Navigating the Evolving Cybersecurity Landscape: NIST CSF 2.0, CIS Controls v8.1, and the Path Forward for MSPs and SMBs

Identify	Protect	Detect	Respond	Recover
Understanding the organization's assets, systems, data, and risks.	Developing and implementing safeguards to limit or contain the impact of a cybersecurity event.	Identifying the occurrence of a cybersecurity event.	Taking action regarding a detected cybersecurity event.	Restoring any capabilities or services that were impaired due to a cybersecurity event.
Govern: The crucial addition in CSF 2.0 focuses on establishing the organization's cybersecurity program governance, including strategy, risk management, and compliance efforts. This function emphasizes the importance of leadership, policy, and continuous improvement.

Controls:	Safeguards:	Implementation Groups (IGs):
High-level cybersecurity objectives, addressing broad security areas.	Specific, actionable recommendations to achieve the control objectives. These provide concrete steps organizations can take to improve their security.	Three groups (IG1, IG2, and IG3) categorize safeguards based on the level of effort and resources required for implementation, allowing organizations to tailor their approach to their specific needs and capabilities.
The Interrelationship: CIS Controls v8.1 directly maps its safeguards to the functions within NIST CSF 2.0. This alignment provides a clear path for organizations to implement the CIS Controls in a way that directly supports the overall cybersecurity risk management strategy defined by the NIST framework. The addition of the "Govern" function in both frameworks further strengthens this synergy, emphasizing the importance of ongoing management, continuous improvement, and demonstrable compliance.

	Key Solution Components and their Contribution to CIS Controls v8.1 Compliance
1	SASE (Secure Access Service Edge): Exium's SASE capabilities directly address several critical safeguards related to network security, data protection, and remote access. Features like secure web gateways (SWG), zero-trust network access (ZTNA), and Firewall functionalities contribute to implementing safeguards within the "Protect" and "Detect" security functions of CIS Controls v8.1.
2	XDR (Extended Detection and Response): Exium's XDR solution provides comprehensive threat detection and response capabilities across the entire IT environment – network, endpoints, and cloud. This unified approach streamlines incident response, reducing mean time to resolution (MTTR) and improving the efficiency of threat hunting. This directly contributes to safeguards within the "Detect" and "Respond" functions of CIS Controls v8.1, focusing on endpoint security, threat detection, and incident response.
3	IAM (Identity and Access Management): Exium's IAM solution strengthens identity and access control across the organization. This includes strong authentication, authorization, and identity governance, addressing safeguards related to user access management and privilege control, thereby contributing to "Protect" and "Govern" functions in CIS Controls v8.1.
4	GRC (Governance, Risk, and Compliance): Exium’s integrated GRC capabilities provide essential tools for managing and demonstrating compliance. This includes policy management, risk assessment, and reporting, thereby fulfilling crucial aspects of the "Govern" function in CIS Controls v8.1 and greatly assisting in demonstrating compliance.
5	Synergistic Effects: The true power of Exium's unified platform lies in the synergy between these components. For example, strong IAM practices (controlled access) minimize the attack surface, enhancing the effectiveness of the SASE and XDR solutions. Similarly, proactive threat detection through XDR informs and refines security policies managed through GRC, creating a continuous improvement cycle. This holistic approach reduces redundancy, simplifies management, and improves overall security effectiveness.

Reduced Complexity	Improved Efficiency	Cost Savings	Enhanced Security	Simplified Compliance
A single, integrated platform simplifies management and reduces the burden of managing multiple, disparate security tools.	Streamlined workflows and automated processes free up MSP resources, allowing them to focus on higher-value tasks.	Consolidating security solutions reduces licensing fees and minimizes operational expenses.	A unified approach delivers comprehensive protection against a wider range of threats.	Easily demonstrate compliance with CIS Controls v8.1 and other relevant security standards.

