Skip to main content
Image coming soon

Sources and Specific Examples on Hand When Peers Push Back with CIS Controls

$199.00
Adding to cart… The item has been added

A tailored course, built for your situation

Sources and Specific Examples on Hand When Peers Push Back with CIS Controls

Build defensible, source-backed positions in high-stakes governance conversations using the CIS Controls framework

$199 one-time
24-hour access provisioning 30-day money-back guarantee Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Having to defend security decisions without clear backing or examples when challenged by peers or stakeholders

The situation this course is for

Even senior practitioners face pushback when proposing controls, especially when the justification feels procedural rather than rooted in incident data, real-world breaches, or authoritative sources. Without concrete reasoning, decisions get delayed, diluted, or overruled.

Who this is for

Senior security and governance leaders who own framework decisions and must defend them across technical and executive audiences

Who this is not for

Entry-level analysts, auditors looking for checklist training, or teams seeking automated tooling integration

What you walk away with

  • Cite breach incidents and attacker behaviors that directly inform each CIS Control
  • Explain control priorities using documented examples from real organizations
  • Map CIS Controls to attacker kill chains with precision
  • Reference authoritative sources like MITRE ATT&CK, CISA alerts, and FBI IC3 reports
  • Walk step-by-step through 'why this, not that' decisions in control selection and implementation

The 12 modules (with all 144 chapters)

