2 of 24

Planet Fitness

Founded in 1992 by Marc Grondahl and Michael Grondahl.�
Planet Fitness Headquarters are located at Hampton, New Hampshire. There are 2,039 current fitness clubs worldwide.�
As of 2020, Planet Fitness has 1,616 employees.�
In 2017, Planet Fitness officially hit 10 million members!�
Planet fitness collects personal information from members when they sign up. Members may choose to omit some information given, but that may refrain them from using the certain application and website features.�
Some of the information Planet Fitness collects:

Identifying information (name, etc.), Classification, Commercial Information
Biometric Information, Account information (username, password, unique ID)
Credit card or banking information�

Planet Fitness also collects information that is sent to them automatically by members’ web browsers.

3 of 24

Center for Internet Security�(CIS)

The Center for Internet Security (CIS) is a nonprofit organization focused on improving public- and private-sector cybersecurity readiness and response. The CIS is comprised of four program divisions designed to promote global Internet security:

The Integrated Intelligence Center division facilitates relationships between government and private-sector entities to develop and disseminate comprehensive, coordinated security intelligence.
The Multi-State Information Sharing and Analysis Center division seeks to improve overall cybersecurity for state, local, territorial and tribal governments through collaboration and information sharing among members, private-sector partners and the United States Department of Homeland Security.
The Security Benchmarks division establishes and promotes the use of consensus-based best practice standards to improve Internet-connected systems' security and privacy, and to ensure the integrity of the public and private Internet-based functions and transactions.
The Trusted Purchasing Alliance is designed to help the public and private sectors procure cybersecurity tools and policies in a cost-effective manner.

4 of 24

CIS Benchmarks

are a set of globally recognized and consensus-driven best practices to help security practitioners implement and manage their cybersecurity defenses.
Developed with a global community of security experts, the guidelines help organizations proactively safeguard against emerging risks. Companies implement the CIS Benchmark guidelines to limit configuration-based security vulnerabilities in their digital assets.

5 of 24

CIS Benchmarks Explained

Inventory and Control of Enterprise Assets

Actively managing all enterprise assets connected to the infrastructure physically, virtually, remotely, and within cloud environments, to accurately know the totality of assets that need to be monitored and protected.

Inventory and Control of Software Assests

Actively managing all software on the network so that only authorized software is installed and execute, and unauthorized and unmanaged software is found and prevented from installation or execution.

Data Protection

Develop and processes and technical controls to identify, classify, securely handle, retain, and dispose of data.

6 of 24

CIS Benchmarks Explained

Secure

Secure Configuration of Enterprise Assests and Software

Establishing and maintaining the secure configuration of assets and software.

Account

Account Management

Uses processes and tools to assign and manage authorization to credentials for user's accounts, as well as service accounts, to enterprise assets and software.

Access

Access Control Management

Use processes and tools to create, assign, manage, and revoke access credentials and privileges for user, administrators, and service accounts for enterprise assets and software.

7 of 24

CIS Benchmarks Explained

Continuous Vulnerability Management

Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise's infrastructure to remediate and minimize the window of opportunity for attackers.

Audit Log Management

Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.

Email and Web Browser Protections

Improve protections and detections of threats from email and web vectors, as these are opportunities for attackers to manipulate human behavior through direct managements.

8 of 24

CIS Benchmarks Explained

Malware Defenses

Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.

Data Recovery

Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.

Network Infrastructure Management

Establish, implement, and actively manage (track, report, correct) network devices, in order to prevent attackers from exploiting vulnerable network services and access points.

9 of 24

CIS Benchmarks Explained

Network Monitoring and Defense

Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise’s network infrastructure and user base.

Security Awareness and Skills Training

Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.

Service Provider Management

Develop a process to evaluate service providers who hold sensitive data, or are responsible for an enterprise’s critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately.

10 of 24

CIS Benchmarks Explained

Application Software Security

Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.

Incident Response Management

Establish a program to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.

