The CIS Critical Security Controls are the most widely adopted prioritised control set in enterprise security, and until this spring they said nothing about AI. On 20 April 2026 the Center for Internet Security published three Companion Guides to CIS Controls v8.1 — one for AI and large language models, one for AI agents, one for the Model Context Protocol — written with Astrix Security and Cequence Security. Their premise is the right one: the Controls do not need replacing, they need "an AI-aware lens". The guides' control-by-control text sits behind CIS's free download form, so this article does the mapping in the open, using the guides' public framing, the NSA's May 2026 guidance on MCP, the OWASP lists for agents, LLMs and MCP, and the MCP specification's own normative requirements.
Two facts to anchor the rest. CIS Controls v8.1 (June 2024) has 18 Controls and 153 Safeguards, grouped into Implementation Groups: IG1 is 56 Safeguards of essential hygiene, IG2 adds 74, IG3 the remaining 23. And there is no official CIS mapping to the NIST AI RMF; the Controls map to NIST CSF 2.0, and NIST's draft Cyber AI Profile (IR 8596, December 2025) is built on CSF 2.0 — so CSF is the bridge if your auditor needs one.
What changes when the asset is an agent
CIS's agent guide puts it plainly: agents span "identity layers, endpoint execution environments, knowledge stores, integration pipelines, and operational monitoring systems", and the risks are "unauthorized actions, data leakage, unintended system changes". The MCP guide is sharper still: MCP "primarily expands the identity, access control, logging, and application security surfaces by formalizing how AI systems discover and invoke privileged capabilities." In CIS terms, that means Controls 1, 2, 5, 6, 8 and 16 carry most of the new weight — and that an MCP server should be treated, in the NSA's words, "with rigor equivalent to API gateways and privileged access systems."
The threat taxonomy to hang Safeguards on already exists. OWASP's Top 10 for Agentic Applications (ASI01–ASI10, final December 2025) covers goal hijack, tool misuse, identity and privilege abuse, agentic supply chain, unexpected code execution, memory poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation and rogue agents. The OWASP MCP Top 10 (a 2025 list, still in beta) adds token mismanagement, privilege escalation via scope creep, tool poisoning, shadow MCP servers and context over-sharing. The LLM Top 10 2026 (August 2026) covers prompt injection, sensitive information disclosure, excessive agency and supply chain. The table below cites them by ID.
The mapping: 18 Controls, read for agents, LLMs and MCP
| CIS Control | What it means for agents, LLMs and MCP | Threats addressed |
|---|---|---|
| 1 Inventory and Control of Enterprise Assets | Agents, MCP servers and clients, and model endpoints are assets. 1.1 means a register of every agent runtime and MCP server with owner and version; 1.2 means a process for unapproved ones. The NSA asks for "a clear inventory of all deployed MCP agents and tools, along with versioning, patch history, and known security concerns." Shadow MCP servers in developer dotfiles are the new unmanaged laptop. | MCP09 Shadow MCP Servers · ASI04 |
| 2 Inventory and Control of Software Assets | 2.1 inventories models, tools and MCP servers as software; 2.5–2.7 allowlist authorised software, libraries and scripts — for agents that means allowlisted tools and signed manifests. OWASP's ASI04 mitigations and the NSA both call for signed manifests with verification chains. | ASI04 · MCP04 · LLM04:2026 |
| 3 Data Protection | Prompts, context windows, agent memory and RAG stores are data stores. 3.2 inventories them; 3.7 classifies what may enter a prompt; 3.12 segments memory by sensitivity; 3.13 puts DLP on MCP egress (the NSA recommends a filtering proxy with DLP, content-length checks and keyword scanning); 3.14 logs sensitive-data access by agents. | ASI06 · MCP10 · LLM02:2026 · LLM08:2026 |
| 4 Secure Configuration | Hardened agent runtimes and tool sandboxes under 4.1: the NSA names "seccomp, AppArmor, SELinux, and AppContainer-class isolation". MCP server configuration follows the spec's MUSTs — validate Origin headers, HTTPS only, never accept tokens not issued for the server. CIS's LLM guide adds "prompt and guardrail change control" as a configuration item. | ASI05 · MCP05 · MCP07 |
| 5 Account Management | Agents are non-human identities. 5.5's inventory of service accounts must include every agent and MCP credential; 5.3's dormant-account rule catches orphaned agents. Credentials should be short-lived and per invocation — the NSA: "Every tool invocation should carry a scoped credential that permits exactly what that action requires." | ASI03 · MCP01 · MCP02 |
| 6 Access Control Management | 6.8 role-based access per tool, not per agent; scope minimisation as the MCP spec describes (start minimal, elevate incrementally, log elevation events); per-client consent for MCP proxies; 6.5 MFA on the admin consoles of agent platforms. Excessive agency is an access-control failure. | ASI02 · ASI03 · MCP02 · MCP07 · LLM03:2026 |
