There are many IT security frameworks/standards/regulations/etc to chose from, each with their own pros and cons. For example, IS0 27000 series, NIST CSF, NIST RMF, PCI-DSS, etc. My question is, is there a checklist that helps me decide which framework is most appropriate for my organization? Something that will ask me a series of questions and at the end suggest the most appropriate one for my organization?
5
-
4PCI-DSS is not a framework to choose. It's a requirement if you meet the criteria.– schroeder ♦Aug 7 at 9:56
-
What will help me chose whether I meet a certain criteria? Lets say I have zero experience. I need some help in recognizing what framework/standards/regulations/etc to chose from to at least get started.– user1720897Aug 7 at 10:03
-
3That's way too broad to answer. Because that would require an answer that lists all possible regulations, industry standards, and discretionary frameworks and to define the utility and requirements of each. For PCI-DSS, that's very, very simple to determine if you are required to comply with it (read the intro of the standard).– schroeder ♦Aug 7 at 10:45
-
google.com/search?q=how+to+choose+a+cybersecurity+framework– schroeder ♦Aug 7 at 10:48
-
@user1720897 with PCI-DSS it's simple: you will know, because if you need to be PCI-DSS compliant and can't show you are, others will cease dealing with you.– muruAug 8 at 8:10
Add a comment
|
2 Answers
There are 3 main considerations when deciding to choose a framework:
- What are your stakeholders expecting from you?
- Why are you choosing a framework? I.E. What outcomes are you looking for?
- Which framework can be implemented efficiently based on your organisation's maturity and resources?
For most organisations, the "stakeholder" question settles the discussion. If your investors, customers, regulators, etc. expect you to use a certain framework, then that's what you need. You can use other frameworks in addition, based on your requirements, but your core will end up being with 3rd parties ask of you, since you have little choice in that.
Once you define why you want a framework, and the resources you have to implement it, then that will help you choose the best framework that meets your requirements.
Some frameworks require quite a lot of defining, management, auditing, etc. and end up being very costly in time and resources (e.g. SOC 2) Others allow you to decide how much of the framework to implement and to what level of complexity. But again, which one to choose will depend on where you are in your maturity and where you want to go.
If you have no stakeholder requirements, few resources, and low maturity, then start looking at the NIST CSF. It's a good place to start; you can make it as complex or simple as you'd like, and is mapped to other frameworks.
-
Good call on the stakeholders. I wouldn't be surprised if most companies implementing something like ISO 27001 (or their national and subject-specific derivatives) only did so because customers started demanding a Statement of Applicability (SOA) for that framework at some point (we do). Getting audited yearly and having everything in order to demonstrate compliance is a huge drain on resources. Aug 8 at 9:53
-
After years in this industry and exposure to 100's of orgs, I know of no org that voluntarily chose ISO 27k without stakeholder pressure. NIST CSF? CIS Top20/18? Even COBIT? Yes. But then COBIT is because the org needs to manage all the stakeholder-demanded frameworks.– schroeder ♦Aug 8 at 14:03
I think the first question you need to ask is: What kind of data you are protecting? Is it PII, financial information, corporate records, technical information? From there you need to know what compliance requirements exist for the type of data you handle. That will help you narrow down your search. Are you doing contract work for the government (US government in particular)? If so, you need to follow their security framework guidelines. Maybe you are working for a large corporation - they might already have a framework chosen that you need to follow.
If it's none of the above, then choose a framework that fits your IT infrastructure model. Don't choose something that involves a lot of management overhead - start with the basics and work up.
