-
Book Overview & Buying
-
Table Of Contents
Executive's Cybersecurity Program Handbook
By :
There are hundreds of cybersecurity frameworks available to choose from; how do you know you are choosing the right one? Talk to stakeholders in the business to understand what the business does, who its customer base is, and where it does business. Also, as established in this chapter, understand how the business approaches cyber risk and how that impacts the enterprise.
Once you understand the business, choose a framework, and begin working on implementing controls. Many frameworks are focused on administrative controls, while others are focused on technical controls. There is nothing that says you cannot combine multiple frameworks to compensate between control families.
Many frameworks have matrices that show how they align with other frameworks. For instance, the NIST Cybersecurity Framework and CIS both have mappings to ISO and SP 800-53. This means that you can begin implementing one framework and if you decide to migrate or adopt another framework, you are not...