Far too many business leaders still consider the needs of information security to be a burden, and a costly and time-consuming one at that. But as the threat landscape continues to evolve alongside technological advancement, the need for achieving the highest possible standards of cybersecurity is clearer than ever. It’s not just about protecting information systems either. It’s also about adding value to your business by reducing risk and building a trustworthy brand image. At a time when clients are becoming increasingly wary of who they do business with, this is vitally important.
The NIST Cybersecurity Framework, or NIST CSF, is a set of recommendations that combine industry standards and best practices to help guide organizations manage risk. Although the framework was first released in 2014 with the critical infrastructure sector in mind, it is versatile and comprehensive enough that it can and should be applied in any business or industry. As such, it is the most widely adopted framework in the US. It is even the basis of many regulatory regimes, such as the Cybersecurity Maturity Model Certification in the US defense sector.
What has changed in the latest NIST Cybersecurity Framework?
While still compatible with the first edition of the framework, the latest version was announced and made publicly available in April 2018. Version 1.1 of the NIST Cybersecurity Framework brings several new additions to address supply chain risk management.
Given the increase in supply chain attacks in recent years, particularly during the coronavirus pandemic, organizations must pay closer attention to vulnerabilities to their vendors, partners, and other external stakeholders. After all, more and more attacks are originating from third-party organizations. The latest NIST Cybersecurity Framework provides guidance on working with supply chain stakeholders when conducting risk assessments and optimizing vulnerability disclosure processes.
What are the best practices in implementing the NIST Cybersecurity Framework?
The NIST CSF requirements are exhaustive, spanning a 48-page document and dozens of controls across five primary function areas. The framework addresses the entire lifecycle of a potential security incident from the moment a threat is first identified to the recovery processes that should be deployed in the event of a data breach or similar event.
The first function concerns the identity of information-bearing assets, which involves building a complete inventory of virtual and physical systems. After all, you can’t protect what you don’t know about, which is why this is the obvious first step towards achieving a higher cybersecurity maturity. The latest NIST Cybersecurity Framework greatly expands upon the Supply Chain Risk Management category under the Identity function.
The second function deals with the proactive protection of the assets identified in the first step. This includes measures like identity and access control, security awareness and training, and endpoint security. This is often the most expensive function to address, as it means deploying cutting-edge security solutions.
The third function covers the detection of threats, with the idea being that businesses should do everything they can to proactively identify threats, so they have a chance to prevent them from ever reaching their networks in the first place. Managed detection and response (MDR) services offer an affordable and scalable way for small businesses to greatly enhance their ability to detect and manage advanced threats.
The fourth function addresses how businesses should respond to threats. It covers important areas like response planning, communications, threat analysis, and mitigation.
The fifth and final section tackles the way organizations prepare for the worst-case scenario, such as a successful data breach or unscheduled downtime of mission-critical systems. This function is built around the belief that an incident will happen eventually, no matter how hard you try to prevent it. As such, it covers disaster recovery planning and business continuity with a goal to minimize the damage done to an organization should the worst happen.
Charles IT provides the full range of services that businesses need to become fully compliant with the NIST Cybersecurity Framework. Get in touch today to schedule your first consultation!
