CIS Control 1 Guide: Safeguards, IGs and Evidence

CIS Control 1 is the first control most assessors test, and many organisations fail it on evidence rather than effort: they have tools that see assets but cannot prove the inventory is complete, current and acted on. This guide is a safeguard-by-safeguard implementation page for Control 1 in CIS Controls v8.1. It explains what each of the five Safeguards requires, which Implementation Group (IG) needs it, how the CIS Controls Assessment Specification measures it, and what evidence an auditor will ask for. For the wider engineering problem of discovery sources, CAASM, cloud inventories and securing the CMDB, read the Asset Inventory and CMDB Security Guide; this page assumes that context and focuses on meeting and proving the control. It is written for security and IT managers, GRC and internal audit teams, and consultants running CIS assessments.

Key takeaways

Five Safeguards, three of them automation. 1.1 and 1.2 are IG1 and can be met with process and simple tooling; 1.3 (active discovery) and 1.4 (DHCP logging) arrive at IG2, and 1.5 (passive discovery) at IG3.
The cadences are hard thresholds. The Assessment Specification scores a Safeguard as zero if the inventory has not been updated for more than six months (1.1), if unauthorised assets are handled less often than every seven days (1.2) or if active discovery runs less often than every 24 hours (1.3).
Accuracy is measured by comparison. Assessors compare your approved inventory with everything discovered since its last update; the gap in both directions is the score.
Required fields are specific. Safeguard 1.1 asks for network address (if static), hardware address, machine name, data asset owner, department and whether the asset is approved to connect.
Control 1 is the foundation for later Controls. Software inventory (Control 2), secure configuration (Control 4), vulnerability management (Control 7) and log coverage (Control 8) are only as complete as this list.

What it is and who it applies to

CIS describes Control 1 as actively managing (inventorying, tracking and correcting) all enterprise assets connected to the infrastructure, physically, virtually, remotely and in cloud environments, so the enterprise knows the full set of assets it must monitor and protect and can find unauthorised and unmanaged assets to remove or remediate. The scope named by CIS covers:

End-user devices: desktops, laptops and mobile devices, including portable and remote ones.
Network devices: routers, switches, firewalls, wireless access points.
Non-computing and IoT devices: printers, cameras, building systems and similar connected equipment.
Servers: physical, virtual and cloud-hosted.
Assets you do not own: Safeguard 1.1 includes assets regularly connected to the enterprise network even if not under enterprise control, which in practice means BYOD and contractor devices.

Control 1 is about hardware and infrastructure assets that can store or process data. Software belongs to Control 2, data to Control 3 and accounts to Control 5. CIS Controls v8.1 (an iterative update to v8, released in June 2024) added a Govern security function aligned with NIST CSF 2.0, revised the asset classes and expanded the glossary; CIS states the update should cause little or no change for existing users. See the CIS Controls Guide for the framework as a whole.

Who it applies to: the CIS Controls are voluntary, so Control 1 applies wherever an organisation has adopted the Controls, is assessed against them by a customer, insurer or regulator, or uses them as its baseline. IG1, which CIS calls essential cyber hygiene, is the starting point for every enterprise; IG2 builds on it and IG3 includes every Safeguard. Small organisations can meet IG1 with a controlled spreadsheet and a weekly review; larger ones need the IG2 automation to keep pace with change.

Structure and key requirements

Safeguard	Title	IG	Requirement in brief	Cadence
1.1	Establish and Maintain Detailed Enterprise Asset Inventory	IG1, IG2, IG3	Accurate, detailed, up-to-date inventory of all enterprise assets that can store or process data, including cloud and remote assets and regularly connected assets not under enterprise control	Review and update at least bi-annually
1.2	Address Unauthorized Assets	IG1, IG2, IG3	A process to deal with unauthorised assets: remove from the network, deny remote connection, or quarantine	Weekly
1.3	Utilize an Active Discovery Tool	IG2, IG3	Use an active discovery tool to identify assets connected to the enterprise network	Execute daily or more frequently
1.4	Use DHCP Logging to Update Enterprise Asset Inventory	IG2, IG3	Use DHCP logging on all DHCP servers or IPAM tools to update the inventory	Review and use logs weekly or more frequently
1.5	Use a Passive Asset Discovery Tool	IG3	Use a passive discovery tool to identify assets connected to the network	Review and update inventory at least weekly

How to read the Safeguards in practice

1.1 is a record, not a scan. The inventory is the approved list with ownership and approval status. Discovery outputs feed it; they are not it. The minimum fields are network address (if static), hardware (MAC) address, machine name, data asset owner, department and network approval status. Most organisations add asset type, location, operating system, last-seen date and criticality.
1.2 is a process with a clock. An unauthorised asset is anything discovered that is not in the approved list. The process must decide within a week: approve and register it, remove it, block remote connection, or move it to a quarantine network or VLAN.
1.3 means scheduled, automated scanning. One-off quarterly scans do not meet "daily". Agent-based tools alone do not count as active discovery because they only see assets that already have the agent.
1.4 closes the gap between scans. Every DHCP lease is a device joining the network. The Safeguard is met when DHCP logging is enabled on every DHCP server and the inventory consumes those logs.
1.5 catches what scans miss. Passive tools observe traffic, so they find devices that drop probes and fragile equipment that must not be actively scanned. The assessment measures how many network segments a properly configured passive tool covers.