CIS Control	CIS Safeguard	Asset Type	NIST CSF 2.0 Security Function	IG1	IG2	IG3	Title	How Exium contributes to satisfying each safeguard
1	Inventory and Control of Enterprise Assets	4/5
1	1.1	Devices	Identify	IG1	IG2	IG3	Establish and Maintain Detailed Enterprise Asset Inventory	Exium's SIEM-XDR for Effective Asset Inventory Management
1	1.2	Devices	Respond	IG1	IG2	IG3	Address Unauthorized Assets	Exium's SIEM-XDR for Effective Asset Inventory Management
1	1.3	Devices	Detect		IG2	IG3	Utilize an Active Discovery Tool	VAS360: Enhancing Security Posture with Exium's Autonomous Vulnerability Assessment
1	1.4	Devices	Identify		IG2	IG3	Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory	Exium's Dynamic Host Configuration Protocol (DHCP) Server
1	1.5	Devices	Detect			IG3	Use a Passive Asset Discovery Tool	-
2	Inventory and Control of Software Assets	4/7
2	2.1	Software	Identify	IG1	IG2	IG3	Establish and Maintain a Software Inventory	Exium's SIEM-XDR for Effective Asset Inventory Management
2	2.2	Software	Identify	IG1	IG2	IG3	Ensure Authorized Software is Currently Supported	Exium's SIEM-XDR for Effective Asset Inventory Management
2	2.3	Software	Respond	IG1	IG2	IG3	Address Unauthorized Software	Exium's SIEM-XDR for Effective Asset Inventory Management
2	2.4	Software	Detect		IG2	IG3	Utilize Automated Software Inventory Tools	Exium's SIEM-XDR for Effective Asset Inventory Management
2	2.5	Software	Protect		IG2	IG3	Allowlist Authorized Software	-
2	2.6	Software	Protect		IG2	IG3	Allowlist Authorized Libraries	-
2	2.7	Software	Protect			IG3	Allowlist Authorized Scripts	-
3	Data Protection	5/14
3	3.1	Data	Govern	IG1	IG2	IG3	Establish and Maintain a Data Management Process	Exium's GRC360
3	3.2	Data	Identify	IG1	IG2	IG3	Establish and Maintain a Data Inventory	-
3	3.3	Data	Protect	IG1	IG2	IG3	Configure Data Access Control Lists	-
3	3.4	Data	Protect	IG1	IG2	IG3	Enforce Data Retention	-
3	3.5	Data	Protect	IG1	IG2	IG3	Securely Dispose of Data	-
3	3.6	Data	Protect	IG1	IG2	IG3	Encrypt Data on End-User Devices	-
3	3.7	Data	Identify		IG2	IG3	Establish and Maintain a Data Classification Scheme	-
3	3.8	Data	Identify		IG2	IG3	Document Data Flows	-
3	3.9	Data	Protect		IG2	IG3	Encrypt Data on Removable Media	-
3	3.10	Data	Protect		IG2	IG3	Encrypt Sensitive Data in Transit	Exium's WireGuard VPN encryption
3	3.11	Data	Protect		IG2	IG3	Encrypt Sensitive Data at Rest	-
3	3.12	Data	Protect		IG2	IG3	Segment Data Processing and Storage Based on Sensitivity	Exium's Network Segmentation and Device Isolation
3	3.13	Data	Protect			IG3	Deploy a Data Loss Prevention Solution	Microsoft 365 Detection and Response
3	3.14	Data	Detect			IG3	Log Sensitive Data Access	Microsoft 365 Detection and Response
4	Secure Configuration of Enterprise Assets and Software	7/12
4	4.1	Doc	Govern	IG1	IG2	IG3	Establish and Maintain a Secure Configuration Process	Exium's GRC360
4	4.2	Doc	Govern	IG1	IG2	IG3	Establish and Maintain a Secure Configuration Process for Network Infrastructure	Exium's GRC360
4	4.3	Devices	Protect	IG1	IG2	IG3	Configure Automatic Session Locking on Enterprise Assets	-
