Call us now:
The Cybersecurity Framework Profile 2.0 draft released by NIST is a step closer to aligning the CSF with corporate business and mission objectives. NIST has included Governance(GV) as a core tenet of the framework through with the 5 functions Identify(ID), Protect(PR), Detect(DT), Respond(RP) and Recover(RC) interact. Ensuring that appropriate oversight and assurance of cybersecurity risk management across the functions is addressed. Rather than including a separate category for risk management, NIST has incorporated Risk Management (RM) within the Governance function.
We have commented many times on the use of the CSF as a vessel, along with cybersecurity risk management, for the mitigation of cybersecurity risks. Supporting an organisation align it’s unique mission and business objective with the risks it faces, to create a cybersecurity profile to mitigate those cyber risks.
The CSF is well documented by CISA, that has created many CSF profiles to be adopted by various industry sectors for the management of cybersecurity risks. Our paper (https://lnkd.in/erHNBwEV) discusses the use of a CSF profile as a ‘bucket’ into which a cybersecurity standard can be input, tailored to meet specific organizational risks that are identified through the risk assessment process and defined through the Risk Management Framework.
The challenge for companies, as we have seen with the SEC final ruling, is defining and demonstrating adequate compliance. With the SEC complying to FISMA, that allows for the use of a CSF profile, the release of drsft NIST 2.0, further demonstrates what adequate cybersecurity compliance looks like.
Ted Dziekanowski Rachel V. Rose, JD, MBA Bob Dix
#cybersecurity #cyberriskmanagement #csfprofile #nist
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7095310138458140672