Industry standards and control frameworks for building the program

A control framework is a structured catalog of controls, organized by topic, that an organization can select from and tailor. Using one avoids reinventing controls, provides a common language for auditors and partners, and makes it easier to show regulators that the program is reasonable. It also helps you spot gaps: if a framework covers supplier security and you have nothing there, you know where to look. CISM expects you to know the major options and how to use them, not to memorize control numbers.