• Watch a preview of this course • Discover how to take this course: Online, In-Person sans.org/sec566 SEC566: Implementing and Auditing CIS Controls What are CIS Controls? The CIS Controls (formerly known as Critical Security Controls) are a recommended set of prioritized cyber defense best practices. They provide specific and actionable ways to protect against today’s most pervasive and dangerous attacks. SANS provides CIS Controls v8 training, research, and certification. Version 8, released in May 2021, is a Change to the Entire Controls Ecosystem and provides backwards compatibility with previous versions and a migration path for users of prior versions to move to v8. Whether you use the CIS Controls or another control framework to guide your security improvement program, it is critical to understand that a controls list is simply a starting point. With the release of version 8, CIS added new tools and guides to the CIS controls ecosystem to help organizations: • Implement, track, measure, and assess controls • Prioritize controls based on evolving threats • Justify investment in CIS Controls implementation • Implement CIS Controls best practices for mobile devices and applications • Apply CIS Controls best practices to cloud environments • Comply with multiple frameworks by providing a map of regulatory frameworks Organizations need to defend their information systems and there are many solutions, requirements and tools to navigate. Which solutions should be implemented first? What will reduce the most risk and defend against the most common attacks? SANS and CIS have mapped the most common and likely threats and attacks to a prioritized list of mitigations called the CIS Controls. These controls are regularly reviewed to ensure they continue to mitigate the the ever- evolving threat and surface-area landscape. By following the CIS Controls, organizations will reduce cyber risk, measure, and report on residual risk. SEC566 will enable you to master the specific and proven techniques and tools needed to implement and audit the controls defined in the Center for Internet Security’s (CIS) Controls. Students will gain direct knowledge of the CIS Controls and ecosystem of tools to implement CIS controls across organizations complex networks, including cloud assets and third-party risk. Additional tools to measure both CIS Control coverage as well as assess risk throughout the program will be provided. This in-depth, hands-on critical security controls training will teach security practitioners to understand not only how to stop a threat, but why the threat exists, and how to ensure that security measures deployed today will be effective against the next generation of threats. SEC566 shows security professionals how to implement the CIS Controls in an existing network through cost-effective automation. For auditors, CIOs, and risk officers, this course is the best way to understand how you will measure cybersecurity control effectiveness. In addition, CIS Controls are mapped to other frameworks to ensure compliance as well as security leveraging the CIS Controls. You Will Be Able To • Apply security controls based on actual threats that are measurable, scalable, and reliable in stopping known attacks and protecting your organization’s important information and systems • Understand the importance of each control and how it is compromised if ignored • Explain the defensive goals that result in quick wins and increased visibility of network and systems • Identify and use tools that implement controls through automation • Create a scoring tool to measure the effectiveness of each control • Employ specific metrics to establish a baseline and measure the effectiveness of security controls • Competently map CIS Controls to compliance and standards such as PCI- DSS, the NIST Cybersecurity Framework (CSF), ISO 27000, and more • Audit each of the CIS Controls with specific, proven templates, checklists, and scripts provided to facilitate the audit process Business Takeaways • Efficiently reduce the most important cyber-related risks • Align compliance requirements with security and business goals and solutions • Report the status of cybersecurity defense efforts to senior leadership in clear, business terms • Enjoy peace of mind that your organization has a comprehensive strategy for defense and compliance 5 Day Program 30 CPEs Laptop Required GCCC Critical Controls giac.org/gccc “ All week long I have been noting the topics and items I want to bring back to my team to improve various operations. This content is perfectly aligned with the work I am doing. So yes, this was an excellent course.” —Thad Zeitler, Athena Health