In episode 156 of Cybersecurity Where You Are, Sean Atkinson and Tony Sager are joined by Stephanie Gass, Sr. Director of Information Security at Center for Internet Security® (CIS®), and <a rel="noreferrer noopener" target="_blank" href="https://www.linkedin.com/in/angelo-marcotullio-169169109">Angelo Marcotullio</a>, Chief Information Officer at CIS. Together, they explore how CIS practices what it preaches by using CIS products and services internally, which includes implementation of the CIS Critical Security Controls® (CIS Controls®) and CIS Benchmarks®, automation, and alignment to compliance frameworks. Their discussion highlights how CIS builds a strong cybersecurity foundation while adapting to evolving threats and regulatory requirements.The conversation dives into practical applications, cultural alignment, and the importance of repeatable processes for scaling security across new products and services. It also touches on the role of privacy regulations, cyber risk quantification, and the community-driven approach that underpins CIS best practices. Here are some highlights from our episode:<ul><li>01:12. Why CIS “drinks its own champagne” when it comes to cybersecurity</li><li>02:56. Three ways the CIS Controls help modern enterprises defend against threat actors</li><li>04:02. The importance of pulling together security lessons learned in a way that's translatable</li><li>10:03. Our use of the CIS Controls to align to SOC 2, ISO 27001, and other frameworks</li><li>12:01. How governance, risk, and compliance (GRC) engineering works with automation to help build repeatable processes</li><li>22:43. The role of collaboration and communication in building a cybersecurity program</li><li>27:17. Privacy regulations as a catalyst for security innovation</li><li>30:24. The CIS Community Defense Model and evidence-based practices</li><li>32:40. How CIS leverages lessons learned to improve our security best practices</li></ul>Resources<ul><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/podcast/episode-146-what-security-looks-like-for-a-security-company?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_156-wistia-podcast_sub">Episode 146: What Security Looks Like for a Security Company</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/implementation-guide-for-small-and-medium-sized-enterprises-cis-controls-ig1?utm_source=wistia&utm_campaign=controls&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-controls-podcast_156-wistia-controls_dl">Implementation Guide for Small and Medium-Sized Enterprises CIS Controls IG1</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/how-to-construct-a-sustainable-grc-program-in-8-steps?utm_source=wistia&utm_campaign=securesuite&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-securesuite-podcast_156-wistia-content_dl">How to Construct a Sustainable GRC Program in 8 Steps</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/cybersecurity-tools/mapping-compliance/mapping-and-compliance-with-the-cis-controls?utm_source=wistia&utm_campaign=controls&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-controls-podcast_156-wistia-lp_view">Mapping and Compliance with the CIS Controls</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/blog/cis-completes-soc-2-type-ii-audit-using-cis-best-practices?utm_source=wistia&utm_campaign=controls&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-controls-podcast_156-wistia-blog_post">CIS Completes SOC 2 Type II Audit Using CIS Best Practices</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/podcast/episode-74-the-nexus-of-cybersecurity-and-privacy-legislation?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_156-wistia-podcast_sub">Episode 74: The Nexus of Cybersecurity & Privacy Legislation</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/cis-community-defense-model-2-0?utm_source=wistia&utm_campaign=controls&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-controls-podcast_156-wistia-controls_dl">CIS Community Defense Model 2.0</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/podcast/episode-121-the-economics-of-cybersecurity-decision-making?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_156-wistia-podcast_sub">Episode 121: The Economics of Cybersecurity Decision-Making</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/podcast/episode-77-datas-value-to-decision-making-in-cybersecurity?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_156-wistia-podcast_sub">Episode 77: Data's Value to Decision-Making in Cybersecurity</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/communities?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_156-wistia-lp_view">CIS Communities</a></li></ul>If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing&nbsp;<a rel="noreferrer noopener" target="_blank" href="mailto:podcast@cisecurity.org">podcast@cisecurity.org</a>.

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

Episode 156: How CIS Uses CIS Products and Services

Cybersecurity Where You Are (video)

AI Chapters

AI Insights

Reviews