CIS Controls v8.1 and CMMC Level 2: what changes for practitioners

At a glance

What this is: Secureframe argues that CIS Controls v8.1 is a structured baseline for cyber hygiene and compliance, but it does not fully cover the full CMMC Level 2 obligation set.

Why it matters: For IAM, PAM, NHI, and broader security teams, the key question is where a strong baseline ends and CMMC-specific evidence, process, and control gaps still begin.

By the numbers:

• CIS Controls v8.1 includes 18 controls and 153 safeguards.
• Secureframe says CIS Controls v8.1 maps to about 73 of 110 CMMC Level 2 practices.
• Secureframe says CIS Controls v8.1 covers 66% of CMMC Level 2 requirements.
• Secureframe says 37 additional CMMC practices still need separate treatment.

Context

CIS Controls v8.1 is best understood as a prioritised cyber-hygiene baseline, not a complete compliance target. It gives teams a structured way to reduce common attack paths, but CMMC Level 2 adds obligations that go beyond control implementation and into evidence, process, and specific defence-contractor requirements.

The identity angle is real, even in a broader cybersecurity article, because several CIS Controls touch access control management, account hygiene, and governance of the control environment. For IAM and PAM teams, the practical question is whether those controls map cleanly to a CMMC programme or whether they only cover part of the required operating model.

Where organisations already have a security programme, CIS Controls often serve as the foundation layer rather than the finish line. That makes this article most relevant to teams deciding how much of their compliance work can be standardised versus where CMMC-specific controls still need dedicated ownership.

Key questions

Q: What is the main gap between CIS Controls and CMMC Level 2?

A: CIS Controls provide strong baseline coverage for common cyber hygiene, but CMMC Level 2 adds practices that are not fully covered by those safeguards. The biggest gap is usually not technical capability alone, but the extra documentation, personnel, physical security, and process evidence that CMMC expects. Teams should treat CIS as a starting point, then map the unmapped practices separately.

Q: Why do CIS Controls help with CMMC preparation but not certification on their own?

A: Because CIS and CMMC overlap in several control areas, especially access control, configuration, and monitoring, but they are not identical programmes. CIS helps reduce duplicate work and standardise the baseline, while CMMC still requires specific practices and assessment evidence that CIS does not automatically satisfy. A mapped control is helpful, but it is not proof of compliance.

Q: What do teams get wrong about CIS benchmark compliance?

A: The common mistake is treating compliance as evidence that the environment is secure. CIS benchmark compliance shows that a system matches a baseline at a point in time, but it does not prove the baseline is current, the exceptions are controlled, or the identity layer is sound. Governance still needs lifecycle oversight and ownership.

Q: How should organisations use CIS Controls as a foundation for CMMC Level 2?

A: Treat CIS Controls as the prioritised security baseline and CMMC Level 2 as the compliance overlay. Implement the CIS safeguards that most improve access control, configuration, logging, and incident response first, then perform a gap analysis against the remaining CMMC practices that require separate evidence or policy work.

Technical breakdown

How CIS Controls v8.1 is structured as a baseline

CIS Controls v8.1 is a prioritised set of 18 controls broken into 153 safeguards. Each safeguard is a measurable action, which is why the framework works well as an implementation baseline rather than an abstract policy standard. Version 8.1 also reflects updated governance language and revised asset classes, which makes it easier to align operational security work to the actual environment being defended.

Practical implication: Treat CIS as a sequencing framework for core cyber hygiene, not as a substitute for compliance-specific control interpretation.

Why CIS Control mapping helps, but does not finish CMMC Level 2

CIS mapping reduces duplication by showing where common safeguards overlap with CMMC expectations. But a mapping is not the same as full coverage. Some CMMC practices are only partially represented, while others are not represented at all, especially where the requirement is administrative, documentary, or tied to defence-contract specifics rather than general cyber control intent.

Practical implication: Use the mapping to identify reuse opportunities, then build a separate gap list for unmapped CMMC practices and partial overlaps.

Why access control and governance remain the hardest part of the overlap

The strongest overlap between CIS and CMMC is usually in access control, secure configuration, and monitoring. The harder work is proving that access governance, account management, and control ownership are operating consistently enough to satisfy an assessment regime. That is where identity security programmes intersect directly with compliance evidence, especially when privileges, users, and service accounts all share the same environment.

Practical implication: Align IAM, PAM, and control evidence workflows early so the programme can show both effective control operation and assessor-ready documentation.

Threat narrative

Attacker objective: The attacker seeks to exploit control gaps that remain after baseline hygiene is in place, especially where identity, configuration, or monitoring weaknesses broaden access.

