#228 - CIS CSAT (with Scot Gicking)

This episode explores the Center for Internet Security's (CIS) Controls Self-Assessment Tool (CSAT) and its practical application for CISOs. The discussion begins with an introduction to the CIS and its framework, highlighting its nonprofit nature and the value of its resources, including configuration guides for various operating systems. More significantly, the conversation focuses on the CSAT, a software tool that facilitates a comprehensive cybersecurity assessment, enabling CISOs to measure their organization's maturity level against industry benchmarks. For instance, the guest, Scott Gicking, details his experience using the CSAT to assess a client's security posture, assigning tasks to control owners, and generating reports that aid in developing a three-year improvement roadmap. The process involves evaluating policy, control implementation, automation, and reporting for each of the 18 CIS controls, with varying levels of maturity (IG1, IG2, IG3) providing progressive depth of assessment. Against the backdrop of this practical application, the hosts also discuss the challenges faced by CISOs in today's market, including the diminishing impact of reputational damage and the need to demonstrate measurable progress to secure funding for security initiatives. Ultimately, the episode emphasizes the importance of honest self-assessment, proactive planning, and building trust with senior management to effectively manage cybersecurity risks and improve organizational resilience.