ZenGRC

Simply Powerful GRC

NIST

NIST and FedRAMP: A Brief Overview

· ·

If you are new to the U.S. government’s rules for federal government contractors, there can be a host of tricky compliance terms to navigate. So here is a quick primer on two of the most important terms a CISO is likely to encounter: NIST and FedRAMP.

NIST Background

The National Institute of Standards and Technology (NIST) produces standards and risk assessment frameworks for a wide range of subjects, including cybersecurity. These documents typically take the form of Special Publications (SP).

For example, the NIST SP 800 series deals with computer security. Specifically, NIST 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, details the security and privacy controls that must be in place for information systems in the U.S. government.

Other publications in the SP 800 series cover issues such as including risk management (SP 800-37 and SP 800-30,) and business continuity planning (SP 800-34).

Why Is NIST Important?

The Federal Information Security Management Act of 2002 (FISMA) and Federal Information Security Modernization Act of 2014 (also called FISMA, and which updates the original law) require U.S. government agencies to implement information security controls using a risk-based approach to information security and cybersecurity assessment. Each agency must report its compliance annually to the Office of Management and Budget (OMB) — and the primary framework used for FISMA compliance is detailed in NIST SP 800-53.

In other words, to be a government contractor, your business must comply with NIST standards to meet annual FISMA compliance requirements. In addition, contractors managing IT systems on behalf of government agencies may also be required to report their compliance with FISMA and other security standards, such as the PCI-DSS standard for protecting credit card data.

How FedRAMP Enters the Compliance Picture

The Federal Risk and Authorization Management Program (FedRAMP) helps U.S. government agencies to reap the benefits of cloud services while minimizing duplicative information security work. It essentially serves as a seal of approval for cloud service providers (CSPs); when a CSP meets FedRAMP standards, federal agencies can use that CSP without the exhaustive due diligence and testing that might typically happen.

CSPs offer cloud products, such as IaaS, PaaS, and SaaS, for sale to the government. These systems must meet the requirements of FISMA; FedRAMP provides a way to streamline the security and risk assessment process for maximum efficiency, so organizations can engage in a cloud-first strategy.

FedRAMP relies on several of the NIST SP documents, including 800-53 as a library of system controls and 800-37 for risk management. The streamlining occurs with a focus on which controls the CSP manages and which are managed by the agency purchasing the cloud services.

For example, a SaaS provider will offer the same shared physical security protections to all users due to the use of a single data center or hosting facility, leading to a low risk for these users. Conversely, each acquiring agency is responsible for implementing appropriate password controls which are sufficiently secure.

A CSP that wants to sell services to the U.S. government must identify which controls are relevant to the services the CSP is selling, and then engage a qualified third-party assessment organization (3PAO) to conduct a risk assessment. Once this assessment has been conducted on behalf of one government agency, other agencies may rely on the report of that assessment without having to conduct their own — saving time and money.

How Are NIST and FedRAMP Connected?

NIST provides standards and guidelines around risk management, information security, and privacy controls for information systems used by the U.S. government. FedRAMP employs the NIST guidelines to enable U.S. government agencies to use cloud services securely and efficiently.

In other words, if you’re a cloud service provider and want to bid on government contracts, you must comply with NIST standards so that you can be part of the FedRAMP program and have a much easier time offering your services to U.S. government customers.

While NIST and FedRAMP compliance are not required for private organizations that don’t bid on federal government contracts, following those standards is still a wise idea for any organization that wants to take a smart approach to cloud-based services and cybersecurity.

Manage NIST and FedRAMP Compliance with RiskOptics

RiskOptics makes managing both NIST and FedRAMP compliance pain-free. The RiskOptics ROAR Platform has FedRAMP and NIST SP 800-53 controls pre-loaded, so you can leverage existing work from compliance with other regulations to get FedRAMP compliant. You can also prepare evidence for your 3PAO quickly and more easily with the audit module.

To learn more about managing NIST and FedRAMP controls in our comprehensive risk management platform, schedule a demo today.

NIST vs. ISO: What’s the Difference?

· ·

Cybersecurity frameworks help countless businesses to better secure their IT systems. Two of the most widely known frameworks for information security are the Cybersecurity Framework, created by the National Institute of Standards and Technology (NIST); and the ISO 27001 standard, created by the International Organization for Standardization (ISO).

