Posted on Mar 23, 2021
In a world where digital transformation increases compliance burdens, understanding how to best secure on-premises, cloud, and hybrid IT stacks becomes more crucial than ever. Most organizations, regulations apply penalties but rarely offer concrete strategies for securing systems, networks, software, and devices. While cybersecurity frameworks provide a set of “best practices” for determining risk tolerance and setting controls, knowing which one is best for your organization can be difficult. Moreover, many regulations cross-reference more than one standard or framework. Understanding the similarities and differences across the top 25 security frameworks can help you create a more robust cybersecurity compliance program.
ASD’s Essential 8 takes a maturity model approach to cybersecurity, listing three levels. The eight essential strategies encompass:
Each maturity level aligns with having specific controls within those eight strategies in place. Maturity Level One means the organization is “partly aligned.” Maturity Level Two means an organization put additional controls in place to be “mostly aligned.” Maturity Level Three means an organization has implemented all required controls and is “fully aligned.”
While some frameworks offer flexibility, others take a more prescriptive approach. Probably the cybersecurity framework most often cited by professionals, the CIS Controls framework lists twenty mission-critical controls across three categories:
The CIS Controls framework then goes even further to define three implementation groups. Implementation Group 1 is for organizations with limited resources and cybersecurity expertise. Implementation Group 2 is for organizations with moderate resources and cybersecurity expertise. Implementation Group 3 is for mature organizations with significant resources and cybersecurity expertise.
Under each of the 20 controls, the CIS Controls framework provides a list of sub-controls, color-coded to indicate which implementation group should be using them. For example, CIS Control 1 “Inventory and Control of Hardware Assets” lists sub-control “Utilize an Active Discovery Tool” is appropriate for Implementation Groups 2 and 3 but considered too much of a burden for Group 1.
Consisting of 197 control objectives organized into 17 domains, the CCM focuses solely on cloud computing. The 17 domains include:
Within each domain, CCM lists controls and specifications to help organizations create a compliant security program.
The Information Systems Audit and Control Association (ISACA) updated its COBIT framework in 2019 to create a Governance System and Governance Framework. Instead of basing compliance on individual security controls, COBIT 2019 starts with stakeholders’ needs, assigns job-related governance responsibilities to each type, then maps the responsibility back to technologies. Ultimately, COBIT’s goal is to ensure appropriate oversight of the organization’s security posture.
The COBIT core model groups governance and management objectives into five domains:
COBIT’s design principles include:
Ultimately, COBIT’s focus on governance creates a security framework that streamlines audits and incorporates continuous improvement to enhance those outcomes.
The Department of Transportation, Transportation Security Administration, United States Coast Guard, and Transportation Systems Sector worked together to create a framework that addressed industry-specific needs. Based on NIST’s Cybersecurity Framework, the TSS Cybersecurity Framework focuses on five discrete TSS strategy goals:
It aligns each goal to the appropriate NIST categories. For example, “Ensure Sustained Coordination and Strategic Implementation” aligns with NIST’s “Business Environment Governance.” The TSS Cybersecurity Framework takes a risk-based and maturity model approach, allowing organizations to apply threat intelligence to determine security breach impact. By defining low, moderate, and high impact levels, organizations can prioritize the next steps to reduce the risk profile.
The Office of the Under Secretary of Defense Acquisition and Sustainment (OUSD(A&S)) worked with Department of Defense (DoD) stakeholder, University Affiliated Research Centers (UARCs), and Federally Funded Research and Development Centers (FFRDC) to standardize cybersecurity across the Defense Industrial Base (DIB).
Unlike other maturity models, CMMC is both a set of best practices and a requirement for organizations that solicit DoD contracts. CMMC lists five maturity levels, primarily based on whether the data an organization collects, transmits, stores, and processes is Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).
The five certification levels are:
As an organization’s maturity level increases, so do the required controls’ number and sophistication level. At Maturity Level 1, an organization only needs seventeen practices. Meanwhile, an organization that needs to meet Maturity Level 5 compliance needs 173 practices in place.
ETSI is a non-profit standards organization with more than 900 members from across 65 countries and five continents. A European Standards Organization (ESO), ETSI supports European regulations and legislation by creating standards used throughout the EU.
Technical Report (TR) 103 305-1 “Critical Security Controls for Effective Cyber Defence.” ETSI based the top twenty Enterprise industry level cybersecurity best practices on the Critical Security Controls (CSC) CIS established. However, unlike the CIS Critical Controls, ETSI does not divide activities into Implementation Groups. The “Critical Security Controls for Effective Cyber Defence” includes the following for each of the twenty controls:
Published on December 7, 2020, the ENISA National Capabilities Assessment Framework provides the Member States a way to engage in self-assessments so that they can identify their maturity level. The framework offers a way for countries to assess their cybersecurity capabilities, ultimately giving them guidelines for setting national strategies.
