Organizations can no longer afford to view cybersecurity as a necessary evil and a mere cost center. Instead, they should view it as an integral component of their value propositions now that customers are increasingly wary about who they do business with. In other words, good security is good for business, not just because it helps mitigate risk, but because it opens the door to lucrative new business opportunities too.
The NIST Cybersecurity Framework by the National Institute of Standards and Technology is one of the leading authorities in the space. While originally designed with critical infrastructure in mind, it has been widely adopted by many industries as the global gold standard in security. It also serves as the basis for many other frameworks and government regulations.
The framework consists of three primary components – the framework core, the profiles, and the implementation tiers. The framework core contains 23 categories and 108 subcategories spanning five function areas – identify, protect, detect, respond, and recover, which detail the controls that need to be put in place to achieve desired outcomes. Profiles help you build your strategy and, finally, the NIST CSF implementation tiers determine how your business currently views its risk management and mitigation procedures.
#1. Establish your goals
As with any plan, the key to success is knowing what you want to achieve and setting realistic goals that align with your specific data environment and risk level. This allows you to measure success, while making it all the more likely you’ll earn the support of senior management. It is, therefore, important to establish goals that will be acceptable to both management and the IT department. Fortunately, this is one of the main focus areas of the NIST CSF, which speaks in a language non-IT people should be able to understand. Setting a clear budget is also an essential step as you’re setting your goals.
#2. Create your target profile
The NIST CSF profiles present your organization’s alignment with the controls and objectives detailed in the framework core, your risk tolerance, and the resources you’re using to achieve the desired outcomes. You should build two profiles – one detailing your current situation, and another detailing where you want to be.
These profiles should align with the NIST Cybersecurity Framework implementation tiers. The four implementation tiers help you understand your current position and your target position. For example, tier one is the lowest tier, in which security controls are typically applied on an ad hoc basis and there is no centralized risk-management in your organization. If your current profile looks like that, then your target profile should probably align with the third or fourth tier, which correspond to repeatable and adaptability cybersecurity respectively.
To create your current profile, you should first conduct a security gap analysis, preferably with the help of an external partner, to determine where your current vulnerabilities lie. Armed with this knowledge, you will be able to refine your goals and create a target profile that meets your budgetary and operational requirements.
#3. Build an action plan
A gap analysis will help you quantify and qualify your existing information security controls and procedures so that you can compare them alongside your target scores. The next stage of the process is turning these insights into a series of actions that you can take to improve your IT security posture. For example, if your identity and access management controls are found to be lacking, then you might consider implementing multifactor authentication.
Your action plan must be aligned with the broader needs of your organization. For example, if you’re a financial services company, then the systems and procedures for handling customers’ financial data will no doubt need to take priority.
It’s also important to remember that NIST CSF compliance isn’t something you just do once. Even once you’ve implemented your action plan, it is not the end. You still need to continually review its performance and relevance, not least because the threat landscape is constantly changing in line with technological advancement. Your plan will need to be updated regularly to ensure your organization is always up to speed with the latest threats and security standards introduced to counter them.
By far the easiest way to implement the NIST Cybersecurity Framework is to partner with an expert consultancy firm and compliance expert, and that’s where Charles IT comes in. Call us today to learn more!