1. Entry often begins with weakly governed accounts, misconfigurations, or exposed services that sit outside the intended control baseline.
2. Escalation becomes easier when access control, configuration, and monitoring are only partially implemented or inconsistently evidenced.
3. Impact is broader when the organisation assumes baseline cyber hygiene automatically satisfies defence-contract obligations that require additional controls and documentation.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

CIS Controls v8.1 is a baseline standard, not a compliance end state. The article makes clear that prioritised safeguards help teams organise cyber hygiene, but the framework does not absorb every CMMC Level 2 obligation. That distinction matters because compliance programmes fail when teams confuse overlap with completeness. Practitioners should treat CIS as the foundation layer and not as the final evidence model.

Control mapping reduces work, but it does not reduce accountability. A mapped safeguard can support both CIS and CMMC, yet the organisation still has to prove that the control exists, operates, and is documented in the right context. That is especially true where the remaining CMMC requirements are about personnel, physical security, maintenance, or artefact handling rather than core technical protections. Teams should separate reuse from closure.

Identity governance is one of the clearest overlap zones. The article’s access-control emphasis shows why IAM and PAM teams are central to making CIS useful for CMMC preparation. If account lifecycle, privilege scope, and access review evidence are weak, the overlap is only theoretical. Practitioners should expect identity controls to be the first area where baseline security work meets audit-grade expectation.

CIS Controls v8.1 signals a more governance-aware cyber baseline. The addition of governance language and updated asset categories reflects a market move from pure technical hygiene toward control operating models. That helps security leaders, but it also raises the bar: once governance is part of the baseline, programme owners must show ownership, measurement, and traceability. Practitioners should plan for evidence-driven control management, not just implementation.

What this signals

Control overlap is useful only when it is translated into ownership and evidence. CIS Controls v8.1 can shorten the path to a stronger baseline, but defence contractors still need a separate view of what CMMC Level 2 demands beyond shared safeguards. That means identity, access, documentation, and physical-process evidence should be treated as programme assets, not by-products of a framework mapping.

CIS Control mapping is now a governance exercise as much as a technical one. The updated focus on governance in v8.1 reinforces that security teams need named owners, control cadence, and traceable evidence for each safeguard. For practitioners, the practical shift is from implementing controls in isolation to managing them as an operating model that can withstand assessment.

Access control remains the clearest bridge between cyber hygiene and compliance. Where account management, privilege scope, and review evidence are weak, CIS and CMMC both become harder to defend. IAM and PAM teams should therefore focus on proving that access is not only restricted, but also explainable and repeatable across the programme.

For practitioners

• Map CIS safeguards to CMMC Level 2 practices before remediation Build a side-by-side matrix that distinguishes full overlap, partial overlap, and unmapped CMMC practices so the team can prioritise work by gap type.
• Separate technical controls from documentation obligations Assign explicit owners for the CMMC practices that are not satisfied by CIS implementation alone, especially where the requirement is procedural or evidentiary.
• Review identity and access evidence early Collect account inventory, privilege assignments, and access review artefacts before assessment timelines compress the programme.
• Validate the remaining CMMC-specific controls independently Test the practices that CIS only covers partially, including physical security, personnel screening, maintenance procedures, and CMMC-specific documentation.
• Use governance requirements to drive control ownership Tie each safeguard to a named control owner, review cadence, and evidence source so the implementation can support both operational security and audit readiness.

Key takeaways

• CIS Controls v8.1 gives organisations a practical, prioritised security baseline, but it does not replace the additional obligations in CMMC Level 2.
• The overlap between CIS and CMMC can reduce duplicate work, yet several CMMC practices still require separate treatment, especially in documentation and non-technical controls.
• For practitioners, the right use of CIS is to accelerate baseline maturity while explicitly tracking the gaps that still need CMMC-specific ownership and evidence.

Key terms

• Cis Controls: A prioritised set of cybersecurity safeguards designed to reduce common attack paths through practical, measurable actions. They are broken into controls and safeguards so organisations can assign ownership, sequence remediation, and collect evidence without building a security programme from scratch.
• Cmmc Level 2: A defence-contract compliance target that requires a defined set of security practices and supporting evidence. It goes beyond implementing controls in principle and expects organisations to show that the practices are operating consistently and are backed by documentation.
• Implementation Group: A CIS classification that helps organisations stage control adoption based on risk and available resources. IG1, IG2, and IG3 are not maturity labels. They are rollout guides that help teams decide which safeguards are reasonable to implement first and how far to expand over time.
• Control Mapping: Control mapping is the process of linking internal policies and technical controls to external requirements such as NIST or ISO 27001. For identity programmes, it turns access reviews, rotation, and offboarding into evidence that can be tested, reported, and audited.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in a way that supports identity and security practitioners alike. It is designed for teams that need a clearer operating model for identity control across modern environments.