How do the NIST cybersecurity framework and ISO 27001 differ? How do you decide which one is best for your business – or could you even use pieces from both at the same time?

Read on to learn more about these important cybersecurity risk frameworks, their differences, whether you can combine them, and how to better protect your data.

What Is a Cybersecurity Framework?

A cybersecurity framework is a system for managing cybersecurity threats and risks. It is a set of guidelines, best practices, and standards that organizations can use to protect their data, systems, and networks from cyber threats.

Frameworks are designed to help organizations minimize the harm from cyber threats and to create a comprehensive cybersecurity strategy. They typically include several components to aid organizations with assessing vulnerabilities, implementing security access controls, incident response procedures, cyber risk mitigation, and continuous monitoring practices.

Frameworks are also designed to be flexible. Any organization should be able to put one to use, regardless of your specific industry, size, or existing cybersecurity talent.

What Is the NIST Cybersecurity Framework?

The NIST cybersecurity framework (CSF) is a set of standards developed by the U.S. government to protect federal information and the country’s critical infrastructure. It has since been updated and adapted for the private sector and for global use.

The goal of the NIST CSF is to help organizations assess and respond to security incidents and threats. It has five main functions that guide the development and implementation of controls: identify, protect, detect, respond, and recover.

Private enterprises only need to implement CSF if they are part of the federal government’s supply chain. For any other business that isn’t, compliance with CSF is wise – but not voluntary.

What Is the ISO 27001 Cybersecurity Framework?

The ISO 27001 framework defines a set of requirements and industry recommendations for managing information security risks. It is based on a systematic approach to managing security risks that includes cyber risk monitoring, remediation, and assessment.

ISO 27001 also includes a set of practices that organizations can use to protect their data assets from a wide range of cyber threats. It helps organizations to establish an effective information security program, demonstrate compliance with regulatory and legal provisions, and provide threat intelligence monitoring.

The goal of ISO 27001 is to build trust with consumers, associates, and other stakeholders about the threats and risks many industries face.

How Do NIST CSF and ISO 27001 Differ?

The CSF and ISO 27001 differ in several important ways. For example, the CSF focuses on self-assessment processes, which can be a great help for companies that are still trying to establish an effective cybersecurity program. Meanwhile, ISO 27001 is less technical and more risk-based for organizations of all shapes and sizes. It is also considered the “international” standard for cybersecurity, although either one can be used worldwide.

ISO 27001 compliance also includes an independent certification audit, which provides additional credibility and assurance that organizations have robust security systems in place. The CSF doesn’t require an audit.

ISO 27001 is ideal for organizations across a multitude of industries that need non-technical, yet comprehensive third-party cyber risk management guidance. It’s a solid way for an organization to ensure that specific criteria measures are met within its industry sector.

Can NIST and ISO Be Used Together?

Both the NIST and the ISO have highly regarded approaches to information security that help organizations across many industries. A common misconception is that an organization must choose between NIST or ISO to protect its systems and networks. You don’t. Unless you have some contractual or regulatory requirement to use one specific framework, nothing forbids a private enterprise from mixing and matching pieces of both to find the right approach for you.

Indeed, using the two frameworks together can deliver many synergies for managing risk and security controls. Both are valuable for data security, asset management, cyber risk analysis, risk assessments, and cybersecurity programs for countless industries.

The only concern here is that you don’t end up duplicating your cybersecurity efforts unnecessarily. For example, there could easily be situations where one control satisfies the demands for both frameworks. Compliance teams will want to know that so you can keep your control systems as simple as possible, rather than clogging your business processes with multiple controls all doing the same thing. (This point is true whether talking about ISO 27001 and CSF, or other, industry-specific security frameworks as well.)

Protect Your Data with the ROAR Platform

Many organizations using multiple frameworks use governance, risk, and compliance platforms such as ROAR to manage their risk more effectively. The RiskOptics ROAR Platform can help your organization implement multiple frameworks more efficiently. It can help you identify control gaps that need attention, or redundant controls that can be streamlined.

ROAR also provides actionable risk management solutions to better safeguard your organization’s critical infrastructure, assure business continuity, and create a more robust security posture. Schedule a demo with us today to get started.

What is the Purpose of NIST?