Penetration Testing

Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls (people, processes, and technology), and simulating the objectives and actions of an attacker.

11 of 24

NIST Framework

3 Key Components

12 of 24

NIST Framework Core

Identify
Protect
Detect
Respond
Recover

13 of 24

NIST Publications

NIST 800-53 Rev 5

Compliance publication
20 different control families
Over 1000 controls

NIST 800-53B

Publication with control baselines

NIST 800-171 Rev 2

Federal agencies

14 of 24

NIST Framework Profiles

Target Profile

Ideal Security Posture

Current Profile

Current Security Posture

Gap Analysis

Improving current to meet or exceed target profile

15 of 24

NIST Implementation Tiers

Partial

Little to no prioritization to risk

Risk Informed

Aware of the risk, but do not have the controls in place

Repeatable

Have policies in place, repeated

Adaptive

Constantly changing and adapting to the landscape

16 of 24

Cloud Security Alliance �(CSA)

The Cloud Security Alliance (CSA) promotes the implementation of best practices for providing security assurance within the domain of cloud computing and has delivered a practical, actionable roadmap for organizations seeking to adopt the cloud paradigm.

Cloud computing is a new operational model and set of technologies for managing shared pools of computing resources.
This technology offers enhanced collaboration, agility, scaling, and availability for organizations that choose to use this.
The key techniques used to create a cloud are abstraction and orchestration. Abstracting resources from underlying infrastructure to create pools and Orchestrating (automating) to coordinate carving out and delivering a set of resources from the pools to the consumers.
States that: The most important security consideration is knowing exactly who is responsible for what in any given cloud project.

17 of 24

CSA Characteristics and Models

The CSA correlates to the NIST model for cloud computing standard.
The CSA also endorses the ISO/IEC model, which provides a more in-depth reference model regarding information on cloud computing.
NIST defines cloud computing by describing five essential characteristics, three cloud service models, and four cloud deployment models as displayed to the right:

18 of 24

CSA Characteristics and Models Explained

Characteristics

Cloud computing requires all these characteristics. If it lacks any of them, it is likely not a cloud.

Resource Pooling: The most fundamental characteristic. Collects all resources and pools them together. It then allocates them to different consumers.

On-Demand Self Service: Consumers can manage recourses without human administrating.

Broad Network Access: Resources are available over a network without any need for physical access.

Rapid Elasticity: Consumers can expand resources from the pool automatically.

Measured Service: Ensures Consumers only use what is needed. The client only pays for what they use

Service Models

There are 3 service models describing the different foundational categories of cloud services:

Software as a Service: a full application that is managed and hosted by the provider. Accessed with web browser, mobile app, or client app.

Platform as a Service: Provides development or application platforms such as databases, application platforms, file storage, and collaboration. With PaaS, you do not manage the underlying servers, networks, and infrastructures.

Infrastructure as a Service: Offers access to a resource pool of fundamental computing infrastructure, such as compute, network, or storage.

Deployment Models

These are how the technologies are deployed and consumed, and how they are applied across the entire range of service models.

Public Cloud: Available to the public or a large industry group and is owned by an organization selling cloud services

Private Cloud: Operated for a single organization. It may be managed by the organization or by a third party and may be located on or off premises.

Community Cloud: Cloud shared by several organizations and supports a specific community that has shared concerns.

Hybrid Cloud: Composed of two or more clouds (private, community, or public) that remain unique entities but are bound together. Commonly used to describe a non-cloud data center bridged to a cloud provider.

19 of 24

CSA Security Scope

Since Cloud computing is a shared technology model, security responsibilities are distributed amongst all organizations involved.
This is commonly referred to as the shared responsibility model.
Security allocation varies based on the service model of the organization
Software as a Service: The cloud provider is responsible for nearly all security since the cloud user can only access and manage their use of the application, and not how the application works. Ex: SaaS provider is responsible for perimeter security, logging/auditing, and application security, while the consumer may only be able to manage authorization and entitlements.
Platform as a Service: The cloud provider is only responsible for the security of the platform, while the consumer is responsible for everything that they implement on the platform, including how they configure any offered security features. Ex: Provider manages security, patching, core configuration, while the cloud user is responsible for database security features, managing accounts, and authentication methods.
Infrastructure as a Service: The provider is responsible for foundational security, while the user is responsible for everything they build on the infrastructure. This places far more responsibility on the client. Ex: IaaS provider will monitor perimeter for attacks, but the consumer is responsible for how they implement their virtual network security.

