In episode 146 of Cybersecurity Where You Are, Tony Sager is joined by <a rel="noreferrer noopener" target="_blank" href="https://www.linkedin.com/in/angelo-marcotullio-169169109">Angelo Marcotullio</a>, Chief Information Officer at the Center for Internet Security®(CIS®); and Stephanie Gass, Sr. Director of Information Security at CIS. Together, they look back on periods of transition at CIS to discuss what security looks like for a security company. Here are some highlights from our episode:<ul><li>00:58. Introductions with Angelo and Stephanie</li><li>02:07. A pro and a con of IT consulting work</li><li>04:12. The importance of soft skills in bringing the Multi-State Information Sharing and Analysis Center® into CIS</li><li>06:12. Looking at security from a corporate perspective with the CIS Critical Security Controls</li><li>07:08. How IT and IT security are essential to corporate strategy</li><li>07:45. The use of governance to support merging three business units into an integrated security company</li><li>12:04. The value of security champions in adapting to regulatory and business changes</li><li>15:15. What IT and Security teams can accomplish when they work as partners</li><li>17:18. The use of data to inform Board decisions and conversations around risk</li><li>20:38. How getting a seat at the table helps with understanding a Board's risk appetite and communicating that out to teams</li><li>25:01. How infrastructure built for growth, not the smallest business case, produced a smooth transition to work from home in March 2020</li><li>29:30. Advice for folks starting out in security</li><li>31.28. The importance of collaboration and culture in implementing security as an organization</li></ul>Resources<ul><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/podcast/episode-144-carrying-on-the-ms-isacs-character-and-culture?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_146-wistia-podcast_sub">Episode 144: Carrying on the MS-ISAC's Character and Culture</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/the-cis-security-operations-center-soc-the-key-to-growing-your-sltts-cyber-maturity?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_146-wistia-content_dl">The CIS Security Operations Center (SOC): The Key to Growing Your SLTT's Cyber Maturity</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/guide-implementation-groups-ig-cis-critical-security-controls-v8-1?utm_source=wistia&utm_campaign=controls&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-controls-podcast_146-wistia-controls_dl">Guide to Implementation Groups (IG): CIS Critical Security Controls v8.1</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/cis-controls-v8-1-mapping-to-iso-iec-27001-2022?utm_source=wistia&utm_campaign=controls&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-controls-podcast_146-wistia-controls_dl">CIS Controls v8.1 Mapping to ISO/IEC 27001:2022</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/cis-controls-v8-1-mapping-to-soc2?utm_source=wistia&utm_campaign=controls&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-controls-podcast_146-wistia-controls_dl">CIS Controls v8.1 Mapping to SOC2</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/white-papers/cis-controls-v8-1mapping-to-nist-sp-800-171-rev-3?utm_source=wistia&utm_campaign=controls&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-controls-podcast_146-wistia-controls_dl">CIS Controls v8.1 Mapping to NIST SP 800-171 Rev 3</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/topics/reasonable-cybersecurity?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_rcs&utm_content=2025-cis-podcast_146-wistia-lp_view">Reasonable Cybersecurity</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://www.cisecurity.org/insights/podcast/episode-110-how-security-culture-and-corporate-culture-mesh?utm_source=wistia&utm_campaign=cis&utm_medium=audio&utm_term=theme_tl&utm_content=2025-cis-podcast_146-wistia-podcast_sub">Episode 110: How Security Culture and Corporate Culture Mesh</a></li></ul>If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing&nbsp;<a rel="noreferrer noopener" target="_blank" href="mailto:podcast@cisecurity.org">podcast@cisecurity.org</a>.

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

Episode 146: What Security Looks Like for a Security Company

Cybersecurity Where You Are (video)

AI Chapters

AI Insights

Reviews