A small organization with a limited budget and no dedicated security staff wants a starting set of controls that will address the most common attacks first. Which approach is MOST suitable?
Select an answer to reveal the explanation.
Short Explanation
If you've only got a few dollars, you buy a lock for the front door before a vault. A prioritized baseline like the CIS Controls tells you which locks matter most first, which fits your size better than a giant catalog or a certification project.
Full Explanation
Small organizations need controls that give the greatest protection for limited effort, in a sensible order. The CIS Controls are designed as a prioritized set of safeguards against common attacks, with an entry-level set intended for organizations with limited resources and expertise, so they provide an actionable starting baseline that can be extended as the organization matures. Implementing the full NIST SP 800-53 catalog in a year is unrealistic for a small organization; the catalog is extensive and is designed to be tailored through baselines, so attempting all of it would exhaust resources without prioritizing the most common threats. Pursuing ISO/IEC 27001 certification first establishes a management system and certification audit, which can be valuable later, but it is a significant undertaking that does not by itself specify which technical safeguards to implement first, and it may not fit the organization's immediate need. Writing a custom control set from scratch reinvents work that established frameworks already provide and risks gaps based on the team's limited experience. Exam caveat: the baseline should still be checked against the organization's specific regulatory requirements. Operational check: confirm a gap assessment against the chosen baseline exists and that remediation is ordered by the baseline's priorities and the organization's risks.