CIS Controls

There's a playbook for not getting hacked. Most businesses have never seen it.

The CIS Controls are a prioritised list of the defences that stop real-world attacks. The global community behind them studies real attacks and keeps the list current. Banks and governments build their security on it. We use it to protect Suffolk businesses and show you, with a score, exactly where yours stands.

18controls, in priority order
~8 in 10common attack methods blocked by the essentials
1plain-English score for your business
The problem

Most small-business security is bought, not planned

A firewall from one salesperson. Antivirus from another. A backup somebody set up years ago. Each piece felt sensible at the time, but nobody can tell you what it all adds up to or what's still wide open.

Security by gut feel

  • A pile of products, each one sold to you as "essential"
  • No way to tell whether any of it actually made you safer
  • The next spend decided by whoever rings you next
  • Insurance forms answered with hopeful guesses
  • Antivirus and crossed fingers

Security by playbook

  • One prioritised list, written by people who study real attacks
  • A score you can see and watch improve
  • Every pound aimed at your biggest risk first
  • Evidence for insurers, customers and Cyber Essentials
  • You always know what's next, and why
The playbook

18 controls. Priority order. Plain English.

Maintained by the Center for Internet Security and battle-tested for over a decade, the controls read like a to-do list because that's exactly what they are. Here's the whole thing, translated.

01

Know every device you own

Inventory & Control of Enterprise Assets
02

Know every app you run

Inventory & Control of Software Assets
03

Know where your data lives

Data Protection
04

Ditch the out-of-the-box settings

Secure Configuration of Assets & Software
05

Know exactly who has an account

Account Management
06

Give people only the access they need

Access Control Management
07

Patch weaknesses before they're found

Continuous Vulnerability Management
08

Keep the security cameras rolling

Audit Log Management
09

Guard the front doors: email & web

Email & Web Browser Protections
10

Stop malicious software cold

Malware Defences
11

Backups that actually restore

Data Recovery
12

Keep the network kit locked down

Network Infrastructure Management
13

Watch for intruders, all the time

Network Monitoring & Defence
14

Train people to spot the scam

Security Awareness & Skills Training
15

Vet the companies you rely on

Service Provider Management
16

Build software the secure way

Application Software Security
17

Have a plan for the bad day

Incident Response Management
18

Attack yourself before they do

Penetration Testing

Nobody starts with all 18. The playbook has a defined starter level called essential cyber hygiene. It is designed for smaller businesses and blocks the large majority of common attacks. Priority order is the whole point: first things first.

What it means for you

Less worry, less waste, more proof

You'll know exactly where you stand

No more wondering "are we OK?" at 2am. Your security becomes a score with plain-English notes: what's solid, what's exposed, and what it means for your business.

Money aimed at risk, not fear

Priority order means your budget goes at the biggest risk first, and much of the starter level is setup and process, not new kit. You stop buying products that don't move your score.

Proof when it counts

Insurance proposal forms, customer security questionnaires and Cyber Essentials are answered with evidence instead of guesses. Increasingly, that's the difference between winning work and losing it.

How we use it

Score. Plan. Climb.

Score

We measure your business against the playbook and turn the result into a score with plain-English notes. You get an honest picture without jargon or scare tactics.

Plan

Together we pick the order: quick wins first, urgent gaps next, nice-to-haves later. You see the cost and effort of each step before anything happens.

Climb

We work the list as part of your monthly service and re-score as we go. Security stops being a vague worry and becomes a number that keeps getting better.

Want to see this applied to Microsoft 365? The West View M365 Security Standard assesses the environment, closes the important gaps and continuously improves the baseline.

Fair questions

What most owners ask next

Aren't we too small to be a target?

Attackers don't pick targets any more. Their software scans the whole internet for any business with a gap. In the government's latest Cyber Security Breaches Survey, 43% of UK businesses (including 46% of small businesses) were hit by a breach or attack in a single year. Small firms get hit because they're less defended, not less valuable. The playbook exists precisely so a 10-person business can close the same gaps a bank would, without a bank's budget.

We've already got antivirus. Isn't that enough?

Antivirus is control 10 out of 18. It's genuinely useful, but most incidents start with a phished password, a forgotten account or an unpatched app. Antivirus sees none of those coming. (Phishing is the UK's most common attack by a distance.) That's why the playbook covers people, accounts and settings, not just software.

Our IT company says they've got it covered.

Great. Ask them one question: "covered against what list?" If the answer is "trust us", that's a feeling, not a measurement. Any provider doing the job properly should be able to show you where you stand against a recognised standard, in language you understand.

Is this another certificate, like Cyber Essentials?

No. The CIS Controls are the working playbook, while Cyber Essentials is the badge. The two overlap heavily: work through the CIS list and certification (increasingly required for contracts and insurance) becomes a formality instead of a scramble.

Do we have to do all 18 at once?

No, and you shouldn't. The controls come in levels, and the starter level is specifically designed for smaller businesses without in-house security people. It's the highest-value slice: the essentials alone block the large majority of common attack methods.

What does it cost?

The conversation about where you stand is free. Much of the starter level is configuration and process that secures what you already own. And because the list is prioritised, the investment spreads over time, aimed where it matters most.

Owen Williams Owen Williams · Managing Director

Want to know your score?

Book a relaxed 30-minute call with Owen. We'll talk through where your business stands against the playbook in plain English, with no hard sell.

01449 798119 · enquiries@westviewit.co.uk

Get your score →