· ·

What Is the Purpose of the NIST Cybersecurity Framework?

Strong cybersecurity is paramount for organizations in every industry – and the best way to implement a robust cybersecurity program (or to strengthen an existing program) is to use an established cybersecurity framework.

An accepted cybersecurity framework will provide useful guidelines and goals to plan, implement, and optimize cybersecurity programs. Such a program can improve an organization’s threat detection, risk mitigation, and incident response capabilities. That, in turn, helps your risk management and regulatory compliance objectives.

Several such frameworks are available. One of the most popular frameworks is the NIST Cybersecurity Framework (NIST CSF). The NIST CSF provides a uniform set of rules, guidelines, and standards that organizations in any industry can use to build an effective cybersecurity program.

What Is the NIST Cybersecurity Framework?

The National Institute of Standards and Technology (NIST) establishes information technology-related frameworks and standards. U.S. federal agencies and private-sector organizations alike use various NIST frameworks for information security management and risk management.

In 2013 the Obama Administration issued Executive Order (EO) 13636, directing NIST to develop a voluntary cybersecurity framework for reducing risks to critical infrastructure in the United States. Based on this EO and the Cybersecurity Enhancement Act of 2014, NIST (official website: www.nist.gov) drafted its CSF in collaboration with industry and government agencies.

The NIST Cybersecurity Framework aims to provide a “prioritized, flexible, repeatable, and cost-effective approach” to cybersecurity risk management. Its tried-and-tested security baselines, guidelines, and best practices enable organizations to manage and mitigate cybersecurity risk.

Any small business or large organization can use the CSF, regardless of industry, size, degree of cybersecurity risk, or cybersecurity program maturity. Your organization can apply its risk management principles and best practices to improve cybersecurity and ultimately to build a more resilient business.

Cybersecurity Framework vs. Cybersecurity Plan

The CSF is not a one-size-fits-all approach to cybersecurity risk management. Despite its focus on standardization and a common cybersecurity “language,” you must customize the framework to meet your organization’s own unique needs and risk profile.

More precisely, the NIST CSF provides a useful way to create your organization’s cybersecurity plan. This plan should cover the security strategy, policies, procedures, and tools you will use to improve cyber risk management and implement a robust security program.

Benefits of the NIST Cybersecurity Framework for Organizations

For private-sector businesses, adopting the NIST CSF is voluntary. You don’t have to comply with its rules, standards, guidelines, and practices; but doing so can benefit your organization in many ways.

For starters, you can better manage and reduce cybersecurity risk. You can also take advantage of the framework’s common language to improve communications about risk management between internal and external stakeholders. The common language can also improve security awareness and understanding among functional units, senior executives, and boards of directors.

Another benefit is that you can determine critical activities for service delivery, and then implement measures to conduct those activities smoothly – activities that can directly affect your business continuity and competitiveness. The framework will also guide security investments to reduce the size of the organization’s threat landscape while maximizing its ROI.

5 Functions in the NIST CSF Core

The NIST CSF, now in Version 1.1 (v1.1), consists of three main components:

  • Framework Core
  • Implementation Tiers
  • Framework Profiles

The Framework Core provides five concurrent and continuous functions that provide a high-level, strategic view of the organization’s cybersecurity risk management lifecycle.

These five Core Functions are:

  • Identify: Identify which assets need protection.
  • Protect: Implement appropriate safeguards to protect these assets.
  • Detect: Implement appropriate safeguards to detect security threats and incidents.
  • Respond: Develop techniques to mitigate the impact of these incidents.
  • Recover: Implement processes to recover from cyberattacks and restore business-as-usual.

Each Function then includes multiple Categories, Subcategories, and Informative References – known as “elements” – in simple, easy-to-understand, and actionable language. These four elements in the CSF Core apply whether you operate your own assets or outsource operations to another party.

How the four Core elements work together

The Functions organize cybersecurity activities, so you can manage cybersecurity risk by:

  • Collecting, organizing, and contextualizing useful information
  • Addressing threats before they can cause damage
  • Learning from previous activities to continually optimize threat detection and mitigation

The five Functions align with existing incident management methodologies and guide cybersecurity investments. For example, you can assess whether additional investments could improve the timeliness and effectiveness of response and recovery actions, and thus reduce the harm of a security incident on service delivery.

