cisecurity

“We use the CIS Controls to help our clients achieve compliance with state and federal cybersecurity regulations. The CIS 18 are prioritized, easy to understand, and extremely cost-effective for small to mid-size organizations looking to prove they are secure enough to do business in today’s marketplace. I highly recommend starting with CIS in building your cybersecurity program.”

“The CIS Control framework along with CIS-RAM are exactly what you need to develop organizational cyber defense capabilities , as well conducting cyber risk assessment to make well-informed decisions about prioritization and implementation of the CIS Controls regardless of organization complexity in-line with global best practices. CIS framework is easy to map with program and risk frameworks, and reverse mapping features.”

“CIS controls and standards help new Fintechs like TASConnect by providing a clear set of baselines for secure configuration of common digital assets. By following a well-defined path to minimize the attack surface, TASConnect was able achieve a more mature security posture within a short time for its security set up. This has also enabled TASConnect to demonstrate its security posture and cybersecurity commitment.”

“The CIS Controls are the friendliest framework for organizational security. They constitute a clear path to success that's built and updated by a small community of subject matter experts who are always looking for additional guidance and refinement.”

“The CIS Critical Security Controls have always provided a prioritized list of security controls to quickly secure your environment. Even if you can’t do everything (and let’s face it, most people can’t), you can easily create a plan for intelligently moving forward.”

“Version 8 is the biggest improvement yet. The implementation groups make prioritization and ROI more understandable than ever before. Using clear explanations of degrees of implementation combined with industry consensus on scoring removes a large amount of subjective bias making the result easier to explain to leadership and to gain buy in on initiatives to further improve security controls.”

“We built our cybersecurity program from the ground up, using the CIS Controls as a guiding light. Our CIS Controls Tactical Plan has since served as a compass, not just pointing the way but shaping how we move. It is more than a checklist. It is a framework that sharpens our focus, tempers our strategy, and aligns our actions with intention. In a space where complexity thrives, this plan brings clarity. It has been instrumental in maturing our security posture, not through noise, but through discipline, structure, and rhythm.”

“CIS’ collaborative correlation between standards facilitates the time to market our supplied assets covered by the CIS Benchmarks.”

“Thank you for your efforts to better secure the overall cyber environment.”

“We needed to reach a security compliance for one of our clients and using CIS we were able to generate reports to prove our process”

“CIS Benchmarks are very useful to apply security best practices on our platform and for the secure configuration of our system.”

“Without this resource, the hardening of our devices would have taken a lot longer and required many meetings between IT and Security to debate which configuration settings to change and the impact they could have. The CIS Benchmarks provided the necessary information to alleviate many of the fears IT may have had with changing specific settings.”

“Since we switched over to a standardized CIS Benchmark, it’s easy for us to give the auditor the data and say: We’re using CIS and these devices are going to be compliant with that, because we implement the CIS Benchmarks through group policy. If we fall in alignment with these configuration standards, it just clearly makes sense that it could really lighten the workload on the team of the State of Minnesota. I’m really impressed [by] the value you get with CIS. It’s huge.”

““Prior to Albert, I had no mechanism for fully analyzing my incoming and (just as importantly) outgoing electronic traffic. I now have a reliable, affordable, and trusted source that inspects ALL of my traffic in both directions.””

“The CIS Controls help security become transparent and predictable, and allow us to communicate security requirements across the organization.”

“There is no penalty for not achieving 100 percent implementation. Resource constraints may prevent 100 percent implementation, but you can rank your own maturity and adjust accordingly.”

“In our view the best thing about the CIS Controls is the metrics guidance provided to measure effectiveness. Metrics help answer the question ‘Is it worth it?’”

“Just do it! This is just another valuable tool in your toolbelt of layered defense.”

““The CIS Controls are a tool that allows us to help smaller organizations develop information security programs and improve their security posture,””

““This is where the CIS Controls are almost perfect for establishing a security baseline for smaller organizations.””

“The initial concerns are: what is the work effort going to be, how much is it going to cost, and what do we focus on first? There are concerns you would expect. There will be areas where there are no gaps that we can say to leadership we are already implementing and maintaining the CIS Controls.”

“Now we are going to do a gap analysis to define where we are to help us identify the work effort that we will need and how to get us to where we want to be.”

“Florida is following the NIST Cyber Security Framework as the basic framework for Information Security. The CIS Controls are known set of best practices. As a non-profit organization, we are trying to balance what the government and private industry are doing. In rewriting our policies and procedures, we decided to build in the CIS Controls into our standards.”

““We like the fact that such a broad base of security professionals were involved with creating, drafting, and prioritizing the CIS Controls based on what is really going on out there in the world.””

““We are in a very competitive business, and we always have to balance the business needs with the security needs.””