three implementation groups (IG1, IG2, IG3) to categorise safeguards based on organisational maturity and resources. IG1 contains essential controls for all organisations. IG2 adds more sophisticated controls for organisations with moderate resources. IG3 includes advanced controls for organisations with significant cybersecurity resources and expertise. In .legal, you can map each safeguard to its respective implementation group.

While both are IT security standards, CIS18 goes deeper on technical level regarding specific tasks and controls compared to ISO27001. Many organisations use CIS18 as their cybersecurity foundation and integrate it with ISO27001 compliance. The .legal platform allows you to work with both frameworks simultaneously and see how they complement each other.

Yes, CIS18 integrates seamlessly with other frameworks in .legal platform including NIS2, ISO27001, ISAE3402, and AI Act. The framework is mapped to both existing and new tasks in the .legal task catalogue, so if you're already working with other frameworks, you can immediately see your progress on CIS18 controls.

The 18 CIS18 controls are mapped as categories with specific safeguards created under each category. Each safeguard is mapped to .legal tasks which function as documentation. You can add tags to register Security Function, evaluate tasks on a 1-5 scale, and the platform calculates an overall assessment for each control. The structure follows the same logic as other frameworks in .legal.

The CIS18 framework includes 18 security controls covering: inventory and control of enterprise assets, software management, data protection, secure configuration, account management, access control, continuous vulnerability management, audit log management, email and web browser protection, malware defences, data recovery, network infrastructure management, network monitoring, security awareness training, service provider management, application software security, incident response management, and penetration testing.

Yes, CIS18 requires access to the Frameworks and Information & Cybersecurity plans in .legal platform. Once you have these plans, you can immediately begin working with CIS18 controls. The framework is already available and ready to use for planning, implementation and ongoing operation of cybersecurity controls.

You do also need to buy access to the CIS18 framework directly from the provider.

Yes, .legal supports group management for CIS18 framework. You can plan your framework across different group companies so your overall framework reflects your organisational structure. For example, you can assign different implementation groups (IG1, IG2, IG3) to different countries or subsidiaries, making it easier to manage varying security requirements across your organisation.

Log into your .legal platform and navigate to the Frameworks module. Select CIS18 from the available frameworks and begin mapping your controls. If you're already working with other frameworks, you'll immediately see your existing progress mapped to relevant CIS18 controls. You can plan from scratch or build on existing compliance work.