Cybersecurity Frameworks
Several cybersecurity frameworks have been developed to address the unique aspects of cyber threats faced by various industry sectors. These frameworks were established to provide a set of security standards across industries and reduce cyber risk. Withum’s Cyber Team will assist your organization with identifying, adopting and adhering to appropriate security control frameworks aligned to your industry.
NIST 800-171 Cybersecurity Framework
The NIST 800-171 framework, created by the National Institute of Standards and Technology (NIST), provides implementation details for managing cybersecurity initially in the manufacturing environment. However, it is a notable framework that has seen widespread use across many sectors. The NIST framework was developed to provide a standardized policy of methodologies and procedures to guide private-sector organizations in effectively assessing their capacity to mitigate cyberattacks.
This framework is based on five interdependent core functions, i.e., Identification, Protection, Detection, Response and Recovery. It also provides a framework with which organizations can assess their cybersecurity readiness.
Cybersecurity Maturity Model Certification (CMMC)
The Cybersecurity Maturity Model Certification (CMMC) is a mandatory requirement for all organizations that fall within the Defense Industrial Base (DIB) and Defense Supply Chain (DSC). Its’ objective is to establish a standardized technology defense posture for every member and every level of the Department of Defense industrial and research enterprise.
The goal is to combat the loss and theft of intellectual property and controlled information from DIB and DSC members, which the Federal Executive has designated as constituting a threat to U.S. national security.
HIPAA is a law designed to protect patients’ privacy, which comprises of both a set of regulations and a framework. Payment Card Industry Data Security Standard (PCI DSS) is similar and applies to any organization that accepts, stores, transmits or processes cardholder data. It’s a specific set of control requirements coupled with a certification process to attest to compliance.
This framework was developed by the Federal Communications Commission (FCC) to assist small businesses in developing and maintaining policies for protecting critical business data.
This framework, published by the International Organization for Standardization (ISO), and the International Electrotechnical Commission (IEC), specifies an information security management system (ISMS) for managing information security risks effectively.
This initiative was developed by the U.S. Security and Exchange Commission’s (SEC) Office of Compliance Inspections and Examinations (OCIE) to assess the cybersecurity preparedness of investment firms.
This broad framework was developed by the Federal Financial Institutions Examination Council (FFIEC) to ensure that financial institutions have accurate threat information to protect themselves and their customers from cyberattacks.
A security controls framework for IT systems used in financial accounting. It is a core part of compliance with the Sarbanes Oxley Act. Developed by ISACA for information technology management and IT governance. This framework is business-focused and defines a set of generic processes for the management of IT.
Cyberattacks only continue to rise and organizations and IT leadership is under a lot of pressure to step up their IT and cybersecurity measures and processes. Having to comply with multiple cybersecurity frameworks can be a considerable undertaking. Need help understanding framework requirements or want additional information on how to prepare to meet these requirements? Contact Withum’s IT and Cybersecurity Team.
Contact Us
For more information or to discuss your business needs, please connect with a member of our team.
