What Cybersecurity framework(s) does your company follow?

A Cybersecurity framework is a tool that provides a common language for organizations to:

• Understand their current cybersecurity posture.
• Identify and prioritize opportunities for improvement within the context of a continuous and repeatable process.
• Describe their future state for cybersecurity.
• Assess the program toward the future state.
• Communicate among internal and external stakeholders about cybersecurity risk.

There are Control frameworks, Program frameworks, and Risk frameworks. Control frameworks (NIST800-53, CIS Critical Security Controls) help organizations build a baseline to ensure they have basic cyber-hygiene practices in place. Program frameworks (NIST CSF, ISO27001) help assess the state of the overall Cybersecurity Program. Risk frameworks help organizations prioritize their activities to ensure they are focusing on the most critical risks to the business.

Ideally, organizations would utilize all three framework types to build a robust Cybersecurity program, but for the majority of SMB's that's just not feasible. So if your organization doesn't use a framework today, start with a Controls framework to ensure you have basic cyber-hygiene practices implemented. As you mature look to adopt Program and Risk frameworks to continue to improve your cybersecurity posture.

Solutions II helps our clients navigate the complexities of Cybersecurity by providing free Security Controls assessments based on CISA's Cybersecurity Performance Goals and the CIS Critical Security Controls. This initial assessment helps paint a picture of our clients Cybersecurity program in its current state. Then, we work with our clients to understand the business outcomes they want to achieve so we can reverse engineer solutions that meet their needs.

At Solutions II, we are committed to our clients’ success. We are driven by guaranteeing our clients’ satisfaction and believe that our success follows the success of our clients.

If your organization is looking for a way to assess the current state of your Cybersecurity program and improve your security posture, please reach out to me or anyone at Solutions II to get an assessment scheduled.

Solutions-II, Inc (Hybrid Data Center, Cyber Security, Managed Services)