It is likely not a coincidence that Verizon #DBIR chose CIS Controls for mapping safeguards associated with breach patterns. enterprise.verizon.com/resources/repo… 
@CISecurity demonstrates how the controls map to the all important ATT&CK that is as relevant/actionable to security risk management as anything out there. cisecurity.org/controls/cis-c…
(Image recreated)
(Image recreated)
It is certainly not a coincidence that this letter calling for an overhaul of #HIPAA #Security #regulation and #enforcement recommends CIS Controls as the guidance framework. bit.ly/2JZPHe6
If one says that a security controls framework is risk-based, one should be able to demonstrate it.
Choose your security controls framework wisely.
