The cyber threat is very real, but hype and hyperbole have often led to disparate initiatives and solutions by governments, private industry, and security vendors. What enterprises need today is a uniform and structured way of looking at the big picture, together with the ability to break cyber challenges into discrete, understandable, and solvable problems with measurable solutions. A consortium of more than a hundred US government agencies and non-governmental cyber experts developed the Twenty Critical Security Controls (also known as the Consensus Audit Guidelines) to help provide exactly that capability. By using all the Controls—which have been prioritized by the US National Security Agency—an enterprise can ensure it has addressed all critical aspects of cyber security. Each Control provides insight into its own implementation, and each Control is critical. Some are easy to implement, others more difficult. They function most effectively, however, within a well-conceived risk management framework that enables an enterprise to identify risks and prioritize investments across the Controls. The aim of this talk is to share insights that will help enterprises understand the utility of the framework provided by the Twenty Critical Security Controls, as well as strategies to make them relevant to enterprises large and small.