Security analysts play an important role working alongside the computer incident response team $($CIRT$).$ The analyst will be the individual who either fixes the issues or allocates resources to fix the issues identified by the CIRT. Using resources to facilitate the work becomes essential to sustain the health of an organization. Applying the Center for Internet Security $($CIS$)$ critical controls to company infrastructure is normal practice for an analyst. The controls are meant to guide the organization towards compliance. They are not meant to be used in isolation. Comparing an organization$$s technical concerns to the CIS critical controls provides a means of developing solutions to remediate issues. Once the issues are identified and remediated, the next step is to determine how to properly report those issues to different stakeholders.