Selecting a cybersecurity framework
A common misconception is that all cybersecurity frameworks are created equal. This notion is far from the truth, as each framework has its own unique set of requirements, controls, and implementation guidelines.
Choosing the right cybersecurity framework requires careful consideration of specific factors, including:
- Business objectives and risk appetite. A framework should align with the organization's objectives, risk appetite, size, scope, and complexity of operations.
- Regulatory compliance requirements. Compliance requirements might vary depending on the industry and geographic location. Organizations should choose a framework that meets the relevant regulatory requirements.
- Industry standards and best practices. Frameworks should align with industry standards and best practices to ensure a comprehensive and effective cybersecurity program.
- Existing security controls and infrastructure. Organizations should consider their existing security controls and infrastructure when selecting a framework to avoid duplicating efforts and wasting resources.
- Budget and resources. Frameworks might require significant investment in terms of time, money, and resources. Organizations should choose a framework that fits within budget and resource constraints.
- Internal expertise and capabilities. Organizations should take into account their internal expertise and capabilities when selecting a framework so that they can effectively implement and maintain it.
- Third-party requirements. Organizations should consider third-party requirements, particularly if they are contractually agreed to, when determining what framework to adopt.
Pitfalls to avoid
Implementing a cybersecurity framework does not guarantee protection against all cyberthreats. A robust implementation requires careful planning, collaboration, and ongoing maintenance.
Common pitfalls to avoid include:
- Lack of executive sponsorship. Without executive sponsorship, a cybersecurity program might not receive the necessary resources and support it needs to be effective.
- Lack of stakeholder buy-in. Engaging stakeholders throughout the organization can help make sure that the cybersecurity program is effectively implemented and maintained.
- Overlooking key requirements. Failure to address key requirements within a framework can leave the organization vulnerable to cyberthreats.
- Poor communication and collaboration. Effective communication and collaboration across the organization are essential for successful implementation.
- Failure to adapt to changing threats and risks. Cyberthreats are constantly evolving, and a framework that is effective today might not be effective tomorrow. Organizations must continually monitor and adapt their cybersecurity programs and stay ahead of emerging threats.
5 cybersecurity frameworks
Following is a comprehensive review of five cybersecurity frameworks, including the descriptions, benefits, and limitations of each.
NIST CSF: The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) is a widely adopted framework for managing and reducing cybersecurity risk in the United States. The NIST CSF is currently composed of five core functions: identify, protect, detect, respond, and recover. Each function includes categories and subcategories that provide detailed guidance on implementing a comprehensive cybersecurity program. The NIST CSF also includes implementation tiers that provide a framework for organizations to assess and improve their cybersecurity program maturity. A draft of version 2.0 of the NIST CSF is scheduled for release in 2023.
| Framework benefits |
Framework limitations |
|
Strategic benefits
- Aligns cybersecurity risk management with business strategy
- Provides a framework for communicating cybersecurity risks and priorities to senior management
Tactical benefits
- Allows for internal evaluation against industry standards
- Provides a structure for prioritizing cybersecurity initiatives and investments
- Allows mapping to multiple industry regulations
Operational benefits
- Emphasizes continuous monitoring and improvement
- Provides a flexible and adaptable framework that can be tailored to an organization's unique needs
Technical benefits
- Provides a baseline set of security controls that can be customized to an organization's specific technical environment
- Includes guidance for implementing technical security controls, such as firewalls, intrusion detection systems, and access controls
|
Strategic limitations
- Might lack sufficient guidance for aligning cybersecurity with business strategy
- Might not meet the specific regulatory requirements for certain industries
Tactical limitations
- Might lack specific guidance for prioritizing security controls based on an organization's unique risks and threat environment
- Can be overly prescriptive, limiting flexibility and adaptability
Operational limitations
- Might not provide a common language and framework for communicating cybersecurity risks and priorities across different departments and stakeholders
- Can be too high level to be useful for certain technical roles or processes
Technical limitations
- Might lack detailed guidance for implementing technical security controls
- Might not provide specific testing and validation procedures for technical controls
|
CIS Critical Security Controls: The Center for Internet Security (CIS) Critical Security Controls provide a prioritized set of actions that organizations can take to improve their cybersecurity posture. These controls are organized into three implementation groups. The CIS Critical Security Controls are continually updated based on emerging threats and industry best practices.