4	4.4	Devices	Protect	IG1	IG2	IG3	Implement and Manage a Firewall on Servers	Exium's Cyber Gateway
4	4.5	Devices	Protect	IG1	IG2	IG3	Implement and Manage a Firewall on End-User Devices	Exium's Unified SASE-XDR agent
4	4.6	Devices	Protect	IG1	IG2	IG3	Securely Manage Enterprise Assets and Software	Exium’s XDR360
4	4.7	Users	Protect	IG1	IG2	IG3	Manage Default Accounts on Enterprise Assets and Software	-
4	4.8	Devices	Protect		IG2	IG3	Uninstall or Disable Unnecessary Services on Enterprise Assets and Software	Exium's XDR360
4	4.9	Devices	Protect		IG2	IG3	Configure Trusted DNS Servers on Enterprise Assets	Exium’s DNS Security
4	4.10	Devices	Protect		IG2	IG3	Enforce Automatic Device Lockout on Portable End-User Devices	-
4	4.11	Data	Protect		IG2	IG3	Enforce Remote Wipe Capability on Portable End-User Devices	-
4	4.12	Data	Protect			IG3	Separate Enterprise Workspaces on Mobile End-User Devices	-
5	Account Management	1/6
5	5.1	Users	Identify	IG1	IG2	IG3	Establish and Maintain an Inventory of Accounts	-
5	5.2	Users	Protect	IG1	IG2	IG3	Use Unique Passwords	Vault360
5	5.3	Users	Protect	IG1	IG2	IG3	Disable Dormant Accounts	-
5	5.4	Users	Protect	IG1	IG2	IG3	Restrict Administrator Privileges to Dedicated Administrator Accounts	-
5	5.5	Users	Identify		IG2	IG3	Establish and Maintain an Inventory of Service Accounts	-
5	5.6	Users	Govern		IG2	IG3	Centralize Account Management	-
6	Access Control Management	8/8
6	6.1	Doc	Govern	IG1	IG2	IG3	Establish an Access Granting Process	Exium's GRC360
6	6.2	Doc	Govern	IG1	IG2	IG3	Establish an Access Revoking Process	Exium's GRC360
6	6.3	Users	Protect	IG1	IG2	IG3	Require MFA for Externally-Exposed Applications	IAM360
6	6.4	Users	Protect	IG1	IG2	IG3	Require MFA for Remote Network Access	SSO/MFA-based Authentication for Exium SASE Clients IAM360
6	6.5	Users	Protect	IG1	IG2	IG3	Require MFA for Administrative Access	IAM360
6	6.6	Software	Identify		IG2	IG3	Establish and Maintain an Inventory of Authentication and Authorization Systems	Exium's GRC360
6	6.7	Users	Protect		IG2	IG3	Centralize Access Control	Security Controls with Exium’s SASE Solution
6	6.8	Users	Govern			IG3	Define and Maintain Role-Based Access Control	Exium's Role-Based Access Control
7	Continuous Vulnerability Management	5/7
7	7.1	Doc	Govern	IG1	IG2	IG3	Establish and Maintain a Vulnerability Management Process	Exium's GRC360
7	7.2	Doc	Govern	IG1	IG2	IG3	Establish and Maintain a Remediation Process	Exium's GRC360
7	7.3	Software	Protect	IG1	IG2	IG3	Perform Automated Operating System Patch Management	-
7	7.4	Software	Protect	IG1	IG2	IG3	Perform Automated Application Patch Management	-
7	7.5	Software	Identify		IG2	IG3	Perform Automated Vulnerability Scans of Internal Enterprise Assets	VAS360
7	7.6	Software	Identify		IG2	IG3	Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets	VAS360
7	7.7	Software	Respond		IG2	IG3	Remediate Detected Vulnerabilities	VAS360
8	Audit Log Management	12/12
8	8.1	Doc	Govern	IG1	IG2	IG3	Establish and Maintain an Audit Log Management Process	Exium's GRC360
8	8.2	Data	Detect	IG1	IG2	IG3	Collect Audit Logs	Exium's SIEM Solution
