Cybersecurity frameworks
Tags: cybersecurity, intermediate, framework, governance
Published: 2023-10-23 20:01:24

## What is CyberSecurity framework? 

> A cybersecurity frameworks describes guidelines, and standards/plan designed for cybersecurity and it's associated risk management. The frameworks intent is to reduce an organization's exposure to exploits and vulnerabilities that cyber-criminals may use.

[NIST's](https://www.nist.gov/) Cybersecurity Framework is widely recognized, but there are other cybersecurity frameworks and standards that organizations may tailor and use. Below is a comparison of some of these frameworks, along with their common vs differentiating factors.

**Common Factors:** Most of the frameworks share a common  area of focus which includes risk management, protection of digital assets, data security and aligning cybersecurity with organizational goals. Framework provides a structured approach for enhancing cybersecurity, and can be tailored to an organization's needs and risk apetite.

**Differentiating Factors:** The differences between the frameworks lie in the specific industry focus, level of prescriptiveness, and methodologies used. Some, like the NIST Framework and ISO/IEC 27001, are widely applicable across industries, while others, like HITRUST and CIS Controls, are more industry-specific. COBIT focuses on governance, while FAIR provides a unique quantitative risk analysis approach.


| Framework / Standard                  | URL                                      | Common Factors                            | Differentiating Factors                                             | Example                                                       |
|---------------------------------------|------------------------------------------|------------------------------------------|--------------------------------------------------------------------|---------------------------------------------------------------|
| NIST Cybersecurity Framework          | [NIST Cybersecurity Framework](https://www.nist.gov/cybersecurity-framework) | - Risk-based approach - Core functions (Identify, Protect, Detect, Respond, Recover) - Tiered maturity model | - Highly adaptable for various industries - Broadly recognized and used globally | A manufacturing company uses NIST's framework to identify critical assets and vulnerabilities and develop a response plan for a potential cyberattack. |
| CIS Controls (Center for Internet Security) | [CIS Controls](https://www.cisecurity.org/controls/) | - Prioritized cybersecurity best practices - Focus on reducing the attack surface - Mapped to other frameworks (e.g., NIST, ISO 27001) | - More prescriptive in terms of specific controls - Targets specific security improvements | A financial institution may implement CIS Controls to reduce its attack impact by applying specific controls e.g. network segmentation and privilege management(role based access). |
| ISO/IEC 27001 (Information Security Management System) | [ISO/IEC 27001](https://www.iso.org/standard/54534.html) | - Comprehensive information security management system - Risk management-based approach - Internationally recognized | - Highly structured and process-oriented | A global IT services company seeks ISO 27001 certification to establish a comprehensive information security management system and to meet international security standards to gain projects/recogniation. |
| COBIT (Control Objectives for Information and Related Technologies) | [COBIT](https://www.isaca.org/go/cobit) | - Governance framework for IT and cybersecurity - Aligns IT and business goals - Process improvement model | - Strong focus on governance and control objectives - Tailored specially for IT management and governance | A large corporation may use COBIT to ensure IT and business alignment by establishing governance practices and a maturity model for IT processes. |
| HITRUST Common Security Framework (CSF) | [HITRUST CSF](https://hitrustalliance.net/hitrust-csf/) | - Healthcare-specific framework - Aligns with HIPAA and other healthcare regulations - Comprehensive controls for PHI protection | - Specifically designed for the healthcare industry - Requires HITRUST certification | A hospital may adopt HITRUST CSF to comply with HIPAA's security requirements and safeguard electronic health records (EHRs) effectively. |
| CIS RAM (Center for Internet Security Risk Assessment Method) | [CIS RAM](https://www.cisecurity.org/risk-assessment/) | - Risk assessment methodology - Aligns with CIS Controls - Provides guidelines for identifying and mitigating security risks | - Focused on risk assessment and mitigation - Works well in conjunction with other frameworks | A financial institution may use CIS RAM to perform a risk assessment on its digital banking platform and then applies CIS Controls to mitigate identified risks. |
| FAIR (Factor Analysis of Information Risk) | [FAIR Institute](https://www.fairinstitute.org/) | - Quantitative risk analysis methodology - Focus on understanding and managing information risk - Business-focused risk assessment | - Unique for its quantitative risk analysis approach - Tailored for organizations looking for deep risk analysis | A cybersecurity consulting firm may use FAIR to conduct a quantitative risk analysis for a financial client to assess the potential financial impact of a data breach accurately. |
| OWASP (Open Web Application Security Project) | [OWASP](https://owasp.org/) | - Focus on web application security - Provides a Top Ten list of critical web application security risks - Offers tools and resources for developers and security professionals | - Specialized in web application security - Primarily for developers and security professionals in the context of web application development | A software development company may follow OWASP guidelines to identify and mitigate common web application security risks, such as SQL injection and cross-site scripting (XSS), during application development. |

**Please feel free to add ...**