Reasonable Cybersecurity: From Legal Theory to Practice

This CIS article explains the growing legal and regulatory emphasis on “reasonable cybersecurity,” advocating for risk-based, defensible security programs aligned to frameworks like the CIS Controls and CIS RAM. It highlights state laws referencing recognized standards, introduces Implementation Groups to tailor safeguards by organizational context, and promotes the CIS Guide to Defining Reasonable Cybersecurity to help leaders document and justify appropriate controls. The focus is on practical, auditable security decisions that protect both organizations and consumers.