Call us now:
When considering the NIST CSF one does not always consider how integral U.S Federal Government made the CSF, in its cybersecurity. The Office of Management and Budget (OMB) places reliance on the use of Cybersecurity Framework Profiles by Federal Agencies to demonstrate their management of cybersecurity risk under NIST SP 800-37 and FISMA. It is also a framework that the Securities and Exchange Commission demonstrate compliance to annually.
When we wrote our board cybersecurity program in 2022, we integrated CSF into the program. As it is recognised by Federal Government and adopted by OMB under A-130 and FISMA. It is often assumed that the CSF is a cybersecurity standard such as NIST SP 800-53 or NIST SP 800-171. However when used within the Risk Management Framework (RMF) the CSF provides more than a traditional cyber standard. CSF profiles can be tailored to information types as we wrote in the Augusta Plan 1, 2 and 3, to enable the cybersecurity of information types rather than systems and process based controls.
CSF profiles are flexible, enabling organisation to tailor their cybersecurity controls to risk. Based on business and mission objectives. That could be useful to the cyber insurance industry in setting cybersecurity standards for the insured to follow, demonstrating cybersecurity risk management.
This maybe a reason why CISA recognizes the use of the CSF and has worked with industry to create several CSF profiles for industries such as Manufacturing, Election Infrastructure, the Smart Grid, IRS and more. These frameworks can be found in our March 2023 paper (https://lnkd.in/erHNBwEV).
Our 2024 board cyber program has been written to support boards of entities covered by the SEC final rule, EU NIS and DORA. Adopting the RMF and CSF profiles as tools to enable boards oversight, assure and attest cybersecurity risk management compliance through our 3 Line of Defense Target Operating Model and Governance Framework. Watchout for the announcements in the coming weeks.
@Thaddeus Dziekanowski Brian D. McCarthy
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7168156304979533824