The Framework outlines the following benefits that come from engaging in a national assessment:
The FAIR Institute is a nonprofit organization whose mission is to establish and promote risk management best practices so that risk professionals can collaborate better with their business partners.
The FAIR cyber risk framework takes an explicit approach to cyber risk management so that organizations can quantify risk regardless of the cybersecurity framework they use. According to FAIR, an implicit risk management approach starts with a compliance requirement and aligns controls to it, creating a reactive risk posture. Meanwhile, FAIR’s explicit approach creates a cycle of continuous improvement integrating risk targets, controls, and a proactive risk posture.
FAIR creates a risk management system focused on:
To help healthcare organizations and their business associates find a more flexible way to meet Health Insurance Portability and Accountability Act (HIPAA) compliance, HITRUST offers an integrated risk and compliance approach.
Privacy, information security, and risk management leaders across the public and private sectors worked together to establish a set of safeguards for protecting the security and privacy of protected health information (PHI) and electronic PHI (ePHI). The HITRUST CSF consists of 49 control objectives across 156 control specifications, all of which fall into one of the following 14 control categories:
The ISF is a no-profit organization whose members consist of companies on the Fortune 500 and Forbes 2000 lists. The organization focuses on creating a knowledge exchange where members share security issues, experiences, and practical solutions.
The SOGP 2020 provides a set of best practices intended to:
Founded in 1945, ISA is a non-profit professional association that established a Global Security Alliance (GSA) to work with manufacturers and critical infrastructure providers. GSA incorporates various stakeholders, including end-user companies, automation and control systems providers, IT infrastructure providers, services providers, and system integrators.
ISA/IEC 62443 is an industrial security framework focused on both traditional IT environments and SCADA or plant floor environments and includes:
Recognizing the increasing importance of information and communication technologies (ICTs) to national security, economic well-being, and social cohesion, ITU created its CIIP as a model for sharing the responsibility between government, business, other organizations, and individual users.
The CIIP sets forth the following key elements that a national cybersecurity strategy should include:
The IoTCA’s mission is to forge a community that brings together cybersecurity and IoT experts so that they can address real-world IoT security issues and work to establish a security-first IoT posture.
Their framework takes a multi-layered approach to create end-to-end security, taking into account all connected devices and their associated applications. The framework includes:
Their goal is to mitigate risks such as:
The IoTSF is a non-profit international organization that brings together IoT security professionals, IoT hardware and software product vendors, network providers, system specifiers, integrators, distributors, retailers, insurers, local authorities, and government agencies.
They focus on securing IoT during the design phase to mitigate financial and brand reputation risk. The IoTSF Security Compliance Framework released in May 2020 takes a risk-based approach to compliance and focuses on six key issues:
ISO represents one of the oldest standards organizations. Founded in 1947, this non-governmental organization has members from 165 countries. ISO sets standards for various technologies, including several security standards. The ISO/IEC 27000 “family” boasts over a dozen standards, but ISO 27001 sets the foundation for establishing an information security management system (ISMS).
ISO 27001 includes requirements for establishing, implementing, maintaining, and continually improving an ISMS influenced by the organization’s needs, objectives, security requirements, processes, size, and structure. Its best practices include setting controls and processes based on:
As part of establishing an ISMS, organizations need to consider additional ISO 27000 family standards such as:
The non-profit, federally funded MITRE is a cybersecurity-focused research and development center. When MITRE began documenting common cyberattack tactics, techniques, and procedures (TTPs) used against Windows enterprise networks, ATT&CK became the baseline acting as a common language for offensive and defensive researchers. MITRE is responsible for establishing and trademarking the Common Vulnerabilities and Exposures (CVE) list.
MITRE Enterprise has 14 tactics commonly used when malicious actors set up advanced persistent threats (APTs) within a corporate ecosystem. Each of the following 14 tactics is then broken down into specific activities:
In response to the increasing use of mobile devices, MITRE created the Mobile matrix to help security staff better track emerging threats. The 14 MITRE mobile tactics, again divided into sub-categories, are:
The United Kingdom’s NCSC launched in 2016 and brings together SMEs, enterprise organizations, government agencies, the general public, and departments to address cybersecurity concerns.
Its CAF provides guidance for UK Critical National Infrastructure (CNI), organizations subject to the NIS Directive cyber regulation, and organizations managing cyber-related risks to public safety. CAF guides organizations toward establishing a cyber resiliency program, focusing on outcomes rather than checklists.
