Data Governance
The framework of policies, roles, and controls that decide who can access data, how it's classified, and how long it's kept. Without governance, a strong security stack still can't answer whether this data should exist.
Cybersecurity Infographic Series · Governance, Risk and Privacy
CIS Controls v8.1
The Center for Internet Security’s Critical Security Controls v8.1, released June 2024, are a prioritized, prescriptive set of 18 Controls and 153 Safeguards built from attack data. Three Implementation Groups set the order of work: every enterprise starts with the 56 Safeguards of IG1, essential cyber hygiene.
Downloads
- Infographic (PNG, 2880×7172, 1.6 MB)
- Field reference (PDF, 2 sheets, 523 KB)
- Infographic, light edition (PNG, 1.7 MB)
- Field reference, light edition (PDF, 530 KB)
More in Governance, Risk and Privacy
Third-Party Risk Management
The discipline of vetting, tiering, contracting, and continuously monitoring every vendor, supplier, and partner that touches your data or systems. A signed contract proves obligation — it never proves compliance.
Fourth and Nth-Party Risk
The risk introduced by your vendors' own vendors — and everything downstream of them. Your direct vendor may be secure; the subprocessor two tiers down that you've never heard of is where the actual exposure lives.
Security Metrics, KPIs and Board Reporting
A board doesn't need every alert — it needs to know whether risk is going up or down and what it will cost to change that, translated out of security jargon and into business terms.
GDPR and Global Privacy Regulation
GDPR applies to any organization processing an EU resident's personal data, regardless of where that organization is actually based. Consent is only one of six lawful bases, and defaulting to it for everything often creates more compliance risk, not less.
.png){kind=link}
NIST Cybersecurity Framework 2.0
NIST published Cybersecurity Framework 2.0 on February 26, 2024, its first major update since 2014. It is a taxonomy of high-level cybersecurity outcomes for any organization, not a control set, a checklist or a certification: CSF 2.0 says what good looks like and leaves the how to the standards it maps to.