ISO/IEC 27001 is a certifiable standard for running an information security management system, while CIS Controls make up a non-certifiable, prescriptive set of technical safeguards. The two are not competitors: most security teams use ISO 27001 to build governance and earn certification, then use CIS Controls to decide exactly which technical actions satisfy that governance. The fastest way to connect them is the official CIS mapping to ISO/IEC 27001:2022.
TL;DR:
- A mapping analysis found 44 shared controls and only 5 unique to ISO Annex A, but the overlap is conceptual, not one to one.
- Complete the risk assessment and Statement of Applicability before mapping; controls in organizational and people domains may need custom measures or documented justification.
- Start with CIS Implementation Group 1 for baseline hygiene, then record each Safeguard’s owner, testing frequency, and latest results as audit evidence.
- If customers or regulators require certification, plan for ISO documentation and audits; teams prioritizing risk reduction can begin with CIS Groups 1 and 2.
Table of Contents
- What ISO/IEC 27001 and CIS Controls Actually Are
- How Much Overlap Exists Between the Two Frameworks
- Using CIS Controls to Build Your ISO 27001 Evidence
- Step-by-Step: Mapping Annex A to CIS Safeguards for Your SoA
- Choosing ISO, CIS, or Both
- Where to Find the Official Mappings and Standards Text
- A Practical Take on Sequencing
- ISMS Calculator: Plan Your ISO 27001 and CIS Effort Before You Start
- FAQ
- Sources
What ISO/IEC 27001 and CIS Controls Actually Are
ISO/IEC 27001:2022 is the internationally recognized standard for building, running and improving an information security management system. Certification against it tells customers and regulators that an organization manages security risk through a formal, audited process, not through ad hoc fixes. Getting there means satisfying clauses 4 through 10 and producing a Statement of Applicability that lists which Annex A controls apply and why.
CIS Controls v8 and v8.1 take a different shape entirely. They are a prioritized, prescriptive list of 153 Safeguards grouped into Implementation Groups, built for practical cyber hygiene rather than for certification. According to Teleport’s breakdown of the two standards, ISO 27001 is typically driven by customer or regulatory demand for audited proof, while CIS Controls exist for self-assessment and technical defense against common attacks.
The practical consequence shows up in how each framework reads:
- ISO 27001 sets governance requirements: documented risk treatment, management accountability and a defensible audit trail.
- CIS Controls specify technical actions: what to configure, who owns it and how often to check it.
- An auditor can accept a well-run CIS Safeguard as evidence for an Annex A outcome, but CIS alone never produces a certificate.
Our guide to ISO 27001 Annex A controls covers what each Annex A domain requires before you start mapping anything to CIS.
How Much Overlap Exists Between the Two Frameworks
The two frameworks cover a lot of the same ground, just in different units. ISO Annex A in the 2022 edition lists 93 controls organized as outcomes, while CIS v8 lists 153 Safeguards organized as specific actions. That unit mismatch means one Annex A control often maps to several CIS Safeguards, and the reverse happens too.
A side-by-side mapping analysis found 44 shared controls between the frameworks and only 5 controls unique to ISO Annex A, which means the bulk of Annex A’s requirements have a direct technical counterpart somewhere in the CIS list.
A few points matter when reading those numbers:
- The overlap is conceptual, not one-to-one: a single Annex A clause like access control can pull in several CIS Safeguards covering account management, privileged access and session timeouts.
- CIS maintains official Safeguard-level mappings to ISO/IEC 27001:2022, published as a white paper and kept current through the CIS Controls Navigator.
- The small number of ISO-only controls tends to sit in organizational and people domains, areas CIS treats lightly because they fall outside pure technical hygiene.
That gap matters for implementation planning: it tells you where CIS alone will not finish your Statement of Applicability.
Using CIS Controls to Build Your ISO 27001 Evidence
The cleanest integration pattern treats ISO 27001 as the governance layer and CIS Controls as the technical build sheet underneath it.
- Run your ISO 27001 risk assessment first, then draft the Statement of Applicability so you know which Annex A controls actually apply to your organization.
- Map each applicable Annex A row to its corresponding CIS Safeguards using the official mapping document, pulling in the specific technical actions and recommended frequencies.
- Start with Implementation Group 1 as your baseline, since it covers essential hygiene most auditors expect to see regardless of company size.
- Treat each completed Safeguard, along with its owner and test results, as the audit evidence for the matching Annex A outcome.
Pro Tip: Keep a single tracking sheet that ties each Annex A control to its CIS Safeguard, owner and last test date; it saves hours during internal audit.