20 of 24

How do they compare? (Similarities)

These frameworks are similar when it comes to their objectives and fundamental principles to be achieved.

The controls and guidelines that are provided by these frameworks aim to improve an organization's security standing.
These frameworks emphasize creating plans to identify, prevent, detect, respond to and recover from security risks, as well as improve an organization's ability to manage the identified risks.
The frameworks also focus on the implementation of security measures to protect the three main core principles of cybersecurity (Confidentiality, Integrity and Availability).
Implementation tiers are offered in these various frameworks. This could help inform organizations of how good their cybersecurity practices are.
CIS is can be mapped to NIST 800-53, CSA can be mapped to CIS 18, NIST is mapped to ISO 27001

21 of 24

Differences

Framework	Guidance Criteria	Target Industry	Core Function
NIST	Risk Based Guidance Framework (some ambiguity) You can apply all of the standards or apply a few within the framework based on your organization’s needs and goals. Ranked by Low, Moderate, and High	Federal Sector	NIST provides security objectives. Essentially, it helps your organization think about its risk and then helps point you in the right direction to better understand how to identify and respond to these risks, for example, in terms of access control, response, authentication, etc. It provides you with information to help you look at all of your critical assets, and then apply NIST guiding statements to those assets.
CIS V8	Maturity-Driven Framework	All	CIS is more explicit. It doesn’t just give you a generalized objective. It provides you with explicit control, which is worded in such a way you understand how to adopt and implement it.
CSA	A new operational model and set of technologies for managing shared pools of computing resources.	Cloud Sector	The Cloud Security Alliance (CSA) promotes implementing best practices for providing security assurance within the domain of cloud computing and has delivered a practical, actionable roadmap for organizations seeking to adopt the cloud paradigm.

When you graphically depict the various, leading cybersecurity frameworks from "easier to harder" it primarily focuses on the sheer number of unique cybersecurity and privacy controls. The volume of these controls (e.g., requirements) directly impacts the number of domains covered by that cybersecurity framework. The lesser number of controls in a cybersecurity framework might make it appear easier to implement, but it also might not provide the necessary coverage that your organization needs from the perspective of administrative, technical and physical cybersecurity and privacy practices. This is where defining "just right" is primarily a business decision, based on your organization's risk profile, which needs to consider applicable laws, regulations and contractual obligations that are required to support existing or planned business processes.

This selection process generally leads to adopting the NIST Cybersecurity Framework, ISO 27002, NIST 800-53 or the Secure Controls Framework (SCF) as a starting point. We call it the "cybersecurity Goldilocks dilemma" since it addresses the question: Which cybersecurity framework is "not too hard, not too soft, but just right!" for my organization? It comes down to first defining you "must have" and "nice to have" requirements, since that helps point you to the most appropriate framework to meet your specific needs. It can be a little confusing when you look at it from a "heat map" perspective, since each framework has its own unique specialization and depth of coverage. However, understanding this can help you make an informed decision on the most appropriate framework for your needs. You may even find you need to leverage a metaframework (e.g., framework of frameworks) to address more complex compliance requirements

22 of 24

Planet Fitness Framework Analysis

Our selection process involved looking at the NIST CSF, NIST 800-53 as a starting point. We defined the must have , nice to have requirements and we considered the CIS Framework is more closely aligned with the industry and business size and risk profile for Planet Fitness.

