The 12 most important IT security frameworks & standards explained

Trusted Advisor for IT & Telecommunications Sourcing

From ISO 27001 to NIST: What IT managers need to know about security frameworks

Companies need to reliably protect data while cyberattacks increase and compliance requirements such as HIPAA, PCI DSS, Sarbanes-Oxley Act or GDPR become stricter.

The question: How can company data be secured and regulations complied with without losing control?

IT security frameworks and cyber security standards provide guidance on information security, from perimeter protection and encryption to application security and disaster recovery. Knowledge of these frameworks is essential for experts, also from an audit perspective.

Savecall ensures that your company remains secure and compliant:

One contact for all IT security issues
Appropriate standards efficiently implemented
Transparency on compliance and costs
Future-proof security architecture

Book a consultation

>20%
Savings

Learn more

99,99%
Availability

Learn more

24/7
Support

Contact

Savecall: People, solutions, reliability

What are IT security standards & regulations?

IT security team in the control room discussing in front of monitors with global data maps and code - presentation of standards and regulations in cyber security

From best practices to legal obligations – what companies need to know:

Standards are comparable to a recipe; they specify the steps to be followed. A well-organized IT department must meet the requirements defined in a standard.

Ordinances, on the other hand, are legally binding. Their wording, which specifies how something is to be implemented, makes it clear that both the government and the public support the rules and procedures laid down in the regulation. Failure to comply with IT-specific regulations can result in fines and legal disputes.

In a nutshell:

Standards = guidelines, best practices, orientation
Regulations = Legally binding, penalties for non-compliance
Both are crucial for compliance, security and risk minimization

Book a consultation

What is an IT security framework?

Why security frameworks are the foundation of modern IT

An IT security framework is a set of documented processes that define policies and procedures around the implementation and ongoing management of information security controls. These frameworks are a blueprint for risk management and vulnerability reduction.

Information security professionals use frameworks to define and prioritize the tasks required to manage enterprise security. Frameworks are also used to prepare for compliance and other IT audits. The framework must therefore support specific requirements defined in the standard or regulation.

Companies can customize frameworks to solve specific information security problems, such as industry-specific requirements or different regulatory compliance objectives. Frameworks also come in varying degrees of complexity and size. Today’s frameworks often overlap, so it’s important to select a framework that effectively supports operational, compliance and audit requirements.

In a nutshell:

Creating orientation: Frameworks define processes, guidelines and priorities for IT security
Reduce risks: They are blueprints for effective risk management and vulnerability minimization
Ensuring compliance: support with audits, inspections and industry-specific requirements

Book a consultation

Why are security frameworks important?

Why security frameworks are the foundation of modern IT

Frameworks provide a starting point for defining processes, guidelines and administrative activities for information security management.

Security requirements often overlap, resulting in “crosswalks” that can be used to demonstrate compliance with different regulatory standards. For example, ISO 27002 defines information security policy in Section 5; Control Objectives for Information and Related Technology ( COBIT ) defines it in the “Align, Plan and Organize” section; the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework defines it in the “Internal Environment” section; HIPAA defines it in the “Assigned Security Responsibilities” section; and PCI DSS defines it in the “Maintain an Information Security Policy” section.

Using a common framework such as ISO 27002, an organization can establish crosswalks to demonstrate compliance with multiple regulations, including HIPAA, Sarbanes-Oxley Act (SOX), PCI DSS and Gramm-Leach-Bliley Act (GLBA).

In a nutshell:

Common basis: One framework bundles different security requirements
Proof of compliance: “crosswalks” facilitate audit and inspection processes
Efficiency for companies: Multiple regulations (e.g. HIPAA, SOX, PCI DSS) covered simultaneously

Book a consultation

How do you select an IT security framework?

Laptop with illuminated red warning symbol and the message System Hacked - illustration of a cyberattack as an example of the importance of IT security frameworks.

