Cybersecurity Policies & Standards

Policies and standards are the foundation for an organization's cybersecurity and privacy program. These components form the alignment with leading practices to help ensure applicable statutory, regulatory and contractual requirements for cybersecurity and privacy are addressed. From these policies and standards, procedures and other program-level guidance provide the specific details of how these policies and standards are implemented.

There are a lot of choices to pick from when selecting a cybersecurity framework. If you are not sure which framework works best for you or would like to learn more about the leading frameworks, you can read more here.

The most common frameworks are the NIST Cybersecurity Framework (NIST CSF), ISO 27001 / 27002, NIST 800-53 and the Secure Controls Framework (SCF). To comply with NIST CSF, ISO 27001 / 27002 or NIST SP 800-53 properly, it takes more than just a set of policies and standards. While those are foundational to building a cybersecurity program aligned with that framework, there is a need for program-specific guidance that helps operationalize those policies and standards (e.g., risk management program, third-party management, vulnerability management, etc.). It is important to understand what is required to comply with NIST CSF vs ISO 27002 vs NIST SP 800-53, since there are significantly different levels of expectation.

Realistically, the process of selecting a cybersecurity framework must be driven by a fundamental understanding of what your organization needs to comply with from a statutory, regulatory and contractual perspective, since that understanding establishes the minimum set of requirements necessary to:

• 1.Not be considered negligent with reasonable expectations for cybersecurity & data protection;
• 2.Comply with applicable laws, regulations and contractual obligations; and
• 3.Implement the proper controls to secure your systems, applications and processes from reasonable threats, based on your specific business case and industry practices.

This understanding makes it easy to determine where on the "framework spectrum" (shown below) you need to focus for selecting a set of cybersecurity principles to follow. This process generally leads to selecting the NIST CSF, ISO 27001 / 27002, NIST 800-53 or SCF as a starting point.