A tailored course, built for your situation
Direct sign-off authority on CIS Controls implementation scope
Own the control mapping decisions without escalation
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Who this is for
Senior IC in security engineering or compliance implementation with cross-org experience
Who this is not for
Entry-level analysts or those focused solely on audit preparation without decision influence
What you walk away with
- Make binding decisions on system inclusion in CIS Controls audit scope
- Define completeness criteria for control remediation without escalation
- Approve control implementation artifacts for review cycles
- Lead cross-functional alignment on control applicability for hybrid environments
- Own the prioritization of control gaps based on operational risk tolerance
The 12 modules (with all 144 chapters)
Module 1. Defining scope boundaries for CIS Controls
Learn how to determine which systems and assets fall under the CIS Controls umbrella based on data sensitivity and operational criticality. Build criteria that stand up to review without escalation.
12 chapters in this module
- Identifying critical system categories
- Mapping data flows to control domains
- Setting inclusion thresholds by risk tier
- Documenting boundary rationale
- Handling edge cases in hybrid environments
- Aligning with network topology
- Evaluating SaaS inclusion rules
- Scoping cloud workloads by account type
- Defining API surface boundaries
- Classifying development environments
- Handling shadow IT inventory
- Versioning scope decisions
Module 2. Control applicability assessment
Determine which of the 18 CIS Controls apply to your environment and at what level. Develop a defensible, repeatable methodology for control exclusion or partial adoption.
12 chapters in this module
- Reviewing control baseline relevance
- Mapping controls to existing tooling
- Assessing cloud-native alternatives
- Documenting control waivers
- Building risk-based exceptions
- Aligning with NIST CSF equivalency
- Tracking control overlap
- Evaluating third-party coverage
- Handling legacy system gaps
- Versioning applicability decisions
- Peer validation of exclusions
- Updating applicability over time
Module 3. Remediation completeness criteria
Define what 'done' looks like for each control implementation. Create acceptance standards that prevent rework and enable autonomous sign-off.
12 chapters in this module
- Setting configuration benchmarks
- Validating logging coverage
- Testing alerting efficacy
- Confirming backup integrity
- Auditing patch compliance windows
- Verifying access revocation
- Checking encryption enforcement
- Assessing MFA coverage
- Reviewing incident response readiness
- Confirming asset inventory accuracy
- Validating segmentation rules
- Signing off on remediation evidence
Module 4. Cross-functional alignment strategy
Lead alignment across infrastructure, security, and application teams without requiring executive sponsorship. Build consensus through structured evidence and role-based engagement.
12 chapters in this module
- Identifying stakeholder decision rights
- Scheduling control reviews
- Presenting implementation impact
- Negotiating timeline tradeoffs
- Documenting team commitments
- Escalating only when blocked
- Tracking cross-team dependencies
- Building shared ownership
- Managing handoff points
- Creating feedback loops
- Updating plans dynamically
- Closing alignment cycles
Module 5. Risk-based prioritization framework
Rank control implementation efforts by operational risk, not checklist order. Build a defensible model that reflects your environment’s unique threat landscape.
12 chapters in this module
- Assessing exploit likelihood
- Evaluating business impact
- Weighting control effectiveness
- Mapping to MITRE ATT&CK
- Adjusting for cloud posture
- Incorporating incident history
- Benchmarking against peer orgs
- Updating risk scores quarterly
- Communicating priority rationale
- Aligning with leadership goals
- Balancing speed and coverage
- Revising based on new intel
Module 6. Documentation standards for audit readiness
Create living artefacts that satisfy auditor requirements while enabling team autonomy. Learn what evidence holds up, and what gets challenged.
