When companies struggle with what to do and how to demonstrate their Cyber Security efforts, many turns to ISO 27001 & 27002. These frameworks are excellent for showing compliance but not well-suited for prioritizing, measuring, and implementing practical IT-security initiatives. To that end, you need a consensus-based framework, such as the CIS 18 critical security controls includes detailed practical and prioritized advise on how to implement cyber security. The CIS controls include detailed instructions on what to do, how to measure, how to prioritize, and how to audit your cybersecurity posture.