SANS 20 Critical Security Controls
SANS Institute made available a prioritised baseline of information security measures and controls that allows organisations to focus their spending on the key security controls that protect against known attacks and detect attacks that occur.
For each of the 20 controls a number of properties are described in detail:
- How do attackers exploit the lack of this control?
- How can this control be implemented, automated, and its effectiveness measured?
- Procedures and tools for implementing and automating this control:
- Control metrics
- Control test details
- Referencing to NIST SP 800-53
http://www.sans.org/critical-security-controls/
SANS also offers the 20 Critical Security controls document available in PDF version.
