By now, many organizations of all sizes either have, are planning to, or are in the midst of nailing down the cybersecurity framework of their choice. Demonstrating compliance to a known cybersecurity framework demonstrates an organization’s commitment to protecting their own, as well as their clients’ information and data assets.
The Most Common Frameworks
The two most common frameworks available today are ISO 27001 (International Organization for Standardization) and NIST CSF (National Institute of Standards and Technology / Cybersecurity Framework). While both are de facto “compliance standards,” they have significant differences in their adaptation and on-going maintenance.
ISO 27001
It is considered a high-water mark when an organization can state to their shareholders and customers that they are ISO 27001 certified. But let’s look briefly at what it takes to attain this certification. ISO 27001 calls for the creation and maintenance of an Information Security Management System (ISMS). The creation and on-going maintenance of the ISMS can be a resource intensive choice for all but very large organizations. An ISMS has a considerable documentation load associated with it, an ISMS “Custodian” needs to be designated, and the organization is subject to annual external audits to prove that their ISMS is being kept current. The financial burden can be something that small to medium organizations just cannot justify.
NIST CSF
The NIST Cybersecurity framework can be a very viable alternative to ISO 27001 certification. The framework is well documented, is easy to understand and implement, and does not require a dedicated resource to maintain it like ISO 27001 ISMS does. Additionally, there is no annual requirement to be externally audited. Your organization, shareholders, and clients can feel the same sense of protection without breaking the bank to implement an ISMS.
In Conclusion
While achieving an ISO 27001 certification can add a heightened sense of accomplishment and prestige to an organization’s cybersecurity posture, small to medium size organizations should consider the very high cost of implementing and maintaining ISO 27001 standards and the requisite ISMS rather than being able to demonstrate the same commitment to cybersecurity compliance by leveraging the NIST CSF.
i3 Can Help
Wherever you are in the cybersecurity lifecycle (have a framework in place, need to fill some gaps, in the midst of implementing one, thinking about implementing one…), i3’s cybersecurity team led by our Certified Information Security Manager (CISM) can help. A great place to start is a gap assessment that typically takes just two weeks to complete.
