Pontis ← Back to Products

CIS Controls v8 IG1 Gap Assessment

A sample readiness review, run in the same format used for a Vigil Certus client engagement — from intake through a prioritized remediation roadmap.

Intake Summary

• Team size: Solo operator (owner-only access to core systems)
• Core stack: Google Workspace for email, docs, and identity; a CRM/automation platform for client relationships; a payment processor for recurring billing
• MFA status: Enabled across email, CRM, and payment processor accounts
• Written policies: None currently documented
• Data handled: Client contact information and business data across several product lines; payment card data is processor-hosted, not stored directly

Why This Matters

A business selling recurring services to other companies eventually gets asked a version of "how do you protect our data," whether that's a vendor security questionnaire, a cyber insurance renewal, or a larger client doing basic diligence before signing. Most small operators have never been asked to formalize what they already do, so the gap isn't usually the technology, it's the documentation and the process behind it.

Gap Assessment Against CIS Controls v8, IG1

Rated Present / Partial / Absent based on intake. IG1 covers 56 safeguards across 18 controls, the baseline designed for small and resource-limited organizations. Safeguards not applicable to a solo, cloud-based operation are marked accordingly rather than scored.

Control	Safeguard	Status	Notes
1. Inventory of Enterprise Assets	Maintain asset inventory	Partial	Devices used to run the business exist but aren't documented anywhere
2. Inventory of Software Assets	Maintain software/SaaS inventory	Absent	No running list of what SaaS tools hold business or client data
3. Data Protection	Data inventory and classification	Absent	No documented list of what client data is collected, where it lives, or how long it's retained
3. Data Protection	Encrypt data at rest and in transit	Present	Inherited from platform defaults; not independently verified or documented
4. Secure Configuration	Secure default configurations	Partial	No documented baseline for account settings across core platforms
5. Account Management	Unique accounts, no shared logins	Present	Solo operator, no shared credentials by default
6. Access Control Management	MFA on all accounts	Present	Confirmed across email, CRM, and payment processor
6. Access Control Management	Centralized access control	N/A yet	Becomes relevant the moment a contractor or VA is added
7. Vulnerability Management	Patch management	Partial	Cloud SaaS tools patch themselves; no review process for third-party app permissions
8. Audit Log Management	Enable and retain audit logs	Partial	Logs generated by default; nothing reviewed or retained intentionally
9. Email/Browser Protections	DNS filtering, anti-phishing	Absent	No DMARC/SPF/DKIM verification confirmed for the business domain
10. Malware Defenses	Anti-malware on all endpoints	Absent	No confirmed endpoint protection on devices used to run the business
11. Data Recovery	Automated backups, tested recovery	Absent	No documented backup of CRM data or business documents outside vendor-side retention
14. Security Awareness Training	Security awareness program	Absent	Not yet needed solo, becomes a real requirement with the first hire
15. Service Provider Management	Inventory and assess service providers	Absent	No documented list of vendors with access to client or business data
17. Incident Response Management	Written incident response plan	Absent	No plan exists for what happens if an account is compromised or data is exposed

What This Actually Means

Two encouraging findings: MFA is genuinely in place everywhere, the single highest-leverage control and the one most solo operators skip. And the core platforms provide strong baseline encryption and logging by default, so the underlying infrastructure isn't the weak point.

The real gap is documentation and process, not technology. Nothing here requires buying new tools. It requires writing down what already exists, adding backups, and building the two or three processes that matter most before they're urgently needed, specifically before adding a contractor, and before a client or partner asks for proof.

Prioritized Remediation Roadmap

Do first — this month, low effort, highest leverage:

1. Turn on automated backup/export for CRM data and business documents. This is the largest actual exposure right now, since there is currently no recovery path if access is lost or an account is compromised.
2. Verify SPF/DKIM/DMARC are correctly configured on the sending domain. Affects email deliverability and closes a phishing/spoofing gap.
3. Write a one-page software/SaaS inventory: every tool with access to client or business data, what it touches, who has login access.

Do next — before adding any contractor or VA:

1. Draft a written information security policy covering account access, data handling, and device use.
2. Draft a one-page incident response plan: what to do first if an account is compromised, who to notify, how to rotate credentials.
3. Set up endpoint protection on the primary device(s) used to run the business.

Do before it's asked for — positions the business ahead of a client or partner request:

1. Build a vendor/service provider inventory documenting what each platform does with client data, and where their own compliance posture stands.
2. Establish a quarterly review cadence: revisit the software inventory, confirm backups are working, confirm MFA is still enforced everywhere.

Evidence Folder Starter

Once the items above are complete, the following should be kept on file and easy to produce on request:

• Screenshot or export confirming MFA enforcement across all core platforms
• SPF/DKIM/DMARC verification record
• Backup configuration confirmation and one successful test restore
• Signed information security policy and incident response plan
• Software/vendor inventory, dated and version-controlled