Planet Fitness buys workout equipment and supplements from multiple different providers. Additionally, Planet Fitness locations have inventory for the staff, most importantly, computers. These computers are part of Planet Fitness' assets and must be properly maintained and secured. ��

The CIS framework aims to help organizations actively manage ALL assets. This is done through a multi-step process which eventually helps organizations detect the totality of assets that need to be monitored and how to protect them. Members of Planet Fitness have extremely sensitive PII data entered into these computers, and the CIS framework is the most ideal as it has a very in-depth, multistep process to help secure this information.

23 of 24

Planet Fitness Framework Analysis

Assessment Criteria	Rationale:	Industry Benchmark	Planet Fitness Rating	Areas for Improvement / Achievement
Service Provider Management (Control 15)	For Planet Fitness, selecting which Manage Services Provider (MSP) to partner with is critical. The increased popularity of MSPs has given rise to a greater pool of providers with a varying range of expertise and experience. Because of the sensitive data that gyms contain it is essential to choose an aligned MSP.	Gyms in this category are not at optimal levels concerning vendor management and security. At a minimum, all gyms have personal information relating to their employees and some amount of personal information on their members and guests A single gym can easily process and store hundreds or thousands of financial transactions, including credit card data and banking information.	Moderate	After review of partnerships and key service providers, Planet Fitness ranks higher in this category compared to others however, while they have a lot of partnerships, the focus is on services offered rather than trusted providers in the industry such as key partnerships with leading privacy and health advocates. Limited data on their policy of sharing data with MSPs and the extent of data is protected and controlled.
Application Software Security (Control 16)	Planet Fitness uses Salesforce. This includes shield platform encryption, event monitoring, and field audit trails. Although these features are implemented through Salesforce, Planet Fitness is urged to implement additional software security following the CIS framework.	Typically, gyms do not take the security of their software seriously. They do not believe they need to specialize in that since they mainly just provide a space for people. These companies are also vague with how they secure their software.	Needs Improvement	Planet Fitness incorporates some of its software security from a third-party system (Salesforce). This software keeps track of all digital activity between the club, its members, and perspective members. While this is helpful, Planet Fitness still needs to implement and customize additional security on their software.
Data Protection (Control 3)	Planet fitness processes a huge amount of sensitive customer information, and the protection of this data is vital to the company image and its customers.	Gyms typically have data that is encrypted at rest and while moving. This minimizes the opportunity for attackers to intercept plaintext. With such high amounts of customer PII gym franchises must ensure that unused data is properly disposed of. Any cloud data should be thoroughly protected through the CSP or through security mechanisms put in place by the company.	Good	Planet fitness processes a lot of customer PII and they encrypt and dispose of that data in a secure fashion. However, to insure further security they can implement greater endpoint security, with mechanisms such as firewalls and security detection/prevention devices. Currently they use Salesforce to handle their data processing and put the security in the hands of the service provider. However, the on premise devices that planet fitness handles need to implement further security controls and mechanisms.

24 of 24

Planet Fitness Analysis Cont.

Assessment Criteria	Rationale:	Industry Benchmark	Planet Fitness Rating	Areas for Improvement / Achievement
Security Awareness and skills training (Control 14)	The employees at Planet Fitness have access to sensitive information collected from their customers and need to be trained on how to reduce the chances of breaches.	Gyms do not really put a big emphasis on security training because they believe that it is not as important for gyms as it is for big companies.	Good	While planet fitness has an online platform that delivers its security awareness courses, the company needs to also train their employees to identify and report attacks, best handle data collected, and adopt best authentication practices.
Inventory and Control of Enterprise Assets (Control 01)	Planet Fitness stores extremely sensitive PII on computer inventory and orders thousands of equipment machinery every year.	Gyms in this class are moderate in terms of controlling sensitive data, several news outlets have reported on sensitive data leakage with employees related to data controls.	Moderate	Planet Fitness needs to better establish and maintain an accurate inventory of all enterprise assets that have the potential to store or process data. This must include all software apps and web servers They must ensure all unauthorized assets are addressed and removed promptly.