| 7 Continuous Vulnerability Management | 7.5/7.6 scanning extends to MCP servers, agent SDKs and model-serving stacks; track CVEs in coding agents (Claude Code CVE-2026-54316, Gemini CLI CVE-2026-12537 this summer) the way you track browser CVEs; the NSA recommends local MCP scans. | MCP04 · ASI04 |
| 8 Audit Log Management | 8.2/8.5 log every tool call, prompt, memory write and agent-to-agent message with detail; 8.9 centralise; 8.10 retain (the EU AI Act's Article 26 requires deployers of high-risk systems to keep logs at least six months); 8.12 collect service-provider logs from model APIs. The NSA notes many MCP implementations "either omit logging entirely or record only minimal operational metadata." | MCP08 · ASI10 · ASI08 |
| 9 Email and Web Browser Protections | Agents that read mail and browse the web are prompt-injection intake points. Apply URL filtering to agent egress and treat inbound content as untrusted input to the model. | ASI01 · LLM01:2026 |
| 10 Malware Defenses | Agent-generated code and downloaded MCP servers are untrusted executables. The MCP spec requires one-click installers to obtain consent before executing commands, showing the exact command untruncated. | ASI05 · MCP05 |
| 11 Data Recovery | Snapshot and rollback for agent memory and vector stores — OWASP's ASI06 mitigations call for exactly this — and version rollback for models and configurations. Backups must not be deletable with the same token the agent holds; that was the PocketOS failure. | ASI06 · ASI08 |
| 12 Network Infrastructure Management | Segment agent networks from data stores that are not mediated through tools (NSA); route agent traffic through egress proxies that block private and link-local ranges, as the MCP spec's SSRF guidance requires. | ASI07 · MCP05 |
| 13 Network Monitoring and Defense | MCP-aware proxy inspection; detect tool-name collision and drift and toolchain pivots (NSA); anomaly monitoring of inter-agent traffic. Behavioural signatures — parallel execution, tight repetition, non-human paths — belong in detection content. | ASI07 · ASI10 · MCP03 |
| 14 Security Awareness and Skills Training | Train people not to over-trust confident agent output and to recognise prompt-injection lures; OWASP's ASI09 mitigations include staff training and confidence labelling in UIs. | ASI09 · LLM07:2026 |
| 15 Service Provider Management | Model providers, API vendors and MCP-server publishers are service providers. 15.1 inventory; 15.4 contracts that carry security requirements — the EU AI Act's Article 25(4) written-agreement duty and ISO 42001's A.10.3 say the same; 15.5 assess with the CSA AI-CAIQ or a SIG AI section; 15.6 monitor; 15.7 decommission by revoking every token. | ASI04 · MCP04 |
| 16 Application Software Security | 16.4/16.5 inventory and vet third-party components, including models and tools (an AI bill of materials); 16.10 secure design — separate planning from execution and generation from execution; 16.13/16.14 penetration-test and threat-model agents. CIS and SAFECode's Secure by Design v1.1 (July 2026): "AI-generated code should be subject to the same testing, review, and validation processes as human-written software." | ASI01 · ASI05 · LLM10:2026 |
| 17 Incident Response Management | An AI-specific playbook under 17.4 (a generic IT process is a documented red flag in vendor assessments); 17.9 thresholds for agent anomalies; kill switches that revoke as well as stop; serious-incident reporting duties under the EU AI Act's Articles 26(5) and 55. | ASI08 · ASI10 |
| 18 Penetration Testing | Agentic red-teaming: test goal hijack, tool poisoning, memory poisoning and inter-agent spoofing, not just the web app in front of the model. | ASI01–ASI10 |
A note on precision: the Safeguard numbers above for Controls 1–8 and 15–18 are quoted from CIS's published list; for Controls 9–14 we have cited the Control only. Pull the Safeguard numbers from the v8.1 spreadsheet before you put them in an audit workpaper.
Where to start, by Implementation Group
If your programme is at IG1, the agent-specific additions are small and high-value: put agents and MCP servers in the asset and software inventories (1.1, 2.1), put their credentials in the service-account inventory (5.5), disable the dormant ones (5.3), collect their logs (8.2), and establish the access-granting and revoking process for tools (6.1, 6.2). That set alone addresses shadow MCP servers, orphaned agents and the "nobody knows what this agent can reach" problem that underlies most incidents.
IG2 adds the inspection layer: DLP on agent egress (3.13), detailed audit logs of tool calls (8.5), allowlisted tools and libraries (2.5–2.6), RBAC per tool (6.8), and vendor assessment for model and MCP providers (15.5). IG3 adds the adversarial work — threat modelling (16.14), penetration testing of agents (16.13, 18.x) and service-provider log collection (8.12).
