Cybersecurity Standards Scorecard (2025 Edition)

Value of the Information & Strength of the Argument

The value of the information is high for practitioners needing to navigate the complex landscape of cybersecurity standards. The speaker provides a structured methodology for evaluating standards, based on criteria like safeguard coverage, recency, and community involvement. He supports his arguments with examples from his consulting experience, such as the client wanting to use NIST CSF for DevOps despite its lack of coverage. The argumentation is coherent and persuasive, advocating for a more thoughtful approach to standards selection rather than following popular trends. However, the presentation is largely qualitative, and the specific scoring results are not shown in detail, limiting the ability to verify the claims.

Scientific Rigor, Source Quality, Title Accuracy

The speaker references his own research and the CRF safeguards library, which is freely available at cfsecure.org. He also mentions specific standards like CIS Controls, NIST CSF, and ISO 27001. The sources are credible, but the presentation does not provide direct citations to external research. The title accurately reflects the content, which is a scorecard comparison of standards. The speaker’s expertise and the systematic approach lend credibility, but the lack of detailed methodology in the video is a limitation.

The title accurately reflects the content, which is a comparative scorecard of cybersecurity standards for 2025.

8/10

The speaker is a senior SANS instructor with extensive experience in cybersecurity standards, and the presentation is based on a systematic annual research study. However, the methodology is not fully detailed in the video, and the results are presented as expert opinion rather than peer-reviewed research.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Introduction to the webcast and the annual study.
• 05:00Discussion on the proliferation of standards and the need for a clear target state.
• 10:00Explanation of the methodology for evaluating standards, including the CRF safeguards library.
• 15:00Overview of major standards considered in the 2025 study.
• 20:00Key findings: 2025 was a quiet year with no major updates to major standards.
• 25:00Discussion on trends, including the increasing focus on NIST SP 800-171 and CMMC.
• 30:00Introduction of the Cyber Rosetta Stone for mapping standards.
• 35:00Advice on avoiding 'shiny objects' and focusing on essential safeguards.

• Original presentation slides and unedited recording — Referenced as the source for the full presentation materials.
• LDR519: Cybersecurity Risk Management and Compliance — Mentioned as the course supporting this webcast's content.
• James Tarala's SANS profile — Referenced for more information about the speaker.

• NIST Cybersecurity Framework — The video discusses the NIST CSF as a major standard, and this official page provides details.
• CIS Controls — The video references the CIS Controls as a key standard, and this page offers the latest version.