Which of the following best describes the CIS Controls?

The Center for Internet Security (CIS) Controls are a prioritized, prescriptive, and actionable set of technical safeguards designed to help organizations defend against the most common and damaging cyber-attacks. Their development is community-driven and informed by analysis of actual attack data from a wide range of threat sources. This threat-informed approach ensures that the controls focus on the defensive actions that have the greatest impact on improving an organization's security posture against prevalent, real-world threats.

A. While the SANS Institute was the original developer, the controls are now managed by the Center for Internet Security (CIS).

C. The CIS Controls are a standalone framework that can map to and help implement NIST frameworks, but they are not designed as an augmentation.

D. This description is too generic. The defining characteristic of the CIS Controls is their specific prioritization based on current threat data, not general regulations.

1. Center for Internet Security. (2021). CIS Critical Security Controls v8. Page 6, Introduction. "The CIS Controls are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are derived from the most common attack patterns highlighted in leading threat reports and vetted by a community of experts."

2. University of Washington, Office of the CISO. (n.d.). CIS Controls. "The CIS Controls are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks... The CIS Controls are developed, refined, and validated by a community of experts from around the world."

3. Purdue University. (n.d.). Cybersecurity Resources - CIS Controls. "The CIS Controls are a prioritized set of actions to protect your organization and data from known cyber-attack vectors. They are a relatively short, prioritized list of cybersecurity controls."