CIS RAM FAQ

CIS RAM is an information security risk assessment method that helps enterprises design and evaluate their implementation of the CIS Critical Security Controls® (CIS Controls®). CIS RAM provides instructions, examples, templates, and exercises for conducting risk assessments so that they meet the requirements of established information security risk assessment standards, legal authorities, and regulators. Since information risks vary from one enterprise to the next, CIS RAM helps model “reasonable” uses of the CIS Controls to address the Mission, Objectives, and Obligations of each environment.

CIS RAM was developed by HALOCK Security Labs in partnership with the Center for Internet Security. HALOCK had been providing CIS RAM methods for several years with positive response from legal authorities, regulators, attorneys, business executives, and technical leaders. HALOCK and CIS collaborated to bring the methods to the public as CIS RAM v1.0 in 2018, and now CIS RAM v2.0 in 2021. CIS is a founding member of the DoCRA Council that maintains the risk analysis standard which CIS RAM is built upon. The DoCRA Council is made up of member organizations that require standards of practice in risk analysis and risk management, and have an interest in the methods used for analyzing risks and safeguards that reduce risk. DoCRA presents risk evaluation methods that are familiar to legal authorities, regulators, and information security professionals to create a “universal translator” for these disciplines.

The CIS RAM Core is a “bare essentials” version of the CIS RAM that provides the principles and practices of CIS RAM risk assessments, and is designed to help readers rapidly understand and implement the risk assessment method. It is also useful for enterprises and cybersecurity practitioners who are experienced at assessing risk, and who are able to quickly adopt its principles and practices for their environment. CIS RAM Core serves as a foundation for other documents in the CIS RAM family.

The reader will need to use professional judgment (either their own, or that of specialized practitioners) to conduct the risk assessment. Professional judgment will help determine the scope of the assessment in order to: define the enterprise’s Mission, Objectives, and Obligations; decide which risks will be evaluated; identify vulnerabilities and foreseeable threats; estimate their Expectancy and Impact; and recommend Risk Treatment Safeguards.

Yes. Other topics that may be useful to the community, and will be incorporated into CIS RAM, include:

No. CIS RAM conforms to and supplements established information security risk assessment standards and methods, such as ISO 27005, NIST Special Publications 800-30, and Risk Information Technology. By conforming to these standards and methods, CIS RAM ensures that the reader will conduct risk assessments in conformance to established (or authoritative) practices. By supplementing these methods, CIS RAM helps its readers evaluate risks and safeguards using the concept of “due care” and “reasonable safeguards” that the legal community and regulators use to determine whether enterprises act as a “reasonable person.” In addition, CIS RAM supports the cost-benefit analysis definitions for reasonableness used by U.S.-based regulators, litigators, and the legal community in general.

While there are multiple established risk assessment standards, CIS RAM is the first to provide very specific instructions for analyzing information security risk in a way that regulators define as “reasonable,” and that judges evaluate as “due care.” CIS RAM emphasizes balance between the harm that security incidents may cause others and the burden of safeguards. This balance is the foundation of “reasonableness.”

New users are able to design their risk assessment within their first day of following the CIS RAM instructions, including analysis of several risks. The amount of time the enterprise takes after that largely depends on the scope of their assessment, and the level of instructions they are following.

Since the CIS Controls are already prioritized by their criticality in preventing cyber-attacks, a CIS Controls gap assessment already has risk built in. However, each enterprise faces its own risks, and has its own level of resources to invest in protecting against security incidents. CIS RAM helps enterprises determine whether their use of CIS Controls is sufficient against the Expectancy of Impacts in their environment, and whether proposed safeguards are more burdensome than the risk they are designed to prevent. This helps translate security concerns into business terms, and helps regulators and legal authorities determine whether safeguards are reasonable and demonstrate due care.

Risk assessments have often been conducted as guess-work, using “high,” “medium,” and “low” rankings of identified gaps. CIS RAM helps enterprises associate risk scores with the potential of harm that may come to themselves and to others. Additionally, CIS RAM provides guidance on estimating foreseeability, so both Impacts and Expectancies can be communicated in simple language to technical and non-technical people.

Yes. CIS does not require CIS RAM to be the sole method for assessing information security risk. CIS does recommend reviewing the Principles and Practices listed in CIS RAM Core to be sure that information security risk assessments are meaningful to non-technical management, to regulators, and to legal authorities.

Yes. CIS RAM is free to use for anyone looking to improve their own cybersecurity posture.

CIS WorkBench offers a community dedicated to helping enterprises with the implementation and use of CIS RAM. Sign up and start a discussion in the CIS RAM Community.

Questions can be sent to [email protected]