CIAM: A data-driven approach for selecting and prioritizing security controls

This paper describes CIAM, an approach that provides cyber security engineers with an initial prioritization of security controls. The approach incorporates data related to security incidents, vulnerabilities exploited, business impact, and security control costs.