CIS Controls and COBIT 2019

ISC Chapter 10 · Area II · Blueprint II.A

NIST gave Brightwater a map. Now it wants a practical to-do list and a way to run IT as a business. The CIS Controls are the to-do list: 18 prioritized controls, from 'know what devices you own' to 'test your defenses like an attacker', grouped so a small company knows where to start. COBIT 2019 is how the board and management govern information and technology so it creates value. Priya walks Brightwater through both, and by the end you can recall what each CIS Control covers and why it matters, and name COBIT's governance principles and the components of a governance system.

In this chapter

The CIS Controls: a prioritized to-do list
Controls 1 to 6: know, protect and control access
Controls 7 to 12: harden, watch and recover
Controls 13 to 18: people, partners, code and practice
COBIT 2019: governing information and technology
COBIT 2019: components and objectives

This chapter has 6 lessons, 50 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

Overview of the 18 CIS Controls
COBIT governance principles and components

Chapter 9: NIST frameworks · Chapter 11: Threats and attacks