Security Frameworks (NIST, CIS, CSF)
Community Posts
If you’ve used the NIST incident response plan as a template, what elements required the most customization to suit your org?
What are your thoughts on CMMC 2.0?
Control frameworks18%
Program frameworks38%
Risk frameworks22%
Consultant services11%
Managed security service providers (MSSPs)5%
Other outsourcing services3%
Other
Drata5%
Vanta20%
Secureframe16%
KnowBe415%
Ostendio8%
AuditBoard4%
Something else -- I'll tell you in the comments6%
We’re not using a GRC platform22%
What are some critical NIST controls to focus on when building a cyber program for a new software startup?
I'm looking for a tool to manage application security requirements for our organization. The requirements need to include both regulatory requirements (healthcare) and threat-based requirements through a lightweight threat modeling component. So far, SD Elements looks like a lone winner in this market segment. Does anyone have experience with them or one of their competitors? SD Elements is intriguing as it would also help us track compliance to the requirements thereby helping to measure progress and outcomes.
Limited resources11%
Siloed data40%
Lack of leadership23%
Poor data quality & context18%
Lack of data control5%
Other (please explain in the comments)