Roadmap
| Stage | Duration | Outcome |
|---|---|---|
| Mobilise | Week 1 | Sponsor confirmed, charter signed, scope agreed |
| Gap assess | Weeks 2–3 | Current-state maturity heatmap and remediation backlog |
| Design | Weeks 4–6 | Policies, control matrix and risk treatment plan |
| Implement | Weeks 6–12 | Controls live, evidence captured, workforce trained |
| Internal audit | Weeks 12–14 | Audit report, findings closed, management review |
| Certification | Weeks 14–16 | Stage 1 and Stage 2 audit support |
Gantt-style timeline titled "CIS Controls v8 implementation timeline" over 16 Weeks with 6 phases: Mobilise from Week 1 to 1; Gap assess from Week 2 to 3; Design from Week 4 to 6; Implement from Week 6 to 12; Internal audit from Week 12 to 14; Certification from Week 14 to 16.
Mobilise
Sponsor confirmed, charter signed, scope agreed
Gap assess
Current-state maturity heatmap and remediation backlog
Design
Policies, control matrix and risk treatment plan
Implement
Controls live, evidence captured, workforce trained
Internal audit
Audit report, findings closed, management review
Certification
Stage 1 and Stage 2 audit support