Relevant Standards for Cybersecurity Risk Management

In the section on Cyber Security Risk Management, we introduced two important concepts:

• A formal process for the assessment and management of risk, with well-defined steps;
• Best practices and technologies for mitigation of cyber security risk.

We also mentioned the fact that it is important to have a consistent approach, both to the categorization of risk factors and to their evaluation, in order to avoid comparing apples to oranges. This is where a harmonized set of standards has an important role to play. 

Of course, many organizations already implement standards mainly as a requirement for compliance (for example, Data protection Risk assessment / impact assessment as prescribed by EU 679/2016 ISO 9001). But that is not the only, or even the best reason for implementing standards. Several national and international standards organizations have published standards both for risk management and for cybersecurity best practices. The advantage of such standards is that they have been elaborated with the broad consensus of organizations in such a way as to guarantee a consistency of approach and terminology. By adopting such standards whenever possible, you are not only ensuring the highest possible quality of your methodology, but also facilitating ease of communication with others.

Standards for Risk Assessment and Management

Perhaps the best-known standard for overall management of information security is ISO 27000 – actually a family of standards (well over forty in total). ISO 27001:2013 in particular is a risk-based standard approach for the information security management system. It adopts a global vision of business, process, people and technology risks, and top management is actively involved in the entire risk mitigation process. In that sense, it provides an excellent framework for the implementation of an integrated Enterprise Risk Management system. Effectively implemented, it can provide:

• Stakeholders with substantiated and consistent opinions over the current state of risk throughout the enterprise;
• Guidance on how to manage risk to levels within the enterprise’s risk appetite;
• Guidance on how to set up the appropriate risk culture for the enterprise;
• Wherever possible, quantitative risk assessments enabling stakeholders to consider the cost of mitigation and the required resources against the loss exposure;
• A more accurate view of significant current and near-future risk throughout the enterprise—and the impact (both negative and positive) of this risk on the enterprise;
• Opportunities for integration of IT risk management with the overall risk and compliance structures within the enterprise;
• Promotion of risk responsibility and its acceptance throughout the enterprise.

The main message here is: you don’t have to go it alone. You don’t have to reinvent the wheel. Enterprise Risk Management, and in particular cyber security risk management, have been codified into standards that have broad international acceptance by all kinds of organizations.

Risk Management for Small-to-Medium Enterprises

One particular initiative is of special interest to smaller organizations. “A simplified approach to Risk Management for SMEs” is an initiative begun in 2007 and promoted by the European Agency for the Security of Networks and Information (ENISA). As indicated in the title of the initiative, ENISA decided to equip management staff who are not expert in matters of security with a simple tool to perform a guided and modular risk self-evaluation. In this regard, security aspects have been simplified and acceptable target security levels have been established, identifying a target risk profile.

Another example of an initiative targeting SMEs is the U.S. National Institute of Standards and Technology (NIST) initiative “Small Business Information Security: The Fundamentals” (publication NISTIR 7621, Revision 1). Like its ENISA counterpart, this initiative also aims to give small businesses a more lightweight, yet effective approach to understanding and managing its risks, safeguarding its information, and working safely and securely in a smaller context that than of very large organizations.

Standards for Cyber Security Best Practices

Recall that an important step is the identification of measures to mitigate the identified risk (see the dedicated section on Risk Mitigation). Recall also that there are two principal categories: technological measures (like state-of-the-art equipment) and best practices followed within the organization.

What are “best practices” for cybersecurity risk mitigation? Do we have to develop our own? Here, too, standards based upon the collective experience of organizations around the world provide us with best practices that have been proven in the field and are being constantly updated to reflect new knowledge. 

In the dedicated section on Risk Management, we encountered the NIST Cybersecurity Framework, which provides recommendations and requirements in many formats (spreadsheet, PDF, etc.) which may be customized for the organization. Examples of best practices you can find here are:

• Asset Management – external information systems are catalogued;
• Business environment – the organization’s role in the supply chain is identified and communicated;
• Governance – Information security roles & responsibilities are coordinated and aligned with internal roles and external partners;
• Access Control – identities and credentials are managed for authorized devices and users;
• Information Protection Processes and Procedures – Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed.

Note that these are organized according to categories, with each category containing specific recommendations.

Here, too, the message is: you don’t have to go it alone. There are standards and initiatives worldwide that provide sets of best practices that you can implement for credible cybersecurity risk mitigation as part of your overall cybersecurity risk management process. This is an important prelude to the successive step of residual cyber risk management, which is where the evaluation of cyber risk insurance enters into the picture.

Brief Standards Overview

Here is an overview of just some of the relevant standards for an organization implementing cybersecurity risk management and best practices.