Security measures for digital systems go beyond just installing security software or reacting to security incidents. Risks should be identified, responsibilities assigned, controls put in place, performance measured, and protections enhanced over time in an organised way within the organisation. Cybersecurity frameworks and standards provide a structure through which organisations can carry out security activities and manage information risks in a recognised way. Frameworks and standards are related, but they are not necessarily the same. A framework is a general model with guidelines that help an organisation decide which security aspects to address. Standards may include more detailed requirements or guidance which organisations may refer to when developing formal security management systems.
Using the NIST Cybersecurity Framework to Organise Risk Management
The NIST Cybersecurity Framework is a well-known tool that helps organisations understand and manage cybersecurity risk. NIST CSF 2.0 structures cybersecurity results into six ongoing functions: Govern, Identify, Protect, Detect, Respond, and Recover. The Govern function includes activities related to organisational context, risk strategy, responsibilities, policies, and oversight. It frames cybersecurity as an integral part of organisational governance, not just an IT problem.
Identify includes the knowledge and understanding of the organisation’s systems, data, assets, suppliers and risks. Protect is about measures to minimise the frequency or severity of cybersecurity incidents. Detect is the ability to detect potentially harmful activity, and Respond is the ability to take action after an incident has been detected. Recover aims to rebuild capabilities and build resilience after disruption.
The benefits of the NIST approach are that it is not prescriptive and is outcome-focused. How organisations achieve these outcomes depends on the technologies they use, the organisation’s size, the risks involved, and its operating environment. The NIST also offers organisational profiles to represent the current and desired cybersecurity posture. This flexibility allows the framework to apply to organisations from those just starting to formalise their cybersecurity to those with mature security programmes.
Understanding ISO/IEC 27001 and Information Security Management
NIST offers a flexible cybersecurity risk framework, whereas ISO/IEC 27001 is a management-system approach. Cybersecurity professionals should be aware of this distinction, as ISO/IEC 27001 is based upon the development, implementation, maintenance, and continuous improvement of an Information Security Management System, or ISMS. An ISMS helps an organisation manage its information security systematically rather than ad hoc. It requires organisations to consider risks, leadership responsibilities, planning, resources, performance evaluation, and continual improvement.
ISO 27001:2013 is therefore primarily about how an organisation manages information security. While technical controls matter, other elements, such as policy, employee responsibility, supplier management, physical protection, and governance processes, also support the overall system. ISO/IEC 27002 helps by guiding information security controls. The latest edition (2022) includes information on access control, cryptography, HR security and incident response. ISO/IEC 27002 does not establish certification standards, but guides organisations.
It’s not a trivial difference. An organisation can obtain ISO/IEC 27001 certification to demonstrate compliance with the defined requirements for an information security management system. ISO/IEC 27002 can then help provide more detailed guidance for selecting and implementing appropriate controls. An understanding of ISO standards can also increase awareness of the larger organisational environment of technical security work for Cyber Security professionals. Security isn’t just about protecting against attacks. Organisations must also document responsibilities, assess risks, evaluate controls, review performance, and continually improve practices.
Applying the CIS Critical Security Controls in Practice
Others require more directive information on the first line of defence. The Critical Security Controls are a prioritised list of security controls used to defend systems and information against common cyber threats. There are currently 18 Controls and 153 Safeguards in the CIS v8.1. These controls include enterprise asset management, software management, data protection, secure configuration, account management, access control, vulnerability management, audit logs, email and web protection, malware defences, data recovery, network infrastructure, security awareness, service-provider management, application security, incident response, and penetration testing. This means that when it comes to turning overarching Cybersecurity goals into action, CIS is especially beneficial.
An organisation might know it needs to better protect its systems, for example, but the CIS Controls can identify specific safeguards that help achieve this objective. CIS also has three Implementation Groups for the implementation process. IG1 is a starting point for every organisation and is essential cyber hygiene. IG2 extends these protections for organisations with higher complexity or risk, and IG3 includes all applicable safeguards for organisations with the highest level of security maturity in the model. CIS Controls v8.1 also aligns more closely with other leading frameworks, such as NIST CSF 2.0 and the Govern function. This is an essential lesson: Organisations do not have to view frameworks as mutually exclusive systems. A business could use NIST to define its cybersecurity risk programme and use CIS Controls to think through practical controls that support it.
Choosing and Combining Frameworks and Standards
The first step in choosing a Cybersecurity framework should be to consider the organisation’s risks, objectives, legal requirements, customer expectations, and resources. Use a framework to inform decisions, not merely because another organisation has used it. NIST CSF 2.0 may be a good starting point for a business looking for a general framework for addressing cybersecurity risk. An organisation seeking to implement an information security management system or become certified may focus more on ISO/IEC 27001. The CIS Controls can help a company identify the most important technical and operational controls for protection. These methods may additionally be combined. For instance, NIST’s Govern and Identify functions can help an organisation define its strategic priorities, while CIS safeguards support practical control implementation.
ISO/IEC 27001 can provide a management framework to review risks, responsibilities, performance, and continual improvement regularly. Organisations should also differentiate between frameworks, standards, and legal requirements. Compliance with a recognised Cyber Security framework does not necessarily imply that all regulatory or contractual requirements are met. Businesses may also need to consider other laws/regulations on privacy, industry standards, customer contracts, etc. Any implementation process should thus start with an understanding of the organisation. Tools can help identify where asset inventories, risk assessments, existing controls, business risks and priorities, and key information systems need the most attention.
Conclusion
Cybersecurity frameworks and standards offer structured processes and methods to help organisations manage digital risk, secure information, and evolve their security practices over time. The NIST Cybersecurity Framework 2.0 defines cybersecurity risk management through six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It is flexible and outcomes-based, so that organisations can tailor it to their needs.
GET IN TOUCH WITH THE DIGITAL SCHOOL OF MARKETING
Equip yourself with the essential skills to protect digital assets and maintain consumer trust by enrolling in the Cyber Security Course at the Digital School of Marketing. Join us today to become a leader in the dynamic field of cybersecurity.