It has four primary objectives:
It embeds 14 subparts within these four primary objectives, many aligned with other international standards. These subparts are:
New Zealand’s PSR creates a policy framework for how organizations should manage security governance (GOVSEC), personnel (PERSEC), information (INFOSEC), and physical security (PHYSEC) across the public and private sectors.
The four-tiered, hierarchical structure requires organizations to:
Across the four key areas it lays out 32 focus areas:
NIST is a US non-regulatory government agency that sets standards across the physical sciences. Originally intended for critical infrastructure owners and operators, NIST CSF can be used by any organization. Many companies outside of the critical infrastructure industry also use the CSF, especially if they need to meet other US federal data protection requirements.
The CSF consists of three sections:
The Framework Core consists of five functions with categories and subcategories embedded within them. The Framework Core Functions are:
The four Implementation Tiers are:
In order to address the unique cybersecurity concerns facing ICS, NIST SP 800-82 provides guidance for supervisory control and data acquisition (SCADA) systems, distributed control systems (IDS), and other control system configurations found in the industrial control sectors, like Programmable Logic Controls (PLC).
To protect ICS, NIST suggests a defense-in-depth strategy, including:
NERC is a non-profit international regulatory authority focused on effectively and efficiently reducing risks facing the grid system. Its jurisdiction includes bulk power system users, owners, and operators.
NERC currently has 19 approved security guidelines across the following areas:
OASIS Open is a community where experts can advance projects, including open source projects, for cybersecurity, blockchain, IoT, emergency management, cloud computing, and legal data exchange.
SAML is a standard that defines a framework for exchanging security information between online business partners. Developed by the Security Services Technical Committee, SAML is an XML-based framework that supports business communications for user authentication, entitlement, and attribute information. Organizations can apply it to human and machine entities, partner companies, or other enterprise applications. Organizations most often use SAML for web single-sign-on (SSO), attribute-based authorization, and securing web services.
SAML consists of four main components:
Founded in 2006 as a response to increased credit card fraud, the Payment Card Industry Security Standards Council (PCI SSC) consists of the five major credit card companies, American Express, Discover, JCB International, Mastercard, and Visa, Inc. The Payment Card Industry Data Security Standard (PCI DSS) is a prescriptive security compliance requirement for merchants and financial services providers.
PCI DSS contains 5 categories of controls:
Within those 5 categories, PCI DSS then sets out 12 detailed requirements:
In May 2017, the Saudi Arabian Monetary Authority (SAMA) issued Version 1.0 of its Cyber Security Framework (SAMA CSF). In the introduction, SAMA noted that applying new online services and new developments, such as fintech, and blockchain, require additional regulatory standards to protect against continuously evolving threats.
SAMA explained its Framework’s objectives as:
1. To create a common approach for addressing cybersecurity within the Member Organizations.
2. To achieve an appropriate maturity level of cybersecurity controls within the Member Organizations.
3. To ensure cybersecurity risks are properly managed throughout the Member Organizations.
The SAMA CSF defines its scope as:
Additionally, it focuses more broadly than other financial cybersecurity frameworks by incorporating applicability to the following industries:
SecurityScorecard’s security ratings platform and Atlas offering enable organizations to monitor their cybersecurity and compliance posture more efficiently. Our security ratings provide real-time visibility into cybersecurity risks, using an easy-to-read A-F scoring system. Our Atlas platform maps controls across various standards so that customers have visibility into their compliance posture.
Using SecurityScorecard, organizations can align their security controls with our ten categories of risk. Since Atlas maps to over 20 industry-standards, organizations can create a holistic, automated compliance program and remove the human error risk that comes from using spreadsheets.
With our all-in-one solution, organizations can monitor their own infrastructure and build out a robust vendor risk management program for a proactive approach to cybersecurity and compliance.
Vendor management is the process an organization utilizes to assess and manage a third- or fourth-party vendor. Learn how SecurityScorecard can help.
Performing cybersecurity risk assessments is a key part of any organization’s information security management program. Read our guide.
Templates and vendor evaluations are needed to level that playing field, in a time efficient and fair way, so that the best vendors are chosen.
Co-founder and CEO, Alex Yampolskiy, speaks about the importance of measuring and acting on key indicators of cybersecurity risk.
You can’t manage what you can’t measure. Check out our list of the top 20 cybersecurity KPIs to track in 2021.
No waiting, 100% Free
Get your free scorecard and learn how you stack up across 10 risk categories. Answer a few simple questions and we'll instantly send your score to your business email.