Once Safeguards are running, feed their metrics (who owns them, how often they are checked, what the last test showed) into your ISO monitoring program and management review. That is what turns a technical control into proof that your ISMS works as documented, not just that a tool is switched on.
Step-by-Step: Mapping Annex A to CIS Safeguards for Your SoA
- Complete the ISO 27001 risk assessment and build the list of necessary controls, then set up an SoA template with columns for the mapped Safeguard and justification.
- Pull the CIS Safeguard mappings for your Implementation Group and assign which Safeguards satisfy each applicable Annex A control.
- Record the Safeguard owner, testing frequency and evidence of the last test directly into your monitoring log and internal audit records.
- Where no CIS Safeguard covers an Annex A control (common in organizational or people controls), document a custom control or a clear justification in the SoA instead of leaving it blank.
Annex A domains covering awareness and training are a frequent gap point; a curated security awareness training roundup is a reasonable starting reference when CIS mappings run thin in that area.
Choosing ISO, CIS, or Both
The decision usually comes down to what is actually driving the work.
- If customers or regulators require certified proof, ISO/IEC 27001 is the requirement, and you should budget time for governance documentation and the external audit cycle.
- If the immediate need is reducing technical exposure fast, start with CIS Implementation Groups 1 and 2 before worrying about certification paperwork.
- Most mature programs run both: ISO governance work moves forward on its own track while CIS Safeguards get implemented as the technical workstream feeding evidence into it.
A common sequence is to spend an initial period on risk assessment and SoA drafting, then run CIS IG1 implementation in parallel before scheduling the certification audit.
Where to Find the Official Mappings and Standards Text
Start with primary sources rather than summaries when you need exact wording.
- The CIS Controls v8 mapping white paper gives Safeguard-by-Safeguard mapping detail to ISO/IEC 27001:2022.
- The ISO/IEC 27001:2022 standard page covers the clauses and Annex A context directly from the source.
- Third-party mapping and coverage analyses are useful for planning once you have the primary text in hand.
A Practical Take on Sequencing
Teams that struggle with audits usually built their technical controls before they knew what Annex A required of them. The order that works: risk assessment, then SoA, then prioritized CIS Safeguards, then measurement and review.
A simple traceability matrix, one row per Annex A control with its mapped Safeguard, owner and evidence, is the single artifact auditors and management reviewers both ask for repeatedly. Before committing budget to either track, it is worth running a quick effort estimate so the sequencing above fits your actual resourcing.
— Martin
ISMS Calculator: Plan Your ISO 27001 and CIS Effort Before You Start
We built our ISO 27001 Cost Calculator to give you an organization-specific estimate of effort and cost before you commit a budget to either the ISO governance track or the CIS technical build.
Our platform estimates are tailored by company size, industry and current security maturity, and you can save multiple scenarios to compare different approaches.
- Run our free readiness check to see where your gaps sit before planning.
- Use our Readiness Assessment to gauge how much governance and technical work remains.
- Use estimates and planning artifacts to brief stakeholders or consultants on timeline and cost.
Start with the free check or run an instant estimate on our cost calculator to get a preliminary plan in minutes.
FAQ
Which is better, NIST or CIS?
Neither is strictly better; NIST CSF is a broader risk management framework while CIS Controls are a prescriptive, technical action list, and many organizations use them together. Our comparison of ISO 27001 and NIST CSF covers how each functions alongside technical control sets like CIS.
Is ISO 27001 outdated?
No, the current edition is ISO/IEC 27001:2022, which updated Annex A’s structure and remains the active certifiable standard. Organizations pursuing certification today work against the 2022 version, not an older one.
Are CIS Controls mandatory?
No, CIS Controls are non-certifiable and voluntary, meant for self-assessment and practical hygiene rather than third-party audit. Some contracts or insurers may reference them informally, but no certifying body issues a CIS credential.
Which is better, ISO 27001 or NIST?
The right choice depends on your driver: ISO 27001 suits organizations that need a certified, auditable ISMS for customers or regulators, while NIST CSF suits those wanting a flexible risk management structure without certification. Many teams use ISO 27001 for governance and reference NIST or CIS for technical depth underneath it.
Do I need both ISO 27001 and CIS Controls?
You do not strictly need both, but combining them is common: ISO 27001 gives you certified governance and CIS Controls give you the technical specifics to satisfy many Annex A outcomes. Our guide to ISO 27001 certification requirements walks through what the certification process itself expects.
Sources
- CIS Controls v8 Mapping to ISO/IEC 27001:2022
- ISO 27001 vs CIS v8 — Framework Comparison | ControlMap
- ISO/IEC 27001:2022 - Information security management systems
- Goteleport