The NIST CSF Core includes Categories that divide a Function into cybersecurity outcomes tied to specific organizational needs and activities. Asset Management, Identity Management and Access Control, and Detection Processes are some of these categories.

The Subcategories divide a Category into specific outcomes and support the achievement of these outcomes. Examples include:

  • External information systems are inventoried
  • Data-at-rest is protected
  • Notifications from detection systems are investigated

Informative References are specific sections of cybersecurity standards, guidelines, and practices that illustrate how to achieve the outcomes associated with each Subcategory in the CSF Core.

Five functions in the CSF Core

The NIST CSF is widely accepted as the gold standard for building enterprise cybersecurity programs. One reason for its popularity is that it categorizes all cybersecurity activities into five easy-to-understand functions:

1. Identify

Meaning: Understand cybersecurity risk to enterprise systems, people, assets, and data.

The Identify function lays the foundation for implementing a new cybersecurity program or improving an existing program. Its various activities are essential to understand the business context, critical functions and resources, and their related cybersecurity risks. The outcome Categories under this Function can help you to prioritize risk management efforts in line with business needs.

Some of these Categories are:

  • Asset Management: Identify enterprise assets and establish an asset management program.
  • Business Environment: Understand the company’s role in the supply chain.
  • Governance: Establish governance policies and identify the legal and regulatory requirements for cybersecurity capabilities.
  • Risk Assessment: Implement risk assessment and response processes.
  • Risk Management Strategy: Identify risk tolerance and implement a supply chain risk management strategy.

2. Protect

Meaning: Implement strong safeguards to maintain service delivery and business continuity.

The Protect function is about limiting the harm of a cybersecurity event and maintaining service delivery during the disruption. Some critical activities in this group include:

  • Identity Management and Access Control: Implement physical, digital, and remote access controls.
  • Awareness and Training: Improve security awareness through role-based and privileged user training.
  • Data Security: Establish controls to protect the confidentiality, integrity, and availability (the “CIA triad”) of information.
  • Information Protection Processes and Procedures: Protect sensitive information systems.
  • Maintenance: Assure that all assets remain in ideal operational condition.
  • Protective Technology: Implement tools and processes to ensure the security and resilience of IT systems.

3. Detect

Meaning: Develop appropriate activities to identify cybersecurity threats and events.

To protect the organization and its assets, you must identify the cybersecurity threats that affect it today or may affect it in future. The CSF Detect Function helps with this goal. Some of its essential activities include:

  • Anomalies and Events: Detect anomalous or suspicious behaviors or events, and assess their potential impact.
  • Security: Implement protective measures and regularly verify their effectiveness.
  • Continuous Monitoring and Detection: Develop capabilities to monitor cybersecurity events.

4. Respond

Meaning: Implement measures to respond to cybersecurity events and minimize damage.

When a cybersecurity event does occur, you must contain its impact to minimize damage. For this, you need to implement measures to respond quickly and appropriately. Examples of outcome Categories in this Function are:

  • Response Planning: Implement and execute an incident response process.
  • Communications: Keep internal and external stakeholders informed during and after an event.
  • Analysis: Perform forensic analysis and impact analysis to accelerate post-incident recovery.
  • Mitigation: Perform mitigation activities to resolve a detected cybersecurity incident and contain its impact.
  • Improvements: Document lessons learned from detection and response activities to improve the cybersecurity program.

5. Recover

Meaning: Develop measures to restore capabilities after an event.

The Recover function is important because it supports timely recovery and a return to normal operations after a cybersecurity incident. It also identifies appropriate activities to renew and maintain plans for enterprise cybersecurity resilience.

The essential activities under this Function are:

  • Recovery Planning: Plan and implement processes and procedures to restore systems impaired by an incident.
  • Improvements: Review existing strategies to plan cybersecurity improvements.
  • Communications: Coordinate internal and external communications during and after the incident.

Automate and Streamline Cybersecurity Risk Management with Reciprocity ZenRisk

The NIST CSF provides a repeatable and customizable way to implement a strong cybersecurity risk management program. The challenge for CISOs is to coordinate all that activity briskly and efficiently. To help with that effort – to develop actionable insights, automated risk scoring, real-time risk monitoring, and more – you can use Reciprocity ZenRisk.

