Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges. His career includes leadership roles across the military, insurance, finance, energy, and technology industries. He is a husband, father, former military cyber officer, adjunct professor, avid reader, dog dad, and popular on LinkedIn.

• Preface xxvAcknowledgments xxvii1 Understanding Cybersecurity Controls 12 The Risk-Based Approach 173 Small Business Implementation 354 Medium-Sized Enterprises 555 Large Enterprises 736 Introduction to MITRE ATT&CK & DEFEND 977 Mapping Threats to Controls Using MITRE ATT&CK 1178 Enhancing Defenses with MITRE DEFEND 1419 Cybersecurity Frameworks Overview 16910 Nist 800-53 19111 Center for Internet Security (CIS) 18 Controls 22112 Agile Implementation of Controls and Control Frameworks 25313 Adaptive Control Testing & Continuous Improvement 26714 Testing Controls in Small and Medium Enterprises 29715 Control Testing in Larger and Complex Enterprises 31716 Control Failures: Identification, Management, and Reporting 36517 Control Testing for Regulated Companies 38918 Emerging Threats and Technologies 409Appendix A Glossary of Terms 427Appendix B Creating and Using a Cybersecurity Risk Register 431Appendix C Creating and Using a Cybersecurity Risk Taxonomy 437Appendix D SME Security Team Structures 441Appendix E Developing Process Maps 445Appendix F Establishing a Regulatory Change Management Program 449Appendix G Recommended Metrics for MITRE ATT&CK Techniques 453Answers 467Index 503

Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges. His career includes leadership roles across the military, insurance, finance, energy, and technology industries. He is a husband, father, former military cyber officer, adjunct professor, avid reader, dog dad, and popular on LinkedIn.

• Preface xxvAcknowledgments xxvii1 Understanding Cybersecurity Controls 12 The Risk-Based Approach 173 Small Business Implementation 354 Medium-Sized Enterprises 555 Large Enterprises 736 Introduction to MITRE ATT&CK & DEFEND 977 Mapping Threats to Controls Using MITRE ATT&CK 1178 Enhancing Defenses with MITRE DEFEND 1419 Cybersecurity Frameworks Overview 16910 Nist 800-53 19111 Center for Internet Security (CIS) 18 Controls 22112 Agile Implementation of Controls and Control Frameworks 25313 Adaptive Control Testing & Continuous Improvement 26714 Testing Controls in Small and Medium Enterprises 29715 Control Testing in Larger and Complex Enterprises 31716 Control Failures: Identification, Management, and Reporting 36517 Control Testing for Regulated Companies 38918 Emerging Threats and Technologies 409Appendix A Glossary of Terms 427Appendix B Creating and Using a Cybersecurity Risk Register 431Appendix C Creating and Using a Cybersecurity Risk Taxonomy 437Appendix D SME Security Team Structures 441Appendix E Developing Process Maps 445Appendix F Establishing a Regulatory Change Management Program 449Appendix G Recommended Metrics for MITRE ATT&CK Techniques 453Answers 467Index 503

Jason Edwards, DM, CISSP, is an accomplished cybersecurity leader with extensive experience in the technology, finance, insurance, and energy sectors. Holding a Doctorate in Management, Information Systems, and Technology, Jason specializes in guiding large public and private companies through complex cybersecurity challenges. His career includes leadership roles across the military, insurance, finance, energy, and technology industries. He is a husband, father, former military cyber officer, adjunct professor, avid reader, dog dad, and popular on LinkedIn.

• Preface xxvAcknowledgments xxvii1 Understanding Cybersecurity Controls 12 The Risk-Based Approach 173 Small Business Implementation 354 Medium-Sized Enterprises 555 Large Enterprises 736 Introduction to MITRE ATT&CK & DEFEND 977 Mapping Threats to Controls Using MITRE ATT&CK 1178 Enhancing Defenses with MITRE DEFEND 1419 Cybersecurity Frameworks Overview 16910 Nist 800-53 19111 Center for Internet Security (CIS) 18 Controls 22112 Agile Implementation of Controls and Control Frameworks 25313 Adaptive Control Testing & Continuous Improvement 26714 Testing Controls in Small and Medium Enterprises 29715 Control Testing in Larger and Complex Enterprises 31716 Control Failures: Identification, Management, and Reporting 36517 Control Testing for Regulated Companies 38918 Emerging Threats and Technologies 409Appendix A Glossary of Terms 427Appendix B Creating and Using a Cybersecurity Risk Register 431Appendix C Creating and Using a Cybersecurity Risk Taxonomy 437Appendix D SME Security Team Structures 441Appendix E Developing Process Maps 445Appendix F Establishing a Regulatory Change Management Program 449Appendix G Recommended Metrics for MITRE ATT&CK Techniques 453Answers 467Index 503