What are the three main categories of the CIS 20 framework?

What are the three main categories of the CIS 20 framework?

The CIS separates the controls into three categories irrespective of the industry. The three main categories of the CIS 20 framework are as below:

Basic Controls: These controls are the most basic and fundamental security measures that should be taken to protect an organization's assets and data. Basic controls include things like user access control, malware protection, and patch management.

Foundational Controls: These controls are designed to build upon the basic controls and provide an additional layer of security. Foundational controls include things like data encryption, secure configuration, and security awareness training.

Organizational Controls: These controls are designed to ensure an organization is following best practices and meeting its specific security objectives. Organizational controls include things like risk assessments, incident response plans, and audit logging.