Module 1. Why CIS Controls Matter in Modern Application Governance
Ground your leadership in the real-world attacks these controls were built to stop. Understand how recent application-layer breaches connect directly to control gaps. Use documented incidents to justify your focus areas, not just compliance mandates.
12 chapters in this module
  1. Origins of the CIS Controls in actual breach investigations
  2. How Oracle applications align with common attack paths
  3. The shift from checklist to evidence-based control selection
  4. Connecting control decisions to MITRE ATT&CK techniques
  5. Using CISA Known Exploited Vulnerabilities as input
  6. Mapping controls to pre-compromise, post-compromise stages
  7. Why 18 controls cover 80 percent of observed attacks
  8. Prioritizing controls by exploit likelihood, not just severity
  9. Differentiating baseline vs. defense-in-depth controls
  10. Control overlap with NIST CSF and ISO 27001
  11. How cloud-native applications change control interpretation
  12. Documenting the 'why' behind each control adoption
Module 2. Defensible Rationale for Implementation Scope
Justify what’s in, what’s out, and why, with sources. Avoid being forced into over-scoping or under-protecting due to peer pressure. Anchor your boundaries in real attack data and documented risk thresholds.
12 chapters in this module
  1. Defining scope using known application attack surfaces
  2. Excluding systems with documented compensating controls
  3. Using asset criticality to weight control application
  4. Citing examples from healthcare vs financial sectors
  5. When to defer controls based on architecture constraints
  6. How containerization affects scope boundaries
  7. Documenting exceptions with attacker behavior context
  8. Linking scope decisions to incident response findings
  9. Using CISA alerts to justify boundary changes
  10. Justifying phased rollouts with attack trend data
  11. Mapping exceptions to MITRE ATT&CK coverage gaps
  12. Building a living rationale document for audits
Module 3. Control 1 Inventory and Asset Management with Evidence
Defend your asset inventory rigor with examples of how missing devices led to breaches. Show how Control 1 stops real attacker behaviors, not just theoretical risks.
12 chapters in this module
  1. Why unmanaged devices enabled Colonial Pipeline breach
  2. Documenting asset discovery methods with tool outputs
  3. Using NetBIOS vs SNMP data to defend coverage claims
  4. How stale DNS records create blind spots
  5. Examples of shadow IT bypassing security controls
  6. Linking asset completeness to ATT&CK technique TA0007
  7. Using Microsoft Defender data to validate completeness
  8. When virtual assets count as 'managed'
  9. Defending thresholds like '99 percent coverage'
  10. Justifying scan frequency with ransomware timelines
  11. How cloud workloads change asset definitions
  12. Sourcing examples from ISACA and CISA reports
Module 4. Control 2 Secure Configuration for Hardware and Software
Explain configuration choices with reference to actual exploited misconfigurations. Move beyond 'it’s in the benchmark' to 'here’s what happened when it wasn’t'.
12 chapters in this module
  1. How default credentials enabled the the current cycle SolarWinds breach
  2. Using CIS Benchmarks vs vendor baselines
  3. Mapping insecure settings to ATT&CK technique TA0005
  4. Examples of credential exposure from logs
  5. Justifying configuration frequency with exploit cycles
  6. Using Shodan data to defend hardening scope
  7. When custom configurations are better than defaults
  8. Documenting exceptions with compensating controls
  9. Sourcing examples from FBI IC3 reports
  10. Linking patch cycles to ransomware delivery windows
  11. Hardening criteria for third-party SaaS connectors
  12. How container images change secure config practices
Module 5. Control 3 Continuous Vulnerability Management
Justify your scanning cadence, prioritization logic, and patch windows using real exploit data. Show how your process closes the window attackers actually use.
12 chapters in this module
  1. Why unpatched systems led to the Kaseya breach
  2. Using CISA Known Exploited Vulnerabilities list
  3. Mapping scan frequency to exploit availability
  4. Prioritizing by exploit maturity, not just CVSS
  5. Defending seven-day patch SLA with real data
  6. Examples of vulnerabilities exploited within hours
  7. Linking to MITRE ATT&CK technique TA0001
  8. Using VulnDB vs NVD for exploit timing
  9. Sourcing from Google Project Zero disclosures
  10. When zero-day risk changes patch urgency
  11. Documenting patch delays with operational context
  12. Creating defensible risk acceptance templates
Module 6. Control 4 Controlled Use of Administrative Privileges
Defend privilege restrictions using examples of abuse. Show how limiting admin access stops real attacker behaviors, not just satisfies auditors.
12 chapters in this module
  1. How excessive privileges enabled the Target breach
  2. Mapping to ATT&CK technique TA0030
  3. Justifying JIT access with incident data
  4. Examples of credential theft via admin sessions
  5. Using PAM logs to defend access policies
  6. When service accounts break privilege rules
  7. Documenting exceptions with session monitoring
  8. Sourcing from Verizon DBIR privilege misuse cases
  9. Linking to CISA guidance on credential hygiene
  10. Defending role-based access with breach examples
  11. How cloud IAM roles change admin definitions
  12. Creating defensible admin rotation templates
Module 7. Control 5 Secure Configuration for Network Devices
Explain firewall and router rules with reference to actual attacker pivots. Use documented network breaches to justify segmentation and change controls.
12 chapters in this module
  1. How flat networks enabled the Marriott breach
  2. Mapping to ATT&CK technique TA0008
  3. Using network flow data to defend segmentation
  4. Examples of unmonitored VLANs leading to exfiltration
  5. Justifying ACL review frequency with attack dwell time
  6. Sourcing from CISA network hygiene advisories
  7. Documenting exceptions with monitoring compensators
  8. When cloud VPCs replace traditional segmentation
  9. Linking to MITRE D3-NETFW for rule validation
  10. Defending microsegmentation scope with breach logic
  11. How DNS tunneling changes device trust
  12. Creating defensible rule change templates
Module 8. Control 6 Boundary Defense with Real-World Logic
Defend your boundary detection and blocking rules with reference to real attacker tools and behaviors. Show how your decisions stop actual TTPs, not just traffic.
12 chapters in this module
  1. How Cobalt Strike was used in the the current cycle REvil attack
  2. Mapping to ATT&CK technique TA0002
  3. Using EDR data to justify blocking rules
  4. Examples of DNS tunneling in breach investigations
  5. Sourcing from CISA alerts on common command tools
  6. Justifying IP blacklists with threat intel feeds
  7. When encrypted traffic breaks boundary rules
  8. Documenting exceptions with session decryption
  9. Linking to MITRE D3-DMZ for rule validation
  10. Defending outbound connection policies
  11. How cloud egress changes boundary definitions
  12. Creating defensible allowlist templates
Module 9. Control 7 Data Protection with Breach Examples
Justify encryption and classification choices using documented data exposure events. Show how your data policies stop real exfiltration paths.
12 chapters in this module
  1. How unencrypted databases led to the the firm breach
  2. Mapping to ATT&CK technique TA0010
  3. Using data flow diagrams to defend scope
  4. Examples of PII exposure in app logs
  5. Justifying DLP rules with breach timelines
  6. Sourcing from FTC enforcement actions
  7. When tokenization replaces encryption
  8. Documenting unencrypted data with compensators
  9. Linking to NIST 800-122 for data handling
  10. Defending classification thresholds
  11. How cloud storage changes data boundaries
  12. Creating defensible data retention templates
Module 10. Control 8 Audit Logs with Actionable Coverage
Defend your logging scope and retention with reference to real investigations. Show how your logs close visibility gaps attackers exploit.
12 chapters in this module
  1. Why missing logs delayed the Uber breach discovery
  2. Mapping to ATT&CK technique TA0011
  3. Using SIEM coverage to defend detection rules
  4. Examples of log gaps enabling lateral movement
  5. Justifying retention with investigation needs
  6. Sourcing from CISA log retention guidance
  7. When cloud-native logs replace traditional sources
  8. Documenting log exclusions with compensators
  9. Linking to MITRE D3-LA for visibility validation
  10. Defending correlation rules with attack patterns
  11. How serverless changes logging practices
  12. Creating defensible log review templates
Module 11. Control 9 Email and Web Browser Protections
Justify browser and email security policies with reference to phishing and drive-by download campaigns. Show how your rules stop real attacker entry points.
12 chapters in this module
  1. How phishing led to the the current cycle MOVEit compromise
  2. Mapping to ATT&CK technique TA0001
  3. Using URL filtering logs to defend blocklists
  4. Examples of malicious macros in breach chains
  5. Justifying script blocking with exploit data
  6. Sourcing from CISA phishing alerts
  7. When SaaS email changes protection rules
  8. Documenting exceptions with user training
  9. Linking to DMARC enforcement levels
  10. Defending browser isolation policies
  11. How zero-trust browsers change the model
  12. Creating defensible email exception templates
Module 12. Control 10 Malware Defenses with Detection Evidence
Defend your EDR and antivirus strategy using real malware samples and detection logs. Show how your tools catch what attackers actually use.
12 chapters in this module
  1. How Emotet spread in the the current cycle healthcare attacks
  2. Mapping to ATT&CK technique TA0002
  3. Using YARA rules to defend detection logic
  4. Examples of fileless malware evading controls
  5. Justifying EDR coverage with attack surface
  6. Sourcing from MITRE CAR analytics repository
  7. When cloud workloads change malware profiles
  8. Documenting disabled features with compensators
  9. Linking to CISA malware analysis reports
  10. Defending behavioral blocking rules
  11. How memory-resident malware changes detection
  12. Creating defensible override templates

