CIS Controls

A prioritized set of cybersecurity best practices published by the Center for Internet Security, designed to help organizations defend against the most common attacks.

The CIS Critical Security Controls are a widely recognized framework that breaks security down into practical, specific actions, such as keeping an inventory of devices and software, managing accounts, protecting data and maintaining backups. The controls are organized into Implementation Groups, with the first group (IG1) describing essential cyber hygiene suitable for smaller organizations with limited IT resources.

For an Alberta small business, the CIS Controls offer a clear starting point instead of a vague goal of being secure. They help you prioritize spending, show insurers and clients that you follow a recognized standard, and give your IT provider a common checklist to work from. They pair well with Canadian guidance such as the Canadian Centre for Cyber Security's baseline controls for small and medium organizations.

Practical tip: ask your IT provider to assess your business against Implementation Group 1 and produce a short gap list. Tackle the highest-risk gaps first, and review progress once or twice a year.