Cybersecurity Standards and Frameworks

Defend with Standards, Secure with Frameworks: Building a Resilient Cyber Defense

There are several cybersecurity standards and frameworks available to guide organizations in implementing effective security practices

Cybersecurity standards are established guidelines, specifications, or requirements that define best practices for securing information systems, protecting data, and managing cybersecurity risks. Compliance with these standards helps organisations demonstrate their commitment to cybersecurity and ensure a consistent and robust security posture.

Click on a cybersecurity standard or framework below for more information.

ISO/IEC 27001

This standard helps organisations manage and improve their Information Security Management System (ISMS), focusing on risk management, security controls, and compliance.

Visit the ISO.Org website for more information.

NIST Cybersecurity Framework (CSF)

NIST has a cybersecurity framework with five functions: Identify, Protect, Detect, Respond, and Recover. It helps organisations assess their security status and plan for improvements.

Click here to go to the NIST CSF website for more information.

NIST SP 800-53

NIST provides a comprehensive list of security and privacy controls for federal information systems, covering access control, incident response, encryption, and system integrity.

Click here to go to the NIST website for more information.

CIS Benchmarks

CIS (Center for Internet Security) is responsible for creating and keeping up-to-date a collection of security benchmarks and configuration guidelines for different technologies and platforms. These benchmarks serve as a set of instructions and best practices for securely managing and configuring systems, applications, and network devices.

Click here to visit the CIS Benchmarks website for more information.

OWASP (Open Web Application Security Project)

OWASP (Open Web Application Security Project) enhances web app security with resources and knowledge for developers and organizations. Through initiatives, it promotes secure coding practices and global web app security.

Click here to go to the OWASP.Org website for more information.

HIPAA

HIPAA (Health Insurance Portability and Accountability Act) is set of rules is for companies that deal with protected health information (PHI) in the healthcare sector. The guidelines aim to protect patient data, maintain privacy and security, and establish administrative, technical, and physical safeguards.

Click here to go to the The U.S. Department of Health & Human Services website for more information.

MITRE ATT&CK

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a database that catalogues the strategies, methods, and processes used by hackers in cyberattacks. It helps improve detection and defence against threats by providing insights into the actions of adversaries. Understanding the attacker’s approach allows for better security measures and the ability to withstand cyber threats.

Click here to go to MITRE.Org website for more information.



The Protective Security Policy Framework (PSPF)

The Protective Security Policy Framework (PSPF) is guidelines and policies created by the Australian Government to safeguard citizens, info, resources, and infrastructure. It sets the standards for security measures.

Click here to visit the Australian Government’s Protective Security Policy Framework (PSPF) website for more information.

The Information Security Manual (ISM)

The Information Security Manual (ISM) is a guidance document developed by the Australian Signals Directorate (ASD) as part of the ACSC to assist Australian government agencies and organizations in protecting their information and information systems from cybersecurity threats.

Click here to visit The Australian Cyber Security Centre (ACSC) website for more information.

GDPR (General Data Protection Regulation)

The GDPR is a data protection standard that applies to organizations that handle the personal data of European Union residents. While not solely focused on cybersecurity, it sets out requirements for data security, breach notification, and individuals’ rights to privacy and data protection.

Click here to visit the GRPD.EU website for more information.

IoT (Internet of Things) Security

Organizations have created guidelines to protect IoT devices and systems, but there is no universal cybersecurity framework for IoT.

1. IoT Security Foundation (IoTSF): Provides best practices, guidelines, and frameworks to help secure IoT ecosystems and devices.
2. NISTIR 8228: Offers a comprehensive overview of IoT device cybersecurity considerations and recommendations.
3. ENISA Baseline Security Recommendations for IoT: Provides guidance on the security measures that should be implemented in IoT products, services, and infrastructures.
4. OWASP Internet of Things Top Ten: Identifies the top security risks associated with IoT devices and applications.
5. Industrial Internet Consortium (IIC) Security Framework: Addresses security concerns in industrial IoT (IIoT) environments.
6. IoT Trust Framework by the IoT Trust Labeling Program: Aims to standardize the assessment of IoT device security.

PCI DSS (Payment Card Industry Data Security Standard)

These guidelines are for companies processing credit card transactions. They ensure cardholder information is protected, the payment environment is secure, and fraud and data breaches are prevented.

Click here to visit the PCI Security Standards Council website for more information.

IEC 62443

The International Electrotechnical Commission (IEC) has created a set of standards that address cybersecurity for industrial automation and control systems (IACS). These standards offer guidance and best practices for safeguarding critical infrastructure and industrial control systems from cyber threats.

Click here to visit the International Society of Automation website for more information.

COBIT

COBIT (Control Objectives for Information and Related Technologies) is a framework developed by ISACA for governing and managing enterprise IT. It aligns IT with business objectives, manages risks, and improves IT performance. COBIT emphasizes control, transparency, and accountability to enhance organizational efficiency and cybersecurity.

Click here to visit the Information Systems Audit and Control Association (ISACA) website for more information.

CSA (Cloud Security Alliance)

CSA (Cloud Security Alliance) Security Guidance: The CSA Security Guidance provides best practices and controls for securing cloud computing environments. It addresses various aspects of cloud security, including governance, data protection, identity and access management, and incident response.

Click here to visit the Cloud Security Alliance (CSA) website for more information.

CSA CCM

The CSA Cloud Controls Matrix (CCM) is a cybersecurity framework developed by the Cloud Security Alliance (CSA) to assist organizations in evaluating the security posture of cloud service providers.

Click here to visit the Cloud Security Alliance (CSA) website for more information.

OWASP ASVS

The OWASP Application Security Verification Standard (ASVS) is a framework created by the community to establish security requirements and guidelines for secure software development and testing. Its goal is to assist organizations and developers in building and maintaining secure applications by integrating security measures throughout the software development life cycle.

Click here to visit the OWASP.Org website for more information.

Zero Trust

Zero Trust is the principle of “never trust, always verify.” It requires continuous authentication, authorization, and validation of users, devices, and applications before granting access to resources. This approach reduces the risk of data breaches and insider threats in modern, cloud-based, and mobile-centric environments.

Click here to visit the Zero Trust page on the Wikipedia.org website for more information.

There are many cybersecurity standards and frameworks available that cover different aspects of cybersecurity like information security management, risk assessment, access controls, incident response, and more.

Organisations typically choose to use one or a combination of these frameworks to meet their specific needs, industry standards, and compliance requirements. It’s important to note that these frameworks are not exhaustive and there may be other cybersecurity measures that an organization may need to consider.