How to choose a cybersecurity framework
By: Kevin Fleming
Tags: Framework, Information Security, Cybersecurity, Risk Management

Frameworks overview

SANS/CIS Critical Security Controls — SANS Institute, one of the founders of the Center for Internet Security (CIS and not to be confused with CISA). Often used interchangeably, the SANS Institute/CIS offers a great program for small to medium size business, and from no-budget to got-cash-to-burn.

The US National Institute of Standards and Technology aka NIST provides the most comprehensive cybersecurity framework (CSF) with the largest set of free resources. The NIST CSF uses a model based on five functions: IDENTIFY important assets and what threatens it; discuss and analyze how best to PROTECT; determine how best to DETECT issues; RESPOND quickly and effectively; and, achieve organizational plans to RECOVER. NIST is appropriate for organizations of any size, but they do have a Small Business Cybersecurity Corner.

System and Organization Controls aka SOC 2 from AICPA — is specifically designed for organizations that store customer data in the cloud. They offer certifications based on technical and management audits and reports. SOC 2 reports the organization’s ability to demonstrate that they are managing threats and have effective processes and controls in place to detect, respond to, mitigate and recover from security incidences. SOC Resources and learning. Excellent overview on SOC2 compliance from threatstack.com. Basic overview from Wikipedia.

COBIT, for example, does not offer a NIST-like cybersecurity framework. COBIT is about governance, and if governance is your thing, if ITIL and ITSM are not meaningless acronyms/initialisms, then dig in! They do offer a guide to implementing the NIST cybersecurity framework.

​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​The Committee of Sponsoring Organizations of the Treadway Commission aka COSO — is not so much a cybersecurity framework as it is a risk management framework. Could go a long way to helping you assess and manage enterprise risk. Sponsored by orgs in finance, accounting and auditing.

Health Information Trust Alliance Cybersecurity Framework (HITRUST CSF) — hard-core, incorporates internationally accepted security and privacy-related regulations, standards, and frameworks–including ISO, NIST, PCI, HIPAA, COBIT, Department of Defense (DoD) Cybersecurity Maturity Model (CMMC) Framework, and NY DOH Office of Health Insurance Programs — to ensure a comprehensive set of security and privacy controls.

FedRAMP — (available to commercial entities as well) is a U.S. federal government program that provides a standardized approach to security assessment, authorization, and continuous monitoring of cloud products and services to ensure that the proper level of security is in place when government agencies seek to access them. Here’s a great overview.

The difference between NIST and FedRAMP is explained brilliantly by the fine folks at reciprocitylabs.com (again, no affiliation):

NIST provides standards and guidelines around risk management, information security, and privacy controls for information systems used by the US Federal Government. FedRAMP uses the NIST guidelines in its own framework to enable US Government agencies to use cloud services securely and efficiently.