Identity and NHI requirements

Control 1 does not mention identities, but two links to identity matter in practice.

The owner field is an identity attribute. Safeguard 1.1 requires a data asset owner. Pulling owners from the identity provider and HR system, and flagging assets whose owner has left, keeps ownership accurate. An asset whose owner is a disabled account is effectively unowned.
Discovery tools run with privileged credentials. Authenticated active discovery uses domain, SSH or cloud API credentials that can reach every asset. Treat these as privileged non-human identities: vault them, scope them to read-only where possible, rotate them and monitor their use. See the Service Account Security Guide.
Cloud and test environments are assets too. Forgotten tenants, subscriptions and test environments hold identities and integrations. In the Microsoft Midnight Blizzard breach, the attacker's foothold was a legacy, non-production test tenant account without MFA, and a test OAuth application in it had elevated access to the corporate environment.
Non-human identities need their own inventory. Service accounts, API keys and certificates are governed under Control 5 and related work rather than Control 1, but they should be linked to the assets that host them. See the Service Account Inventory Template and the CIS Control 5 Account Management Guide.

Implementation steps

The order below meets IG1 first, then adds IG2 and IG3 automation. Each step produces evidence you will need later.

Define scope and the record. Write down which networks, sites, cloud accounts and device classes are in scope, and the mandatory fields for an asset record (at least the 1.1 fields). Name the system of record: a CMDB, an asset management tool or, for a small IG1 organisation, a controlled spreadsheet.
Seed the inventory from what you already have. Export from endpoint management (MDM, EDR, configuration management), the directory, cloud provider inventories, network device configurations and procurement records. Deduplicate on hardware address, serial number or cloud instance ID.
Assign owners and approval status. Every record gets a data asset owner and department. Mark each asset approved or unapproved. Unowned assets go to a triage queue, not into the approved list.
Stand up the 1.2 process. Define who reviews new and unauthorised assets each week, the decision options (register, remove, deny remote access, quarantine) and where decisions are recorded. Network access control or a quarantine VLAN makes the quarantine option real; see the Network Access Control (NAC) Guide.
Schedule active discovery (IG2). Configure a scanner to sweep every in-scope subnet at least daily and write results into the inventory automatically. Use authenticated scans where possible. Pilot on one site, check load and false positives, then expand. Exclude fragile OT segments and cover them with passive tools instead; see the OT Asset Visibility Guide.
Turn on DHCP logging (IG2). Enable logging on every DHCP server and IPAM tool, forward logs centrally and configure the inventory to ingest them. Reconcile devices seen in DHCP logs but missing from the inventory at least weekly.
Deploy passive discovery (IG3). Place sensors on SPAN ports or taps for each network segment, documented against your network architecture diagrams (Safeguard 12.4). Track which segments have no sensor.
Run the bi-annual review. At least every six months, reconcile the approved inventory against the aggregate of all discovery since the last review, fix incomplete records and sign off. Keep the signed record.

Rollback and safety: new active scans should start in a low-intensity profile with a change record and a named contact for each site; if a device misbehaves under scanning, exclude it, record the exclusion and cover it with passive monitoring rather than stopping discovery.

Quick wins

Export endpoint management and cloud inventories into one list and compare them; the difference is your first unauthorised and unmanaged asset report.
Enable DHCP logging today, even before IG2; it is cheap and gives immediate visibility of new devices.
Add the owner field to every record and report the percentage still blank each week.

Evidence and assessment

The CIS Controls Assessment Specification defines inputs, measures and metrics for each Safeguard. Knowing them tells you what to collect.