8	8.3	Data	Protect	IG1	IG2	IG3	Ensure Adequate Audit Log Storage	Exium's SIEM Solution
8	8.4	Data	Protect		IG2	IG3	Standardize Time Synchronization	Exium's SIEM Solution
8	8.5	Data	Detect		IG2	IG3	Collect Detailed Audit Logs	Exium's SIEM Solution
8	8.6	Data	Detect		IG2	IG3	Collect DNS Query Audit Logs	Web and SaaS Security
8	8.7	Data	Detect		IG2	IG3	Collect URL Request Audit Logs	Web and SaaS Security
8	8.8	Data	Detect		IG2	IG3	Collect Command-Line Audit Logs	Exium's SIEM Solution
8	8.9	Data	Detect		IG2	IG3	Centralize Audit Logs	Exium's SIEM Solution
8	8.10	Data	Protect		IG2	IG3	Retain Audit Logs	Exium's SIEM Solution
8	8.11	Data	Detect		IG2	IG3	Conduct Audit Log Reviews	Exium's SIEM Solution
8	8.12	Data	Detect			IG3	Collect Service Provider Logs	Exium's SIEM Solution
9	Email and Web Browser Protections	2/7
9	9.1	Software	Protect	IG1	IG2	IG3	Ensure Use of Only Fully Supported Browsers and Email Clients	-
9	9.2	Devices	Protect	IG1	IG2	IG3	Use DNS Filtering Services	Exium's SASE Web and SaaS Security
9	9.3	Network	Protect		IG2	IG3	Maintain and Enforce Network-Based URL Filters	Exium's SASE Web and SaaS Security
9	9.4	Software	Protect		IG2	IG3	Restrict Unnecessary or Unauthorized Browser and Email Client Extensions	-
9	9.5	Network	Protect		IG2	IG3	Implement DMARC	-
9	9.6	Network	Protect		IG2	IG3	Block Unnecessary File Types	-
9	9.7	Network	Protect			IG3	Deploy and Maintain Email Server Anti-Malware Protections	-
10	Malware Defenses	4/7
10	10.1	Devices	Detect	IG1	IG2	IG3	Deploy and Maintain Anti-Malware Software	Advanced Malware Detection with Exium’s XDR360
10	10.2	Devices	Protect	IG1	IG2	IG3	Configure Automatic Anti-Malware Signature Updates	Advanced Malware Detection with Exium’s XDR360
10	10.3	Devices	Protect	IG1	IG2	IG3	Disable Autorun and Autoplay for Removable Media	-
10	10.4	Devices	Detect		IG2	IG3	Configure Automatic Anti-Malware Scanning of Removable Media	-
10	10.5	Devices	Protect		IG2	IG3	Enable Anti-Exploitation Features	-
10	10.6	Devices	Protect		IG2	IG3	Centrally Manage Anti-Malware Software	Advanced Malware Detection with Exium’s XDR360
10	10.7	Devices	Detect		IG2	IG3	Use Behavior-Based Anti-Malware Software	Advanced Malware Detection with Exium’s XDR360
11	Data Recovery	1/5
11	11.1	Doc	Govern	IG1	IG2	IG3	Establish and Maintain a Data Recovery Process	Exium's GRC360
11	11.2	Data	Recover	IG1	IG2	IG3	Perform Automated Backups	-
11	11.3	Data	Protect	IG1	IG2	IG3	Protect Recovery Data	-
11	11.4	Data	Recover	IG1	IG2	IG3	Establish and Maintain an Isolated Instance of Recovery Data	-
11	11.5	Data	Recover		IG2	IG3	Test Data Recovery	-
12	Network Infrastructure Management	7/8
12	12.1	Network	Protect	IG1	IG2	IG3	Ensure Network Infrastructure is Up-to-Date	Seamless Software Management for Endpoints and Cyber Gateway
12	12.2	Network	Protect		IG2	IG3	Establish and Maintain a Secure Network Architecture	Exium's Cyber Gateway Architecture and Features
12	12.3	Network	Protect		IG2	IG3	Securely Manage Network Infrastructure	Exium's Cyber Gateway Architecture and Features
12	12.4	Doc	Govern		IG2	IG3	Establish and Maintain Architecture Diagram(s)	Exium's GRC360