The right framework depends on the industry and objective

The decision to use a specific IT security framework can be determined by several factors. The type of industry or compliance requirements can be decisive factors. For example, listed companies may want to use COBIT to comply with SOX, while the healthcare sector may consider HITRUST. The ISO 27000 series of information security frameworks, on the other hand, is applicable in both the public and private sectors.

Although ISO standards are often time-consuming to implement, they are helpful when an organization needs to demonstrate its information security capabilities through ISO 27000 certification. While NIST Special Publication (SP) 800-53 is the standard required by U.S. federal agencies, it can be used by any organization to create a technology-specific information security plan.

These frameworks help security professionals organize and manage an information security program. The only bad choice among these frameworks is to not choose one of them.

In a nutshell:

Choose industry-specific: e.g. COBIT for SOX, HITRUST for healthcare
Proof of capabilities: ISO 27000 or NIST ensure compliance and certification
Worst choice: Doing without a frameworkaltogetherCreating orientation: Frameworks define processes, policies and priorities for IT security

Book a consultation

Examples of IT security standards & frameworks

1

ISO 27000 series

The ISO 27000 series was developed by the International Organization for Standardization. It is a flexible information security framework that can be applied to all types and sizes of organizations.

The two primary standards ISO 27001 and 27002 define the requirements and procedures for setting up an information security management system (ISMS). An ISMS is an important audit and compliance activity. ISO 27000 consists of an overview and a vocabulary and defines ISMS requirements. ISO 27002 specifies the code of practice for the development of ISMS controls.

Compliance with the standards of the ISO 27000 series is ensured by audit and certification processes, which are generally carried out by third-party organizations approved by ISO and other accredited agencies.

The ISO 27000 series comprises 60 standards that cover a broad spectrum of information security issues, for example:

ISO 27018 deals with cloud computing.
ISO 27031 provides guidelines for IT disaster recovery programs and related activities.
ISO 27037 deals with the collection and protection of digital evidence.
ISO 27040 deals with storage security.
ISO 27799 defines healthcare information security, which is useful for organizations that require HIPAA compliance.

2

NIST SP 800-53

NIST has developed an extensive library of IT standards, many of which focus on information security. The NIST SP 800 series, first published in 1990, addresses almost all aspects of information security, with an increasing focus on cloud security.

NIST SP 800-53 is the information security benchmark for U.S. government agencies and is widely used in the private sector. SP 800-53 has helped drive the development of information security frameworks, including the NIST Cybersecurity Framework (NIST CSF)

3

NIST SP 800-171

NIST SP 800-171 has gained popularity due to the requirements established by the U.S. Department of Defense for contractor compliance with security frameworks. Due to their proximity to government information systems, government contractors are a frequent target of cyberattacks. Government manufacturers and subcontractors must have an IT security framework in place in order to bid on federal and state business opportunities.

The controls contained in the NIST SP 800-171 framework are directly related to NIST SP 800-53, but are less detailed and more general. It is possible to create a transition between the two standards when an organization needs to demonstrate compliance with NIST SP 800-53, using NIST SP 800-171 as the foundation. This creates flexibility for smaller organizations to demonstrate compliance as they grow using the additional controls included in NIST SP 800-53.

4

NIST CSF

The NIST Framework for Improving Critical Infrastructure Cybersecurity (NIST CSF) was developed as part of Executive Order 13636 published in February 2013. It was developed for U.S. critical infrastructure, including power generation, water supply, food supply, communications, healthcare, and transportation. These industries must maintain a high level of preparedness as they have all been targeted by nation-state actors due to their importance.

Unlike other NIST frameworks, NIST CSF focuses on the analysis and risk management of cybersecurity risks. The security controls in the framework are based on the five phases of risk management:

Identify, protect, detect, respond and recover.

Like all IT security programs, these phases require the support of senior management. NIST CSF is suitable for both the public and private sectors.

