What are your views on the CIS Controls framework?

332 views2 Comments

Sort by:

VP of IT/CTO/CISO in Healthcare and Biotech3 years ago

We are using the NIST framework as our primary, but are considering adding others on top of this. The additional ones we are reviewing currently are HITRUST & CIS.

Sr Community Manager in Travel and Hospitality3 years ago

Marc Bradley Sudath Wijendra Nirav Shah Vivek A Ara Ghazaryan Hernan Garcia Mohan Bharti based your recent activity, I thought you might be interested in this question on the CIS Controls framework. If you have some thoughts, we’d love to hear them!

Content you might like

Organizations should invest in a data governance framework preemptively.

Strongly agree18%

Agree66%

Neutral11%

Disagree3%

Strongly disagree

View Results

As organizations deploy LLMs and other AI systems, how do you recommend security teams address risks such as data leakage, prompt injection and adversarial manipulation? What frameworks or practices should be prioritized to make AI security programs resilient from day one?

We have a new GRC tool and we're selecting frameworks like NYDFS, SOC2, NIST CSF, COSO, etc. We have financial, IT, and operational controls. What frameworks are other companies implementing with their GRC tools to map operational controls?

Our organization is embarking on ISO certification for security and privacy in the cloud. We are looking for best practices to implement ISO whilst being mindful of the rigor needed to manage with multiple standards. From our initial review we were informed of BSI's PAS 99 and wanted to understand: 1. Pros and Cons 2. Adoption i.e. has it been widely adopted across business landscape, specifically in the insurance sector embarking on ISO certifications? 3. Are there alternatives or best practice recommendations when embarking on cloud ISO security and privacy certifications? Also, we understood that the current certification I.e. ISO/IEC 27017:2015 looks to be replaced by ISO/IEC DIS 27017 - Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services. Do you recommend waiting for the revision in its current stage or progress with the incumbent certification and have a subsequent review once the new version is published?

“Risk quantification frameworks need to be combined to be effective.”

Strongly agree13%

Agree61%

Neutral13%

Disagree10%

Strongly disagree

Other (tell us in the comments)

View Results