Safeguard	Evidence an assessor expects	Measure or metric	Automatic fail
1.1	Current approved inventory with required fields; aggregate list of everything discovered since last update; date of last update; documented procedure for adding and removing assets	Accuracy: discovered assets present in the inventory divided by all discovered assets. Completeness: records with all required fields divided by all records	No inventory, or more than six months since last update
1.2	Written process, the defined timeframe, a list of unauthorised assets and the action taken on each	Share of unauthorised assets no longer reachable on the network after the timeframe	Timeframe longer than seven days
1.3	List of active discovery tools, their schedule and configuration, scan results, evidence that results update the inventory	Asset discovery coverage: discovered assets divided by inventoried assets; tools configured to the approved standard	Scan interval longer than 24 hours, or no active discovery tool
1.4	List of DHCP servers with logging status; configuration showing the inventory ingests DHCP logs; devices in DHCP logs missing from the inventory	DHCP logging quality: DHCP servers with logging divided by all DHCP servers	None defined
1.5	Network architecture documentation; list of passive tools, their configuration and the networks each covers	Networks covered by a properly configured passive tool divided by all networks	None defined

Practical points for the evidence pack:

Timestamps matter more than screenshots. Export reports with generation dates, scheduled task configurations showing frequency, and tickets showing weekly 1.2 decisions.
Show both directions of the gap. Assets in the inventory not seen by discovery (possibly retired or offline) and assets discovered but not in the inventory (unauthorised) are both expected.
Owned but disconnected devices need manual evidence. The specification notes that devices not connected to the network must be discovered manually; stock records and loan registers cover them.
Test yourself with samples. Pick devices at random on site and in the cloud console and confirm each has a complete record before the assessor does the same.

Metrics to run the control

Inventory accuracy: the 1.1 accuracy ratio, measured monthly; aim for steady improvement towards full coverage.
Record completeness: percentage of records with every required field, especially owner.
Time to disposition: median days from discovery of an unauthorised asset to a decision; must stay under seven.
Discovery freshness: percentage of assets seen by any source in the last 7 days.
Segment coverage: networks covered by active and by passive discovery.

Mapping to other frameworks

Framework	Reference	Relationship to Control 1
NIST CSF 2.0	ID.AM-01 hardware inventories; ID.AM-08 life cycle management; DE.CM-01 network monitoring	1.1 aligns with ID.AM-01; removal under 1.2 supports ID.AM-08; discovery under 1.3 to 1.5 supports DE.CM-01
NIST SP 800-53 Rev. 5	CM-8 System Component Inventory; CM-8(1) Updates During Installation and Removal; CM-8(2) Automated Maintenance; CM-8(3) Automated Unauthorized Component Detection; CM-8(4) Accountability Information; PM-5 System Inventory	CM-8(3) is the closest match to 1.2 and 1.3; CM-8(4) to the owner field in 1.1
ISO/IEC 27001:2022 Annex A	A.5.9 Inventory of information and other associated assets; A.8.1 User endpoint devices	A.5.9 requires an inventory with owners; Control 1 adds the discovery cadence
CISA BOD 23-01 (US federal civilian agencies)	Automated asset discovery every 7 days	A stricter government benchmark covered in the Asset Inventory and CMDB Security Guide
Other CIS Controls	Control 2 software assets; 4.1 secure configuration process; 12.4 architecture diagrams	The assessment specification links 1.3 to 4.1 and 1.5 to 12.4

Related sibling pages: the CIS Control 2 Inventory and Control of Software Assets Guide and the CIS Control 7 Continuous Vulnerability Management Guide, which depends on this inventory to know what to scan.

Common pitfalls

Treating a scanner report as the inventory. Without owner and approval status it fails 1.1's required fields and gives 1.2 nothing to compare against.
A process for 1.2 that exists only on paper. If there are no weekly tickets or decisions, assessors will score the timeframe as unmet.
Scanning only the data centre. Remote, cloud and branch assets are explicitly in scope. Laptops that rarely join the corporate network need agent or cloud-management data to appear at all.
Forgotten environments. Test tenants, lab networks and old cloud accounts fall out of discovery scope while keeping live credentials and trust paths, as the Midnight Blizzard case shows.
Unprotected discovery credentials. A scanner account with domain admin rights stored in plain text in a tool's configuration is itself a high-value target.
Letting records age. More than six months between full reviews is an automatic zero for 1.1, however good the tooling.

Practitioner checklist

Document scope, the system of record and mandatory fields, including owner, department and approval status.
Seed and deduplicate the inventory from endpoint, directory, cloud and network sources.
Run a weekly unauthorised asset review with recorded decisions (register, remove, deny remote access, quarantine).
Schedule authenticated active discovery of every in-scope subnet at least daily (IG2).
Enable DHCP logging on every DHCP server and IPAM tool and feed it into the inventory weekly (IG2).
Deploy passive discovery on each network segment and record coverage against architecture diagrams (IG3).
Vault, scope and rotate the credentials used by discovery tools.
Complete and sign a full reconciliation at least every six months and keep the evidence.
Report accuracy, completeness, time to disposition and segment coverage monthly.

CIS Control 1 Inventory and Control of Enterprise Assets Guide: Safeguards, Implementation Groups and Evidence