What you’ll be able to do
- Map a Riverstone risk to a CSF 2.0 function and an outcome statement.
- Choose a CIS Implementation Group mindset for a first control set without claiming certification.
- Match a capability need to a product category while naming what the category does not do.
- Write the evidence you would keep so a later reviewer can see the control working.
Outcomes first, catalogs second, products third
A framework is a way to talk about outcomes and organize work. It is not a trophy. NIST CSF 2.0 gives six functions—Govern, Identify, Protect, Detect, Respond, Recover—plus Organizational Profiles and Tiers. Riverstone can say: we need to Identify internet-facing appliances, Protect driver authentication, Detect unusual exports, Respond with reversible account disables, Recover YardOS from immutable copies, and Govern who owns each of those sentences. That is an outcome conversation.
CIS Controls v8.1 then offers a prioritized set of Safeguards grouped into Implementation Groups. Implementation Group 1 is essential cyber hygiene for organizations that need a small, foundational set. It is a starting discipline, not a certificate that attackers will honor. ISO/IEC 27001 and NIST SP 800-53 are different again: a certifiable management-system standard versus a broad control catalog. Use the card that matches the question you are asking.
Categories are capabilities, not endorsements
Once the outcome is named, a product category might help. Identity and access management (IAM) helps create and authenticate Jordan’s record. Privileged access management (PAM) helps wrap the YardOS admin role. A security information and event management (SIEM) system helps collect the 02:14 logs. Endpoint detection and response (EDR) helps inspect the contractor laptop. A web application firewall (WAF) might sit in front of TrackPort. None of those names is a substitute for the F1 loss sentence.
Industry labels overlap on purpose. Extended detection and response (XDR) vendors claim to stitch endpoint, network, and identity signals. Managed detection and response (MDR) sells people plus tooling. Secure access service edge (SASE) and security service edge (SSE) packages network and cloud access controls. If you cannot say which outcome a category is serving, you are shopping. ATT&CK can later describe adversary behaviors you hope to detect; it is not a coverage score for a purchase.
- Outcome: drivers cannot be impersonated into TrackPort exports.
- Control: phishing-resistant MFA, scoped tokens, export authorization, session revoke.
- Evidence: identity logs, application authorization denials, restore-test records.
- Category: IAM plus SIEM plus, if needed, PAM—not “buy XDR and skip the sentence.”
Worked mapping: the VPN and the export
Risk: opportunistic exploitation of the internet-facing VPN leading to driver-account abuse and customer-address disclosure. CSF: Identify assets (the appliance), Protect (patch, MFA, least privilege), Detect (impossible travel plus export alerts), Respond (revoke sessions), Recover (if YardOS is later hit). CIS IG1-minded actions: inventory, patching, account hygiene, log retention. Evidence: KEV ticket, patch timestamp, MFA enrollment report, sample export authorization tests, last restore test.
Product categories that might support those controls: vulnerability management for the appliance queue; IAM for MFA; SIEM for joining identity and TrackPort logs; EDR for the laptop that approved the prompt. A framework card is not permission to skip the uncertainty line: we still do not know whether a geofence already limits VPN logins. Write that too.
CHECK YOUR JUDGMENT