You probably wouldn’t set out on a trip without first mapping the route you plan to take to your destination. The journey to better cybersecurity is no different: After deciding to undergo a security risk assessment, the next question you’ll need to ask is which framework you should utilize.
Because everyone’s situation is unique, there isn’t a one-size-fits-all method for achieving optimal security posture, and it’s essential to carefully consider your options and select a system that aligns with your specific requirements.
Fortunately, you don’t have to construct your own security standards from scratch. Organizations and agencies in the information security space maintain risk mitigation frameworks that can apply to organizations of various sizes and across industries.
Here are the major security guidelines you should consider if you’re searching for the best road map for your business. These frameworks undergo periodic reviews and updates to stay up-to-date with the latest developments in the IT security world.
1. NIST Cybersecurity Framework (CSF)
This framework from the National Institute of Standards and Technology (NIST) offers voluntary best practices that can help businesses of any size safeguard their networks and sensitive data, according to the Federal Trade Commission (FTC). It consists of the following three components.
- The Framework Core lays out industry standards, best practices and guidelines in a way that facilitates the communication of security activities and goals throughout your entire organization. The Core covers these five functions:
- Identifying all the equipment, data and software utilized throughout your organization.
- Protecting your infrastructure and data (e.g., through encryption and security awareness training)
- Detecting threats
- Responding to security incidents
- Recovering after a cyberattack
- The Framework Implementation Tiers categorize your risk management practices on a scale of partial (Tier 1) to adaptive (Tier 4). NIST advises identifying the tier you want to be at based on your organizational objectives.
- The Framework Profile can cover cybersecurity activity outcomes you’re currently achieving or that you’d like to ideally attain. You can develop a profile by identifying the most critical NIST CSF categories and subcategories for your organization based on your needs, goals and risk assessment. This can shed light on ways to reduce your risk level if you compare your current profile with your optimal profile.
Overall, the NIST CSF can seem overwhelming. However, it includes not only technical controls but also built-in organizational controls. By leveraging this framework, you can figure out what to focus on and where to invest resources to accomplish your security goals.
2. CIS Controls
The Center for Internet Security (CIS) also provides a recommended framework for protecting your network and data from cyberattacks. First developed by an international consortium in 2008, the CIS Controls have become popular with thousands of companies worldwide as a relatively short list of the most effective steps you can take to enhance your security posture.
The latest version of the CIS framework includes 18 top-level controls covering everything from inventory and control of enterprise assets to penetration testing. CIS Controls v8 also accounts for trends like increased reliance on cloud computing, remote work, and virtualization. CIS focuses on technical controls and provides machine image baselines that meet those standards, which you can deploy in AWS or Azure with a few clicks.
While these controls align with many leading compliance standards, CIS notes that they don’t serve as a replacement for regulatory frameworks like HIPAA or PCI DSS. Instead, they can serve as a jumping-off point for your defensive strategy and help you combat the most common security threats.
If you’d like to get insight into your risk score based on the CIS Controls, fill out our free security risk assessment questionnaire.
3. ISO 27001
The International Organization for Standardization (ISO) has created a series of standards for information security. While the ISO/IEC 27000 family contains over a dozen standards, ISO/IEC 27001, in particular, is well-known worldwide and details information security management system requirements. The 27001 guidelines are general enough to apply to companies of all sizes and across all industries. This framework can help your organization establish, deploy and maintain a comprehensive cybersecurity program customized to meet your business needs. Additionally, it specifies requirements for assessing and handling information security risks. While adhering to ISO standards isn’t mandatory, many organizations choose to get certified to demonstrate a high level of security to current and prospective clients.
Note: The ISO doesn’t administer certification, so you’ll have to go through an external certification body. Ultimately, determining which security framework to use depends heavily on your distinct needs, objectives, and regulatory obligations, among other factors.
Contributed blog courtesy of Stratosphere Networks and authored by Jesse Miller, CISO at Stratosphere Networks. Read more contributed blogs from Stratosphere Networks here.
