About eighty percent of the canal need is covered by CIS; three house controls remain. What is the preferred approach?
Select an answer to reveal the explanation.
Short Explanation
Do not photocopy all of CIS into a homemade JSON novel. Turn CIS on, then hang a small custom standard for the three house rules that CIS never heard of.
Full Explanation
When about eighty percent of canal needs are covered by CIS and three house controls remain, enable the built-in CIS standard and add a small custom standard for the remaining house controls. Reuse Microsoft's maintained CIS content and extend only the gaps instead of reinventing the catalog.
Rebuilding the entire CIS catalog as a custom JSON dump so one standard contains everything creates a large, brittle duplicate that you must maintain whenever CIS updates. Disabling all built-in standards and tracking the three house controls only in email abandons scalable assessment and evidence. Ignoring CIS and relying solely on Secure Score without any regulatory standard enabled skips the mapped CIS control reporting the board adopted.
Exam caveat: overlapping controls between CIS, MCSB, and a custom standard can appear on multiple dashboards—coordinate remediation owners so the same failed resource is not triaged three times without shared tracking.
Operational check: enable CIS on canal subscriptions, create a minimal custom standard for the three house controls, assign both, and confirm dashboards show CIS coverage plus the three extra assessments without attempting to clone all of CIS into the custom standard.