uses_and_benefits_of_framework based on NIST

Editor's Notes

• #3: The Framework is designed to complement existing business and cybersecurity operations, and can be used to: Understand current cybersecurity operations through the creation of a current state profile Establish or Improve a cybersecurity program regardless of maturity by reducing risk Communicate cybersecurity requirements with stakeholders – including suppliers and partners Identify opportunities for new or revised standards Assists in prioritizing improvement activities (gap assessment) Enables investment decisions to address gaps Additionally, the Framework can help: Identify tools and technologies to help organizations use the Framework Integrate privacy and civil liberties considerations into a cybersecurity program
• #4: Can be used by organizations regardless of size or sector. Framework was designed with CI in mind, but is extremely versatile and can easily be used by non-CI organizations Still provides value to mature programs, or can be used by organizations seeking to create a cybersecurity program. The framework complements, and does not replace, an organization’s risk management process and cybersecurity program. It can be used to leverage current processes and to identify opportunities to strengthen and communicate its management of cybersecurity risk while aligning with industry practices. Additionally, the Framework incorporates international standards and can be voluntarily used in or outside the United States
• #6: The Framework helps guide key decision points about risk management activities through the various levels of an organization from senior execs, to business and process level, to implementation and operations. The executive level communicates the mission priorities, available resources, and overall risk tolerance to the business/process level. The business/process level uses the information as inputs into the risk management process, and then collaborates with the implementation/operations level to communicate business needs and create a Profile. The implementation/operations level communicates the Profile implementation progress to the business/process level. The business/process level uses this information to perform an impact assessment. Business/process level management reports the outcomes of that impact assessment to the executive level to inform the organization’s overall risk management process and to the implementation/operations level for awareness of business impact.
• #7: The Framework provides a common language and systematic methodology for managing cyber risk. The Framework can be tailored to meet each organization’s needs. It does not tell an organization how much cyber risk is tolerable, nor provide “the one and only” formula for cybersecurity. Framework Profiles and Roadmaps can be used as artifacts to easily demonstrate due care for cybersecurity. The Framework Informative References and community published standards mappings can help achieve compliance goals. Enables best practices to become standard practices for everyone via common lexicon to enable action across diverse stakeholders. Communicates cybersecurity requirements with stakeholders, including partners and suppliers Framework profiles and roadmaps are completely customizable by the organization, allowing it to be cost effective for any budget.
• #8: Framework Success Stories summarize why and how organization’s use the Framework, emphasizing the variety of approaches and benefits, typically including lessons results, learned, and next steps.