5

NIST SP 1800 series

The NIST SP 1800 series is a series of guides that complement the standards and frameworks in the NIST SP 800 series. The SP 1800 publication series provides information on the implementation and application of standards-based cybersecurity technologies in real-world applications.

The SP 1800 series releases offer the following:

Examples of specific situations and skills.
Experience-based how-to approaches with multiple products to achieve the desired result.
Modular skills implementation guide for organizations of all sizes.
Specifications of the required components as well as installation, configuration and integration information so that companies can easily replicate the process themselves.

6

COBIT

COBIT was developed in the mid-1990s by ISACA, an independent organization of IT governance experts. ISACA offers the well-known Certified Information Systems Auditor and Certified Information Security Manager certifications.

COBIT originally focused on the reduction of IT risks. COBIT 5 was released in 2012 and incorporated new technology and business trends to help organizations align IT and business objectives. The current version is COBIT 2019, which is the most widely used framework for achieving SOX compliance. Numerous publications and professional certifications address the COBIT requirements.

7

CIS controls

The Center for Internet Security (CIS) Critical Security Controls, Version 8 – formerly the SANS Top 20 – lists technical security and operational controls that can be applied to any environment. It is not concerned with risk analysis or risk management like NIST CSF; rather, it is solely concerned with reducing risk and increasing the resilience of technical infrastructures.

The 18 CIS controls include the following:

Inventory and control of company assets
Data protection
Monitoring log management
Malware defense
Penetration tests

CIS Controls are linked to existing risk management frameworks to help address identified risks. They are useful resources for IT departments that lack experience in technical information security.

8

HITRUST Common Security Framework

The HITRUST Common Security Framework (CSF) includes risk analysis and risk management frameworks as well as operational requirements. The framework has 14 different control categories and can be applied to almost any organization, including healthcare.

HITRUST CSF is a massive undertaking for any organization because of the importance of documentation and processes. As a result, many organizations end up defining smaller focus areas for HITRUST. The cost of obtaining and maintaining HITRUST certification adds to the expense of implementing this framework. The certification is audited by a third party, which provides an additional level of validity.

9

The GDPR is a framework of security requirements that global organizations must implement to protect the security and privacy of EU citizens’ personal data. GDPR requirements include controls to restrict unauthorized access to stored data and access control measures, such as least privilege, role-based access and multi-factor authentication.

10

COSO

COSO is a joint initiative of five professional associations. Its “Internal Control – Integrated Framework”, published in 1992 and updated in 2013, helps companies to achieve a risk-based approach to internal controls. It comprises the following five components:

Control environment
Risk assessment and management
Monitoring activities
Information and communication
Monitoring

COSO published its Enterprise Risk Management (ERM) – Integrated Framework in 2004 and updated it in 2017. The framework, which is designed to help organizations improve their cyber risk management, comprises 20 principles in the following five components:

Governance and culture
Strategy and objectives
Performance
Review and revision
Information, communication and reporting

A guidance paper published in 2019 entitled “Managing Cyber Risk in a Digital Age” provides advice on how to prepare for and respond to cyber threats to organizations. It aligns with the COSO ERM Framework.

11

FISMA

The Federal Information Security Modernization Act (FISMA), which is closely aligned with the NIST Risk Management Framework, provides a security framework to protect federal government data and systems. FISMA was introduced in 2002 and updated in 2014. An update has been proposed in 2023. Legislation is still pending.

FISMA requires federal agencies and their third parties, contractors, and vendors to develop, document, and implement security policies and practices, including monitoring their IT infrastructure and conducting periodic security reviews.

12

NERC CIP

The North American Electric Reliability Corporation’s Critical Infrastructure Protection is a framework of 14 ratified and proposed standards applicable to utilities on the bulk power grid. The standards describe recommended controls and guidelines for monitoring, regulating, managing and maintaining the security of critical infrastructure systems.

The CIP standards include the following: