01 · PRIORITIZED
Do the right things first
Implementation Group 1 is essential cyber hygiene. Get it in place, then build toward IG2 and IG3 as your risk and resources require.
Governance, risk, and compliance
GRC built on
the CIS Controls.
A prioritized, practical security program your team can run and your auditors can verify, led by one of the people who helped write the CIS Controls.
Why the CIS Controls
Start with what stops real attacks
Most frameworks tell you what to cover. The CIS Critical Security Controls tell you what to do first: a prescriptive, prioritized, and simplified set of best practices, drawn from how attacks actually happen and organized into Implementation Groups so a small agency and a large utility can each start at the right level. The current version, CIS Controls v8.1, adds emphasis on cloud environments and supply chain security, and several states point to the Controls as a way to show a reasonable level of security.
02 · MEASURABLE
Know where you stand
Each safeguard is specific enough to assess and score, so progress shows up as numbers leadership can track, not opinions.
03 · MAPPED
Map once, answer to many
The CIS Controls map to NIST CSF 2.0, NIST 800-53, and other frameworks, so one program supports several audits instead of one program per audit.
How we engage
From first assessment to audit day
ASSESS
CIS Controls assessment
Where you stand against each safeguard and Implementation Group, with a maturity score and the gaps that matter most.
PLAN
Roadmap and implementation
A sequenced plan your team can execute, with help standing up the safeguards and the processes behind them.
LEAD
vCISO and program leadership
CISO-level guidance for leadership and boards, aligning cyber risk with business and mission risk.
DOCUMENT
Policies and documentation
Policies, standards, and procedures people follow, including OT documentation that matches what is on the plant floor.
PROVE
Audit and framework readiness
Evidence, crosswalks, and audit prep, with evidence collection automated through Anecdotes so your staff is not buried in screenshots.
TEACH
Workshops and training
Hands-on workshops on the CIS Controls, NIST CSF 2.0, and RMF, built around your environment and your templates.
Frameworks
One program, the frameworks you answer to
We build on the CIS Controls and map your program to the standards your organization is measured against.
FederalNIST CSF 2.0, RMF and NIST 800-53, NIST 800-171, FedRAMP
OT and utilitiesNIST 800-82, ISA/IEC 62443, NERC CIP
Enterprise and emergingISO 27001, the NIST AI RMF
Who leads it
Led by a CIS Controls Technical Editor
Kelli Tarala
Director of GRC
Kelli is the lead Technical Editor of the CIS Critical Security Controls, versions 4 through 8, and the creator of the governance resources, tools, and policies at AuditScripts. She has briefed the CIS Controls updates at RSA Conference, co-founded Enclave Security, authored and taught SANS courses, and serves on the IANS faculty. She delivered the opening keynote at BSides San Diego 2025.
Watch her interview on the blind spot in compliance ↗GRC · SMUD (Sacramento Municipal Utility District)
NIST CSF 2.0 and RMF deep dive
"We attended Kelli Tarala's GRC keynote at BSides San Diego and couldn't wait to have her deliver a workshop to our utility in Sacramento."
Cybersecurity Risk Program Manager, SMUD · 2025
Find out where you stand
Most GRC engagements start with a CIS Controls assessment. Tell us about your organization and we will recommend a first step.