| Framework benefits |
Framework limitations |
|
Strategic benefits
- Prioritizes security controls based on effectiveness
- Provides a framework for aligning cybersecurity risk management with business strategy
Tactical benefits
- Provides detailed implementation guidance
- Helps organizations identify and prioritize security controls based on their unique risks and threat environment
- Allows mapping to multiple industry regulations
Operational benefits
- Updated regularly based on emerging threats and trends
- Provides a flexible and adaptable framework that can be customized to an organization's unique needs
Technical benefits
- Provides a baseline set of security controls that can be customized to an organization's specific technical environment
- Includes guidance for implementing technical security controls, such as firewalls, intrusion detection systems, and access controls
|
Strategic limitations
- Might lack sufficient guidance for aligning cybersecurity with business strategy
- Might not meet the specific regulatory requirements for certain industries
Tactical limitations
- Can be overly prescriptive and limit flexibility and adaptability
- Might lack specific guidance for prioritizing security controls based on an organization's unique risks and threat environment
Operational limitations
- Might not provide a common language and framework for communicating cybersecurity risks and priorities across different departments and stakeholders
- Can be too high level to be useful for certain technical roles or processes
Technical limitations
- Might lack detailed guidance for implementing technical security controls
- Might not provide specific testing and validation procedures for technical controls
|
ISO/IEC 27001: ISO 27001:2022 is an international standard for information security management systems (ISMSs). The standard provides a systematic approach to managing sensitive company information to ensure its confidentiality, integrity, and availability. The standard also includes a comprehensive set of controls and guidelines for establishing, implementing, maintaining, and continually improving an ISMS.
| Framework benefits |
Framework limitations |
|
Strategic benefits
- Aligns cybersecurity risk management with business strategy
- Provides a framework for demonstrating compliance with regulatory requirements
Tactical benefits
- Provides a comprehensive and systematic approach to cybersecurity risk management
- Helps organizations identify and prioritize security controls based on their unique risks and threat environment
Operational benefits
- Provides a structured approach to continuous improvement
- Facilitates communication and collaboration between stakeholders
Technical benefits
- Provides guidance for implementing technical security controls, such as firewalls, intrusion detection systems, and access controls
- Includes requirements for testing and validating the effectiveness of security controls
|
Strategic limitations
- Can be too focused on compliance and certification
- Generally applied more to organizations with international operations or customers
- Might lack sufficient guidance for aligning cybersecurity with business strategy
Tactical limitations
- Can be overly prescriptive, limiting flexibility and adaptability
- Might lack specific guidance for prioritizing security controls based on an organization's unique risks and threat environment
Operational limitations
- Might not provide a common language and framework for communicating cybersecurity risks and priorities across different departments and stakeholders
- Can be too high level to be useful for certain technical roles or processes
Technical limitations
- Might lack detailed guidance for implementing technical security controls
- Might not provide specific testing and validation procedures for technical controls
|
MITRE ATT&CK: The MITRE ATT&CK framework is a knowledge base of tactics, techniques, and procedures used by threat actors during cyberattacks. The framework provides a common language for threat intelligence and enables organizations to better understand the tactics and techniques used by threat actors. The framework is organized into multiple layers, including tactics, techniques, subtechniques, and mitigation strategies.