12	12.5	Network	Protect		IG2	IG3	Centralize Network Authentication, Authorization, and Auditing (AAA)	Exium's Zero-Trust Network Access Control (NAC)
12	12.6	Network	Protect		IG2	IG3	Use of Secure Network Management and Communication Protocols	Exium's Cyber Gateway Architecture and Features
12	12.7	Devices	Protect		IG2	IG3	Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise’s AAA Infrastructure	Exium's Zero-Trust Secure Private Access
12	12.8	Devices	Protect			IG3	Establish and Maintain Dedicated Computing Resources for All Administrative Work	-
13	Network Monitoring and Defense	11/11
13	13.1	Network	Detect		IG2	IG3	Centralize Security Event Alerting	SASE Alerts Management
13	13.2	Devices	Detect		IG2	IG3	Deploy a Host-Based Intrusion Detection Solution	Exium’s XDR360
13	13.3	Network	Detect		IG2	IG3	Deploy a Network Intrusion Detection Solution	Exium's Intrusion Detection and Prevention Systems
13	13.4	Network	Protect		IG2	IG3	Perform Traffic Filtering Between Network Segments	Exium's Network Segmentation and Device Isolation
13	13.5	Devices	Protect		IG2	IG3	Manage Access Control for Remote Assets	Exium's Zero-Trust Secure Private Access
13	13.6	Network	Detect		IG2	IG3	Collect Network Traffic Flow Logs	Exium's Enhanced Cybersecurity and Network Observability with Netflow
13	13.7	Devices	Protect			IG3	Deploy a Host-Based Intrusion Prevention Solution	Exium’s XDR360
13	13.8	Network	Protect			IG3	Deploy a Network Intrusion Prevention Solution	Exium's Intrusion Detection and Prevention Systems
13	13.9	Network	Protect			IG3	Deploy Port-Level Access Control	Exium's Zero-Trust Secure Private Access
13	13.10	Network	Protect			IG3	Perform Application Layer Filtering	Exium's SASE Web and SaaS Security
13	13.11	Network	Detect			IG3	Tune Security Event Alerting Thresholds	SASE Alerts Management
14	Security Awareness and Skills Training	1/9
14	14.1	Doc	Govern	IG1	IG2	IG3	Establish and Maintain a Security Awareness Program	Exium's GRC360
14	14.2	Users	Protect	IG1	IG2	IG3	Train Workforce Members to Recognize Social Engineering Attacks	-
14	14.3	Users	Protect	IG1	IG2	IG3	Train Workforce Members on Authentication Best Practices	-
14	14.4	Users	Protect	IG1	IG2	IG3	Train Workforce on Data Handling Best Practices	-
14	14.5	Users	Protect	IG1	IG2	IG3	Train Workforce Members on Causes of Unintentional Data Exposure	-
14	14.6	Users	Protect	IG1	IG2	IG3	Train Workforce Members on Recognizing and Reporting Security Incidents	-
14	14.7	Users	Protect	IG1	IG2	IG3	Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates	-
14	14.8	Users	Protect	IG1	IG2	IG3	Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks	-
14	14.9	Users	Protect		IG2	IG3	Conduct Role-Specific Security Awareness and Skills Training	-
15	Service Provider Management	5/7
15	15.1	Users	Identify	IG1	IG2	IG3	Establish and Maintain an Inventory of Service Providers	-
15	15.2	Doc	Govern		IG2	IG3	Establish and Maintain a Service Provider Management Policy	Exium's GRC360
15	15.3	Users	Govern		IG2	IG3	Classify Service Providers	Exium's GRC360
15	15.4	Doc	Govern		IG2	IG3	Ensure Service Provider Contracts Include Security Requirements	Exium's GRC360