How this maps to your situation

  • When a peer questions your control scope
  • During design review with infrastructure leads
  • Before audit validation with compliance teams
  • When onboarding new cloud services

Before vs. after

Before
Relying on compliance mandates or general best practices to justify control decisions
After
Walking into meetings with specific breach examples, attacker behaviors, and sourced rationale to defend every control choice

What's included with your purchase

  • 12 modules with 12 chapters each (144 chapters)
  • Downloadable templates and worked examples for every module
  • Hand-built implementation playbook delivered alongside course access
  • 30-day money-back guarantee

Delivery and format

  • Course and learning environment access provisioned within 24 hours of purchase
  • Hand-built implementation playbook delivered alongside course access

Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.

Time investment: Approximately 90 minutes per module, designed to fit within executive schedules. Total course time: around 18 hours.

If nothing changes
Continuing to rely on generic justifications may lead to compromises during peer review, reduced influence in architecture decisions, and missed opportunities to lead security strategy.

How this compares to the alternatives

Unlike generic compliance courses, this program focuses exclusively on building defensible, source-backed reasoning for control decisions, giving you the concrete examples and frameworks needed to win high-stakes discussions.

Frequently asked

Do I need prior experience with the CIS Controls to take this course?
Yes, this course assumes foundational knowledge. It’s designed to deepen your ability to defend decisions, not introduce basic concepts.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Can I use this if I’m not in a security role?
The course is tailored for technical leaders and governance owners. If you make or influence control decisions, it’s for you.
$199 one-time. Approximately 90 minutes per module, designed to fit within executive schedules. Total course time: around 18 hours..

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

30-day money-back guarantee· 144 chapters· Hand-built playbook included· Account access within 24 hours
!