CIS RAM does not have a broken answer. It has a missing axis. And the consequence of that missing axis is not abstract — it is a specific, measurable distortion that the framework cannot perceive about itself.
To see it, you only need to ask one question CIS RAM never asks: where, by cause, does our control effort actually go?
The two axes
Every risk framework measures along some axis. The axis you choose determines what you can see — and what you can't.
CIS RAM measures by
Six buckets. The VCDB Index. Frequency that an asset type appears as a target.
TLCTC measures by
Ten mutually-exclusive generic vulnerabilities. The mechanism, not the target.
These are not two views of the same thing. "A server was attacked" (asset) and "the server was exploited / abused / reached with stolen credentials" (cause) are orthogonal. One asset bucket can hold three causes. One cause can strike five asset types. You cannot derive one axis from the other.
CIS chose the asset axis. So the cause axis is simply not in the data.
Map the 153 Safeguards by cause. This appears.
Every CIS Controls v8.1 Safeguard, assigned to the cluster whose generic vulnerability it acts upon. Bar length = preventive control effort landing on that cause.
preventive coverage
fragments sit on #2+#4
flag this distribution
Why CIS cannot see this
The skew above is not a secret. It is sitting in the control set, in plain sight, the whole time. The reason no CIS RAM assessment has ever surfaced it is structural: the chart is drawn on an axis CIS RAM does not possess.
CIS RAM's expectancy engine pairs two numbers — how often an asset class is hit, and how mature a Safeguard is. There is no cause variable anywhere in that calculation. So when the control set pours nineteen preventive measures onto server exploitation and one onto flooding, the engine has no coordinate in which that fact can register. It can tell you that devices are attacked in 74% of incidents. It cannot tell you that your defenses against server exploitation outnumber your defenses against flooding nineteen to one — because "server exploitation" and "flooding" are not entries in its vocabulary. They are causes. CIS speaks assets.
A blind spot is not an error. It is a region the instrument cannot resolve — no matter how carefully you read it.
Why it matters
You might object: maybe server exploitation deserves nineteen controls. Maybe flooding is a one-control problem. Perhaps. But that is a decision a risk framework should let you make — and defend. Right now CIS RAM cannot present the distribution, so the distribution was never decided. It accreted. Each Safeguard was added on its own merits, against an asset-frequency justification, with nothing in the method ever asking "and how does this balance our effort across causes?"
Under DoCRA — CIS RAM's own standard — a "reasonable person" balances effort against foreseeable harm. But you cannot demonstrate a balanced, reasonable allocation across threats you cannot enumerate. If a flooding attack causes harm, "we had one control, weighted by asset-class frequency" is not a defense. "We deliberately allocated N controls to flooding because our cause-balanced assessment judged it an N-control risk" is. The first is an accident. The second is due care. Only the cause axis can produce the second.
This is the whole argument, and it is small enough to hold in one hand: CIS RAM can tell you whether a risk is reasonable to accept. It cannot show you how your own defenses are distributed across the causes of those risks — because it measures the wrong axis. The distribution is right there. CIS simply cannot see it.
The fix is free
The cause axis exists. It is ten mutually-exclusive clusters, openly published, CC BY 4.0. Adopt it underneath CIS RAM and nothing of value is lost: Impact × Expectancy stays, the reasonableness test stays, the legal translator stays. What is gained is sight — a control set that can finally see its own shape, name its own gaps, and defend its own balance.
CIS does not need to be replaced. It needs to be able to see.
Read the full argument: Why CIS Cannot Answer Your Cyber Threat Risk · or the evidence: 153 Safeguards → 74 objectives.