- CIS Critical Security Controls (CSC), formerly SANS Top 20, are a prioritized, actionable set of cybersecurity practices maintained by the Center for Internet Security.
- Organized into three Implementation Groups (IGs). IG1 (essential cyber hygiene), IG2 (plus operational complexity), IG3 (sophisticated adversaries).
- 18 controls with 153 safeguards across the current version, focused on the highest-impact defensive actions first.
- Particularly popular with mid-market organizations looking for practical, actionable controls without the complexity of NIST 800-53.
- ComplianceForge documentation maps CIS CSC to NIST CSF, NIST 800-53, ISO 27001 and 200 plus frameworks through the SCF.
Taking ICS, OT and IOT Into Account
For years, the “CIA Triad” stood as the foundation for what a security program was designed to address – the Confidentiality, Integrity and Availability of both systems and data. That has now changed, since there are real-world safety considerations from Operational Technology (OT) and the Internet of Things (IoT). This has caused the evolution of the CIA Triad into the Confidentiality, Integrity, Availability and Safety (CIAS) model.
The SCRP is designed around the CIAS model by adopting the best of leading security frameworks.
The SCRP Comes In Both Microsoft Word & Excel Formats
The DSP is ready to import into your Governance, Risk & Compliance (GRC) solution, since it comes in both Microsoft Word and Excel formats. This makes the import from Excel easy. For many GRC tools, this provides you the ability to perform your customization and collaboration directly from your GRC portal.
If you do not currently have a GRC tool, but want to deploy the DSP from a user-friendly internal website, we can help with that. We offer a fixed-cost service to convert the DSP into an internal website using GRAV, a Content Management System (CMS). If that interests you, please contact us at support@compianceforge.com and we can provide you with more details on that option.
The Excel version of the DSP comes with the following content so it is easy to import into a GRC solution (e.g., ZenGRC, MetricStream, Ostendio, Archer, RSAM, MetricStream, etc.):