ZenRisk will help you identify, assess, and mitigate IT and cyber risk with its guided, content-rich approach. With ZenRisk’s fast onboarding and automated workflows, you can quickly start monitoring risk and reduce uncertainty. Goodbye, manual processes and tedious work!

Visualize and quantify your cybersecurity posture to guide strategic, risk-based decisions, risk communications, and risk investments. Stay ahead of threats and optimize security with this integrated cybersecurity risk management solution from cybersecurity experts Reciprocity.

Schedule a demo to see how ZenRisk works for yourself.

NIST vs SOC 2: What’s the Difference?

· ·

When the subject is cybersecurity compliance, the National Institute of Standards and Technology (NIST) is often the first reference that comes to mind. NIST has been around for decades, and its standards for the development of cybersecurity risk management programs are considered the gold standard.

There is, however, another standard that applies to service providers that handle customer data, as well as to those firms’ business partners: the SOC 2 audit.

SOC 2 was developed by the American Institute of Certified Public Accountants (AICPA) as a way to audit and document the effectiveness of a business’ internal processes and cybersecurity controls, to assure that certain customer data is adequately protected against cyber attacks and data breaches.

How do SOC 2 and NIST differ?

The principal difference between the two is that a successful SOC 2 audit leads to an organization obtaining independent documentation that it has achieved SOC 2 compliance — something that may be required by customers, business partners, or (depending on your business) the law.

In contrast, NIST is a voluntary framework that can be applied to a service organization’s IT systems to improve information security and solidify a cybersecurity program. But that doesn’t result in an independent audit report or any other certification of compliance.

Both NIST and SOC 2 are standards that aim to analyze an organization’s internal controls, but they place emphasis on distinct areas of data security.

What is the difference among the different types of SOC reports: SOC 1, SOC 2 and SOC 3?

SOC 1 is a review of financial controls and financial reporting, showing that management’s assertion that all financial data are protected from data breaches and handled in a safe manner is accurate.

SOC 2 is a report completed by an independent auditor showing that an organization’s cybersecurity risk management program as well as IT system and organization controls are effective and adequate.

SOC 3 is similar to SOC 2, in that both review cybersecurity controls. A SOC 3 report, however, ,summarizes the findings of the SOC 2 audit and describes the effectiveness of the controls in place, and how they apply to protect privacy and integrity of the data handled. A SOC 3 report tends to be more general and easier to understand for the public.

Together, SOC 2 and SOC 3 compliance reports are often used to show potential clients that your organization takes cybersecurity seriously. The reports address your cybersecurity objectives, the effectiveness of internal controls, and how committed management is to an organization’s cybersecurity risk management program.

For comparison, the NIST Cybersecurity Framework (CSF) lists best practices, standards, and guidelines to help a company do a thorough cybersecurity examination and risk assessment.

Let’s dive deeper into SOC 2

Developed by the AICPA, a SOC 2 report focuses on a company’s data processing integrity and whether customers’ sensitive information is adequately protected within the company and among its third-party vendors.

SOC 2 is not just SOC for cybersecurity; it focuses on five areas of data handling also known as trust services criteria:

  • Privacy: does the organization provide sufficient access controls, such as two-factor authentication?
  • Confidentiality: are encryption, firewalls, and other security controls in place and updated?
  • Processing integrity: how strong are the company’s internal assessment process and third-party vendor management?
  • Availability: how are potential cybersecurity breaches and incidents handled? Are there disaster recovery plans in place that will allow the company to recover and continue to operate if a data breach takes place.
  • Security: how effective are the controls put in place to detect intrusion? How effective is the internal cybersecurity reporting framework and its response to security events?

All SOC reports are performed by external auditors as a way to assure that management accurately describes the organization’s cybersecurity risk management and reporting framework.

Cybersecurity and compliance management tools

As you forge a path for your business in our highly regulated, highly interdependent world, many tools can help keep your business stay competitive while keeping cybersecurity and compliance top priorities.

ZenGRC’s compliance, risk, and workflow management software is an intuitive, easy-to-understand platform that not only keeps track of your workflow, but also lets you find areas of high risk before those risks manifest as real threats.

Worry-free compliance management is the Zen way. For more information on how ZenGRC can enable your CMS, contact us for a demo.