4 ms·
I don't think a NIST heavy documentation centric process is as applicable to private industry, particularly startups, nor does NIST itself track the state of th
by OrvalWintermute 5y ago
I don't think a NIST heavy documentation centric process is as applicable to private industry, particularly startups, nor does NIST itself track the state of the industry around defenses & countermeasures. Am saying that since you are using NIST language if it not apparent to all readers.
Given that NIST is tracking so many controls (1190 controls & enhancements in the current revision) it becomes hard to see the singular burning trees from the forest view that is NIST.
- rorykoehler 5y agoEach control is a tree. You have to work through it one by one but as you do that you will find many of them (50% would not be unusual) are not applicable to your business. The standard is basically a guide rail. There are things that aren’t in it, there are things that are in it but are not relevant and there are also things that are outdated and/or against prevailing industry best practices.