How to assess risk and measure progress with the CIS Controls: CIS RAM, its IG1 workbook, the Controls as a reasonable security baseline, the Community Defense Model and the metrics in the assessment specification.
What CIS RAM is and when to use it: who developed it, the DoCRA standard and ISO 27005 and NIST SP 800-30 alignment, how it frames reasonable risk for regulators and courts, the document family and its cost.
How the CIS RAM IG1 workbook helps an enterprise with little security expertise assess its risk against IG1, what the workbook and guide contain, how it relates to CIS RAM Core and the other Implementation Group documents.
Why the CIS Controls are cited as a measure of reasonable security: the California Attorney General's 2016 statement, state safe harbor statutes that list the Controls, and how CIS RAM supports a due care argument.
What the CIS Community Defense Model v3.0 found: how it was built from attack data and MITRE ATT&CK, how much IG1 and the full Controls cover, why Safeguard 4.1 ranks first, and the Active Defense Lifecycle.
How the CIS Controls Assessment Specification turns Safeguards into measures and metrics, with examples of its failure thresholds for inventories, account lists, remediation and network reviews, and how CSAT records implementation.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.