The original post: /r/cybersecurity by /u/Successful-Trade5395 on 2024-12-23 00:24:11.

I’m looking for some advice on how best to implement a control library across a medium sized enterprise.

I have a view of what I want to do but having never done this before, and never having seen how someone else has done it I wanted to pick your collection brains.

(1) Framework controls - I don’t actually consider these controls, more requirements.

(2) Controls should be specific, what is implemented and how.

(3) Probably best to create a custom control library which then maps to any required frameworks or standards.

(4) Assess control health and effectiveness (CCL) not compliance. Allow your GRC tool to reflect compliance automatically based on mapped control health.

(5) Use something like CMMI to assess control maturity.

Does that sound about right?

In your experience will that overburden operational staff given that meeting a single requirement might need several separate controls?

How does this work when using something like the CIS Benchmarks? Would each configuration setting be a control? Wouldn’t that lead to hundreds if not thousands of controls that have to be assessed annually?

Thank you in advance.