NIST Control Families: A Practical Reference for Security Teams

A pentest is a time-boxed, authorized attack where ethical hackers chain flaws to prove exploitable risk, not just run scans. It outlines deliverables, audit drivers, and when to test.

Since the role of the Chief Information Security Officer (CISO) and how he or she reports has a major impact on security and risk, I think it’s interesting to look at how different organizations have structured the position. With that said, there is very little consistency other than a correlation with the industry vertical’s understanding of IT risk.

I attended the PCI-SSC community meeting this past week (September 22-24). There were three key issues discussed that showed that the PCI program is maturing and that a number of standards and regulations are converging (both in and outside the PCI world).

Turning an ISO 27001 ISMS into working controls: tie risk assessments to real systems, keep evidence fresh and let internal audits sample technical control behavior—not just paperwork.

Using NIST SP 800-53 without drowning: scope systems and impact levels first, write implementation statements that name the enforcing system, and validate controls with real logs and configuration.

Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.