The NIST Cybersecurity Framework (CSF) 2.0 organizes cybersecurity activities into six high-level functions that guide organizations in managing and reducing cyber risk. Govern provides strategic oversight, policies, and accountability structures to integrate cybersecurity into organizational decision-making. Identify focuses on understanding assets, business environment, and risk landscape to prioritize protective efforts. Protect involves implementing safeguards such as access controls, encryption, and secure configurations to prevent or limit the impact of cyber events. Detect emphasizes timely discovery of anomalies and potential incidents through monitoring and threat intelligence. Respond outlines processes for containing, mitigating, and communicating during incidents to minimize damage. Finally, Recover addresses restoring capabilities and services after an event to maintain business continuity. Together, these six functions provide a comprehensive, flexible, and risk-based approach to cybersecurity management.
The EBA Guidelines on ICT and Security Risk Management provide a comprehensive framework for credit institutions, investment firms, and payment service providers to identify, assess, and mitigate ICT and security… Read More »EBA Guidelines on ICT and security risk management
The MITRE Common Attack Pattern Enumeration and Classification (CAPEC) is a publicly available, comprehensive catalog that documents and categorizes common attack patterns used by adversaries to exploit software and systems.… Read More »MITRE CAPEC – Common Attack Pattern Enumeration and Classification Version 3.9
FIPS 140-3 is a mandatory standard for federal agencies and a benchmark for the private sector that defines the security requirements for hardware and software cryptographic modules. It superseded FIPS… Read More »NIST Federal Information Processing Standard (FIPS) Publication 140-3: Security Requirements for Cryptographic Modules
NIST Special Publication 800-37, Revision 2, titled “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” provides comprehensive guidelines for applying the… Read More »NIST SP 800-37 Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
Recommendations to secure the administration of IT systems emphasize conducting a thorough risk analysis tailored to the organization’s specific environment, as administrative resources are high-value targets for attackers due to… Read More »ANSSI Recommendations to secure administration of IT systems
The CCPA/CPRA represents the most comprehensive data privacy framework in the United States, granting California residents extensive rights over their personal information, including the right to know, delete, correct, and… Read More »California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA)
BSI Standard 200-3 provides a highly structured methodology for conducting specialized risk analyses within the IT-Grundschutz framework, specifically targeting assets that require a “high” or “very high” protection requirement. This… Read More »BSI Standard 200-3: Risk Analysis based on IT-Grundschutz
BSI Standard 200-2 serves as the practical implementation guide for the IT-Grundschutz methodology, providing a structured, process-oriented framework for establishing and maintaining a robust Information Security Management System (ISMS). This… Read More »BSI Standard 200-2: IT-Grundschutz Methodology
BSI Standard 200-1 establishes the fundamental requirements for a robust Information Security Management System (ISMS), defining the core principles of confidentiality, integrity, and availability required to protect an organization’s data.… Read More »BSI Standard 200-1: Management Systems for Information Security
The ISO 27000 standard provides an overview and introduction to the ISO 27000 family, which is a series of international standards focused on information security management systems (ISMS). These standards… Read More »ISO/IEC 27000:2018 Information technology — Security techniques — Information security management systems — Overview and vocabulary