Written by a practitioner who runs this in production.
The framework tells you what. This library is the how: the 18 controls as real playbooks, what good looks like, how to implement it on a Windows / AD / Microsoft 365 estate, the common mistake, and the evidence an assessor asks for. Written by a working security practitioner.
See what's in the library First: how ready am I? →
Score your essential-hygiene posture first, then take the one-page reference. Both are genuinely useful on their own, and the best way to judge whether the paid library is worth it.
Answers Where do we stand on essential cyber hygiene?
Fifteen plain-English questions across the highest-consequence IG1 safeguards, giving you a banded score and the single most valuable thing to do next, in about ten minutes.
Best for pinning above your desk
The whole framework distilled: the 18 controls with the one thing to get right on each, the Implementation Groups, the four safeguards that save you, and the order to do it all in.
IG1 is the 56 safeguards that define essential cyber hygiene, the floor every organisation is judged against. Answer honestly for the whole organisation. Score each: Yes = 2, Partly = 1, No or Don't know = 0. This is a self-assessment, not a certification.
JavaScript is off, so score it yourself: Yes = 2, Partly = 1, No = 0, out of 30. 25+ is a strong IG1 posture; 17 to 24 has real gaps; 9 to 16 is early; under 9 is exposed. Whatever your total, a "No" on questions 3, 4, 11 or 12 is worth fixing before anything else, they are the four that save you.
Prefer paper? The printable worksheet is in the free cheat sheet and the Starter Pack workbook.
A guided workbook and the complete 56-item IG1 checklist. Enough to get a small team to essential cyber hygiene, and everything maps straight onto the Core library when you outgrow it.
Best for a small team starting cold
One guided document you work top to bottom: scope, your Implementation Group, governance, a first self-score, a starter risk list, the four that save you, and a gap list that becomes your project plan.
Best for a fast self-assessment
All 56 IG1 safeguards as concrete items, each with what "done" looks like, plus Status / Owner / Evidence columns so it doubles as an assurance tracker with a per-control roll-up.
The Workbook and the IG1 Checklist together, the fastest way to find out where you stand and what to fix first.
Launching shortly
Eleven deliverables that fit together: the playbooks explain it, the tracker records it, the inventories and registers feed it, the policies document it, the roadmap sequences it, the maturity workbook scores it, and the board pack proves management owned it.
All eleven deliverables in one download. Built for the IG1-bound SMB and the consultant, MSP or internal team serving one, proportionate, practical, and mapped to the frameworks you already report against.
Launching shortly
The CIS Controls are how you implement the technical measures NIS2 Article 21 demands. Pair the Playbook Library with the NIS2 Compliance Toolkit and cover both the controls and the directive with one connected evidence base, at a saving over buying them apart.
Every tier is a step up from the last, and each one credits into the next. Start where you are.
| Tier | What you get | Best for | Price | |
|---|---|---|---|---|
| Free | IG1 readiness scorer + one-page cheat sheet | "Where do we stand?" | $0 | Start |
| Entry | Starter Pack: Implementation Workbook + 56-item IG1 Checklist | A small team starting cold | Coming soon | Preview |
| Core | Playbook Library: 18 playbooks, 153-safeguard tracker, inventories, registers, policies, roadmap, maturity + audit workbooks, board pack | Building an evidenced programme | Coming soon | Preview |
| Premium | Team / MSP Edition · Workshop Pack | Delivering CIS to others | Coming soon | See both |
| Bundle | CIS Playbook Library + NIS2 Compliance Toolkit | Controls and the directive together | Coming soon | See bundle |
No. This is independent implementation guidance written by a practitioner. The authoritative CIS Controls and Safeguards text is owned by CIS and is free at cisecurity.org/controls. We reference and paraphrase the framework for implementation, we do not reproduce it, and this is not a CIS certification.
IG1-bound SMBs and the consultants, MSPs and internal IT/security teams serving them. It is written to be proportionate, a 40-person firm is not held to a hospital's standard, and it is anchored to CIS Controls v8.1 with a strong Windows / Active Directory / Microsoft 365 focus.
Editable working files: the playbooks, roadmap, maturity workbook, audit workbook and board pack as PDFs; the 153-safeguard tracker, inventories, risk register and framework mapping as spreadsheets; the eight policies as ready-to-adopt templates. Nothing is DRM-locked and nothing phones home.
Yes. Every one of the 18 controls is cross-walked to ISO/IEC 27001:2022 Annex A, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev. 5 and NIS2 Article 21. Collect the evidence once and satisfy multiple assessments, and most cyber-insurance questionnaires. If you also face NIS2, see the Controls + Compliance bundle.
The free CIS material tells you what each safeguard requires. This tells you how to implement it on a real estate: what good looks like, the Microsoft-stack specifics, the common mistake that fails an audit, how to validate it, and the exact evidence to file. Plus pre-filled trackers, inventories, registers, policies, a phased roadmap and a board pack. The blog shows the depth for free, read it first.