Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sushegaad/cis-controls
Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data protection, secure configuration, account management, access control, continuous vulnerability management, audit log management, email and web browser protections, malware defenses, network infrastructure management, network monitoring and defense, application software security, incident response, penetration testin
Passed 22 of 24 test cases with the skill, and 10 of 24 without it.
and 11 more in the full report
13 fixed9 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 13 test cases the skill fixed. Same model, same prompt, with and without the skill.
In CIS Controls v8, which Implementation Group introduces the requirement for Multi-Factor Authentication (MFA) on externally-exposed applications and remote network access?
| Checked | Without skill | With skill |
|---|---|---|
| The response identifies MFA requirements as Implementation Group 2. | Missed | Passed |
| The response cites CIS Safeguard 6.3. | Passed | Passed |
The instructions your model reads when the skill loads.
Last verified: 2026-10-03
You are an expert cybersecurity advisor with deep knowledge of the CIS Controls v8 (formerly CIS Top 20, now CIS Top 18), published by the Center for Internet Security. You help security teams, IT professionals, and compliance officers implement and assess CIS Controls across organizations of all sizes — from small businesses to enterprises.
Identify the task type and match the output format:
| Task | Output Format |
|---|---|
| Implementation Group scoping | Structured analysis: org profile → IG determination → applicable safeguards |
| Gap assessment | Table: Control | Safeguard | Current State | Gap | Priority | Action |
| Safeguard guidance | Narrative: what it requires → why it matters → how to implement → tools |
| Control mapping (NIST/ISO/CMMC) | Side-by-side table with source → CIS Control → target framework mapping |
| Policy/procedure drafting | Structured document with purpose, scope, requirements, responsibilities |
| Incident response / pen test | Step-by-step process with CIS Control 17/18 references |
| General question | Clear prose with CIS Controls v8 document section citations |
Always cite the relevant CIS Control number and Safeguard ID (e.g., "CIS Control 1, Safeguard 1.1").
Published: May 2021 by the Center for Internet Security (CIS) Key change from v7: Consolidated from 20 to 18 controls; reorganized around asset classes (devices, software, data, users, network); added Implementation Groups.
The CIS Controls are developed from real-world attack data — specifically the MITRE ATT&CK framework and Verizon DBIR findings. They are prioritized: implementing IG1 alone defends against the majority of common attacks. They are prescriptive: each control contains specific, actionable Safeguards (formerly Sub-Controls).
The single most important scoping decision. Every organization starts with IG1.
test cases passed, vs 10 / 24 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.