The guidance that sits alongside CIS
- NSA, "Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation", 20 May 2026. Published by the NSA's Artificial Intelligence Security Center; we found no CISA co-seal, so cite it as NSA guidance. It names the protocol gaps — session-to-identity association "is not defined by the protocol", no RBAC exchange at instantiation, bearer tokens without lifecycle management — and recommends inventory, filtering proxies with DLP, injection detection, OS-level sandboxing, signed JSON-RPC payloads with expiry and replay protection, SIEM-forwarded audit logs, per-invocation scoped credentials, signed registries and network segmentation.
- The MCP specification (revision 2025-11-25). Its security best practices are normative: servers "MUST NOT accept any tokens that were not explicitly issued for the MCP server"; servers that implement authorization "MUST verify all inbound requests" and "MUST NOT use sessions for authentication"; proxies "MUST implement per-client consent". Those are configuration tests, and they belong in Control 4.
- NIST IR 8596, the Cyber AI Profile (preliminary draft, December 2025). Organised on CSF 2.0 with three focus areas — securing AI system components, AI-enabled cyber defence, thwarting AI-enabled attacks. Because CIS v8.1 maps to CSF 2.0, this is the route from a CIS Safeguard to a NIST AI outcome.
- CSA AI Controls Matrix v1.1 (June 2026). 247 control objectives across 18 domains, mapped to ISO 42001, NIST AI RMF, the EU AI Act and more. CIS maps to CSA's Cloud Controls Matrix v4, and the AICM inherits CCM's domains — a second bridge when you need an AI-specific control ID.
What does not exist yet
Three things people assume and go looking for. There is no CIS Benchmark for Azure OpenAI, Amazon Bedrock or Google Vertex AI — the Benchmarks catalogue stops at cloud foundations, compute, database and storage. There is no CIS-to-NIST-AI-RMF mapping; the Controls Navigator lists 29 frameworks and the AI RMF is not among them. And the Companion Guides interpret existing Safeguards rather than adding new ones, so a tool that claims "CIS AI Safeguard 20.x" is making it up.
How we use this
AccuroAI's evidence maps to eight frameworks, and the CIS lens fits on top of it without new plumbing: the AI inventory is Controls 1, 2 and 5; the policy engine and tool allowlists are 2 and 6; inline inspection with 40+ classifiers is 3.13 on agent egress; the attributed audit trail of every prompt, response and tool call is Control 8; AI supply-chain vetting is 15 and 16. If your auditor speaks CIS, that is the mapping we hand them.
FAQ
Did CIS add new Safeguards for AI?
No. The April 2026 Companion Guides for AI and LLMs, AI agents and MCP interpret the existing 153 Safeguards of v8.1 through an AI-specific lens; CIS says explicitly the agents guide works "rather than introducing entirely new safeguards".
Is there a CIS mapping to the NIST AI RMF?
Not an official one. CIS maps v8.1 to NIST CSF 2.0, and NIST's draft Cyber AI Profile (IR 8596) is organised on CSF 2.0, which gives you a two-step bridge. The CSA AI Controls Matrix, reachable through the CIS-to-CCM mapping, maps directly to the AI RMF.
Which Controls matter most for MCP?
CIS's own summary: MCP expands the identity, access control, logging and application-security surfaces — Controls 5, 6, 8 and 16 — plus inventory (1, 2) for shadow servers and service-provider management (15) for third-party servers.
Is the NSA MCP document joint NSA/CISA guidance?
We found no co-seal in any source describing the 20 May 2026 document; it was released by the NSA's Artificial Intelligence Security Center. Cite it as NSA guidance unless the PDF cover says otherwise.
Where do I get the Companion Guides?
Free from cisecurity.org after registration. Download all three and quote their per-Control text directly in audit workpapers; this article uses only their public abstracts.
Sources: CIS, AI Agents Companion Guide (20 Apr 2026) · CIS, MCP Companion Guide (20 Apr 2026) · CIS, AI and LLM Companion Guide (20 Apr 2026) · CIS Controls v8.1 list · CIS Implementation Groups · CIS Controls Navigator · CIS v8.1 mapping to NIST CSF 2.0 (25 Jun 2024) · CIS and SAFECode, Secure by Design v1.1 (15 Jul 2026) · NIST IR 8596, Cyber AI Profile draft (16 Dec 2025) · NSA, MCP security design considerations (20 May 2026) · MCP specification, security best practices (2025-11-25) · OWASP MCP Top 10 · OWASP Top 10 for Agentic Applications 2026 · OWASP LLM Top 10 2026 · CSA AI Controls Matrix v1.1 (Jun 2026).
Related: MCP Security · OWASP Top 10 for Agentic Applications 2026, Annotated · MCP Server Security: A 10-Step Inventory Playbook · NIST AI RMF × EU AI Act × ISO 42001: Compliance Crosswalk.