15	15.5	Users	Govern			IG3	Assess Service Providers	Exium's GRC360
15	15.6	Data	Govern			IG3	Monitor Service Providers	Exium's GRC360
15	15.7	Data	Protect			IG3	Securely Decommission Service Providers	-
16	Application Software Security	6/14
16	16.1	Doc	Govern		IG2	IG3	Establish and Maintain a Secure Application Development Process	GRC360
16	16.2	Doc	Govern		IG2	IG3	Establish and Maintain a Process to Accept and Address Software Vulnerabilities	GRC360
16	16.3	Software	Protect		IG2	IG3	Perform Root Cause Analysis on Security Vulnerabilities	VAS360
16	16.4	Software	Identify		IG2	IG3	Establish and Manage an Inventory of Third-Party Software Components	-
16	16.5	Software	Protect		IG2	IG3	Use Up-to-Date and Trusted Third-Party Software Components	-
16	16.6	Doc	Govern		IG2	IG3	Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities	GRC360
16	16.7	Software	Protect		IG2	IG3	Use Standard Hardening Configuration Templates for Application Infrastructure	-
16	16.8	Network	Protect		IG2	IG3	Separate Production and Non-Production Systems	-
16	16.9	Users	Protect		IG2	IG3	Train Developers in Application Security Concepts and Secure Coding	-
16	16.10	Software	Protect		IG2	IG3	Apply Secure Design Principles in Application Architectures	-
16	16.11	Software	Identify		IG2	IG3	Leverage Vetted Modules or Services for Application Security Components	-
16	16.12	Software	Protect			IG3	Implement Code-Level Security Checks	-
16	16.13	Software	Govern			IG3	Conduct Application Penetration Testing	VAS360
16	16.14	Software	Protect			IG3	Conduct Threat Modeling	GRC360
17	Incident Response Management	7/9
17	17.1	Users	Respond	IG1	IG2	IG3	Designate Personnel to Manage Incident Handling	GRC360
17	17.2	Doc	Govern	IG1	IG2	IG3	Establish and Maintain Contact Information for Reporting Security Incidents	GRC360
17	17.3	Doc	Govern	IG1	IG2	IG3	Establish and Maintain an Enterprise Process for Reporting Incidents	GRC360
17	17.4	Doc	Govern		IG2	IG3	Establish and Maintain an Incident Response Process	GRC360
17	17.5	Users	Respond		IG2	IG3	Assign Key Roles and Responsibilities	GRC360
17	17.6	Users	Respond		IG2	IG3	Define Mechanisms for Communicating During Incident Response	GRC360
17	17.7	Users	Recover		IG2	IG3	Conduct Routine Incident Response Exercises	-
17	17.8	Users	Recover		IG2	IG3	Conduct Post-Incident Reviews	-
17	17.9	Doc	Recover			IG3	Establish and Maintain Security Incident Thresholds	GRC360
18	Penetration Testing	5/5
18	18.1	Doc	Govern		IG2	IG3	Establish and Maintain a Penetration Testing Program	GRC360
18	18.2	Network	Detect		IG2	IG3	Perform Periodic External Penetration Tests	VAS360
18	18.3	Network	Protect		IG2	IG3	Remediate Penetration Test Findings	VAS360
18	18.4	Network	Protect			IG3	Validate Security Measures	VAS360
18	18.5	Network	Detect			IG3	Perform Periodic Internal Penetration Tests	VAS360

¶ NIST Cybersecurity Framework (CSF) Version 2.0

¶ CIS Critical Security Controls Version 8.1

¶ Exium's Unified Platform: A Holistic Approach to CIS Controls v8.1 Compliance

¶ Benefits for MSPs and their SMB Clients:

¶ Achieving CIS Controls v8.1 Compliance with Exium

¶ Conclusion