12 chapters in this module
- Structuring control narratives
- Capturing implementation dates
- Linking to policy references
- Including configuration snippets
- Adding network diagrams
- Referencing ticketing systems
- Versioning documentation
- Archiving evidence securely
- Redacting sensitive details
- Formatting for reviewer clarity
- Updating after changes
- Signing off on completeness
Module 7. Vendor tooling integration strategy
Evaluate how commercial tools support or hinder CIS Controls implementation. Make integration decisions that preserve autonomy and reduce dependency.
12 chapters in this module
- Assessing native control support
- Mapping tool outputs to controls
- Configuring automated reporting
- Validating data accuracy
- Handling false positives
- Integrating with SIEM
- Customizing alert thresholds
- Managing API rate limits
- Documenting tool gaps
- Planning for tool rotation
- Negotiating vendor SLAs
- Signing off on tool efficacy
Module 8. Change management for control updates
Own the process of updating controls as environments evolve. Implement a review cycle that prevents drift without creating bottlenecks.
12 chapters in this module
- Tracking configuration changes
- Reviewing control relevance
- Updating implementation plans
- Notifying stakeholders
- Scheduling maintenance windows
- Validating post-change stability
- Updating documentation
- Auditing rollback readiness
- Logging decisions centrally
- Requiring peer sign-off
- Archiving old versions
- Closing review cycles
Module 9. Metrics that demonstrate control efficacy
Define and track KPIs that prove controls are working, not just present. Move beyond checkbox compliance to measurable security outcomes.
12 chapters in this module
- Measuring detection speed
- Tracking remediation time
- Calculating coverage gaps
- Auditing log retention
- Reviewing incident trends
- Assessing false positive rates
- Benchmarking against baselines
- Reporting to leadership
- Updating thresholds
- Aligning with business goals
- Visualizing trends
- Defending metric choices
Module 10. Incident response integration
Ensure CIS Controls directly support incident response. Build playbooks that leverage control data to accelerate detection and containment.
12 chapters in this module
- Linking controls to playbooks
- Validating detection rules
- Testing alert fidelity
- Reviewing containment steps
- Updating response plans
- Conducting tabletop drills
- Logging incident findings
- Updating controls post-event
- Sharing lessons across teams
- Documenting response efficacy
- Signing off on improvements
- Closing feedback loops
Module 11. Continuous control validation
Implement automated checks that verify control effectiveness between audits. Build confidence in sustained compliance without manual reviews.
12 chapters in this module
- Scheduling automated scans
- Validating configuration drift
- Testing logging coverage
- Checking backup restores
- Monitoring access changes
- Alerting on policy violations
- Reviewing scan results
- Assigning remediation owners
- Tracking fix timelines
- Updating scan frequency
- Documenting validation cycles
- Signing off on results
Module 12. Leadership communication strategy
Report progress and decisions in a way that builds trust without oversimplifying. Own the narrative without needing approval.
12 chapters in this module
- Summarizing control status
- Highlighting key decisions
- Explaining risk tradeoffs
- Presenting metrics clearly
- Anticipating executive questions
- Defending prioritization
- Updating leadership regularly
- Sharing success stories
- Addressing concerns proactively
- Documenting communication history
- Adjusting tone by audience
- Closing reporting cycles
How this maps to your situation
- When rolling out CIS Controls in a new environment
- During audit preparation cycles
- After a security incident
- When integrating new cloud workloads
Before vs. after
Before
Waiting for approvals to finalize control scope or remediation plans
After
Making binding decisions on control implementation without escalation
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, with self-paced access to all materials.
How this compares to the alternatives
Unlike generic compliance courses, this program focuses on the specific decision rights that senior ICs need to own, giving you direct control over CIS Controls implementation without relying on approvals.
Frequently asked
Who is this course for?
Senior individual contributors in security, compliance, or engineering roles who are expected to make autonomous decisions about control implementation.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Does this course cover other frameworks like NIST or ISO 27001?
The focus is on CIS Controls, but crosswalks to NIST CSF are included where relevant.
$199 one-time. Approximately 3 hours per module, with self-paced access to all materials..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours