What are your views on the CIS Controls framework?

338 views2 Comments

Sort by:

VP of IT/CTO/CISO in Healthcare and Biotech3 years ago

We are using the NIST framework as our primary, but are considering adding others on top of this. The additional ones we are reviewing currently are HITRUST & CIS.

Sr Community Manager in Travel and Hospitality3 years ago

Marc Bradley Sudath Wijendra Nirav Shah Vivek A Ara Ghazaryan Hernan Garcia Mohan Bharti based your recent activity, I thought you might be interested in this question on the CIS Controls framework. If you have some thoughts, we’d love to hear them!

Content you might like

Which of these resources have you used to design cybersecurity programs?

Control frameworks20%

Program frameworks40%

Risk frameworks22%

Consultant services10%

Managed security service providers (MSSPs)5%

Other outsourcing services2%

Other

View Results

If you get hired by an SMB and you’re the company’s first/only security practitioner, where should you start? (Should you focus on SANS top 20 controls? Or start with the NIST framework?)

As organizations deploy LLMs and other AI systems, how do you recommend security teams address risks such as data leakage, prompt injection and adversarial manipulation? What frameworks or practices should be prioritized to make AI security programs resilient from day one?

How much of your internal controls for cyber risk management are framework-based?

Completely framework-based10%

Mostly framework-based47%

Even mix of framework-based and non-framework22%

Mostly non-framework12%

Completely non-framework8%

Don't know1%