Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity Policy Mapping topic
No spam. Unsubscribe anytime.
IT staff outline plan to map city policies to CIS cybersecurity controls
Summary
City IT staff presented a plan to map existing policies to Center for Internet Security (CIS) critical controls, create separate end-user and IT handbooks, and run regular self-assessments to reach IG1/IG2 compliance and improve audit readiness.
Chris (Staff member) told the Waukesha City Information Technology Board that the department will map the city’s policies to the Center for Internet Security (CIS) critical controls and split policies into separate end-user and IT handbooks to reduce duplication. “CIS is Center for Internet Security,” Chris said, outlining the 18 CIS sections and how the mapping shows where CJIS, PCI and NIST 800‑53 overlap with existing city policies.
Chris walked the board through the CIS self‑assessment tool the team has been testing, saying the first pass will check compliance under Implementation Group 1 and a later pass will target Implementation Group 2. He said the intent is to centralize documentation so that, when auditors arrive, the city can hand over clear evidence: “We’ve been using this assessment tool…we’re right now looking at implementation group 1,” Chris said. The plan calls for two self-assessments per year—an initial run and a follow-up roughly nine months later—to drive policy and SOP updates.
Board members asked how the mapping would surface gaps; Chris pointed to specific areas such as inventory of service providers where no policy currently maps to a CIS control and said the exercise will produce concise policy templates for auditors and insurers. Staff will return with redlines and proposed handbook layouts at a future meeting.