| Framework benefits |
Framework limitations |
|
Strategic benefits
- Helps organizations understand the tactics and techniques used by attackers
- Provides a framework for aligning cybersecurity risk management with business strategy
Tactical benefits
- Helps organizations identify and prioritize security controls based on real-world attack scenarios
- Provides a common language and framework for communicating cybersecurity risks and priorities
Operational benefits
- Includes a constantly updated library of real-world attack techniques and tools
- Provides a detailed road map for incident response and threat hunting
Technical benefits
- Includes guidance for implementing technical security controls to detect and mitigate specific attack techniques
- Provides a framework for testing the effectiveness of security controls against real-world attack scenarios
|
Strategic limitations
- Might lack sufficient guidance for aligning cybersecurity with business strategy
- Might not meet the specific regulatory requirements for certain industries
Tactical limitations
- Can be overly focused on attack scenarios rather than risk management and security
- Might lack specific guidance for prioritizing security controls based on an organization's unique risks and threat environment
Operational limitations
- Can be too technical and focused on specific technical roles and processes
- Might not provide a common language and framework for communicating cybersecurity risks and priorities across different departments and stakeholders
Technical limitations
- Can be overwhelming for organizations without dedicated cybersecurity teams or resources
- Might lack detailed guidance for implementing technical security controls
|
FFIEC CAT: The Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool (CAT) is a framework designed to help financial institutions identify their risks and determine their cybersecurity preparedness. The CAT includes a set of assessment factors that evaluate an organization's cybersecurity preparedness across five domains: cybersecurity risk management and oversight, threat intelligence and collaboration, cybersecurity controls, external dependency management, and incident management and resilience.
| Framework benefits |
Framework limitations |
|
Strategic benefits
- Provides a framework for aligning cybersecurity risk management with business strategy
- Helps organizations meet regulatory requirements for cybersecurity risk management in banking
Tactical benefits
- Provides a standardized approach to cybersecurity risk assessment and management
- Helps organizations identify and prioritize security controls based on their unique risks and threat environment
Operational benefits
- Provides a common language and framework for communicating cybersecurity risks and priorities
- Includes a comprehensive set of controls and assessment procedures
Technical benefits
- Provides guidance for implementing technical security controls, such as firewalls, intrusion detection systems, and access controls
- Includes requirements for testing and validating the effectiveness of security controls
|
Strategic limitations
- Lacks sufficient guidance for aligning cybersecurity with business strategy outside of the financial industry
- Does not meet the specific regulatory requirements for certain industries
Tactical limitations
- Can be time consuming and resource intensive to implement
- Might lack specific guidance for prioritizing security controls based on an organization's unique risks and threat environment
Operational limitations
- Can be too high level to be useful for certain technical roles or processes
- Focuses on security controls rather than risk management
Technical limitations
- Might not be suitable for organizations with limited technical expertise
- Might lack detailed guidance for implementing technical security controls
|
Mitigating limitations
The potential limitations of various frameworks do not mean these frameworks are not useful tools or that they might ineffectively assess the organization. Instead, they point to potential challenges that organizations should consider when selecting and implementing a cybersecurity framework.
To mitigate these limitations, organizations can take the following steps:
- Consider the specific business needs and regulatory requirements when selecting a framework
- Customize and adapt the framework to meet the organization's unique risks and threat environment
- Use risk assessments to prioritize security controls based on their impact and likelihood of occurrence
- Develop a common language and framework for communicating cybersecurity risks and priorities across different departments and stakeholders
- Use additional technical guidance and resources to supplement the framework and ensure that technical controls are implemented effectively
- Conduct regular testing and validation of technical controls to ensure their effectiveness
Staying ahead of threats
With the ever-increasing number of cyberattacks, safeguarding sensitive data, systems, and networks should be top priority, and the right cybersecurity framework is a critical part of the security puzzle. More than a simple checklist, cybersecurity frameworks offer a critical, holistic lens on how organizations can protect their assets, networks, reputations, and customers.
But while various frameworks can help manage and mitigate cybersecurity risks, they are not a one-size-fits-all solution. Regardless of which framework they select, organizations should view cybersecurity as an ongoing process and continually monitor and adapt their cybersecurity program to stay ahead of emerging threats.
