Cyber Risk – Choosing the Right Framework

Organizations should manage cybersecurity using a risk-based approach, and adopting a recognized cybersecurity framework creates consistency regardless of whether IT is delivered in-house, by third parties, or via cloud services. Digital transformation increases business dependency on IT, magnifies the impact of cyber incidents, and adds regulatory pressure; consequently, it is no longer a question of if an organization will be targeted, but when. Hybrid IT delivery models intensify governance, assurance, and compliance challenges because responsibilities are shared between service customers and providers, often creating confusion and gaps. Even when large cloud service providers implement strong security controls, ultimate responsibility for data access commonly remains with the customer organization, and many incidents result from user-side failures.

A coherent framework links cybersecurity activities to business objectives, rationalizes the selection of controls and technologies, and enables comparable risk assessment across a mixed estate. An Information Security Management System (ISMS), foundational to ISO/IEC 27001 and defined in ISO/IEC 27000, structures security via six elements: governance, standards, management processes, risk management, controls, and audit. When choosing frameworks, organizations should prioritize capabilities such as a structured approach mapping business objectives to risks, support for key roles via the three lines of defense, a consistent risk-based methodology aligned to enterprise risk appetite, measurable controls, lifecycle coverage from specification to retirement, and monitoring and audit support.

The report compares widely used frameworks (CIS Controls, CSA CCM, COBIT 2019, ISO/IEC 2700x, ITU X.805, NIST CSF, PCI-DSS, SABSA) and positions them by security vs service governance and business vs technology focus to identify overlap and complementarity. Recommended practice is evolutionary: catalogue what is already used and effective, integrate rather than replace where possible, and select a framework that best fits organizational circumstances while complementing existing standards and compliance needs.

• The UK TSB bank’s IT system failures are estimated to have cost a total of £330M for customer compensation, fraud losses, and other expenses.
• GDPR allows penalties for data breaches of up to 4% of an organization’s global annual turnover.
• The UK ICO announced its intention to fine British Airways £183.39m under GDPR for a data breach.
• Norsk Hydro’s ransomware attack affected 22,000 computers across 170 sites in 40 countries.
• Retired workers manually operated Norsk Hydro’s molten metal production lines, preventing destruction of the plants.
• On December 23, 2015, Kyivoblenergo reported electricity service outages affecting approximately 225,000 customers.
• NIST CSF was developed in the USA following Presidential Executive Order 13636 focused on reliable function of national critical infrastructure.
• The NIST CSF organizes cybersecurity activities into five Functions: Identify, Protect, Detect, Respond, and Recover.
• CSA STAR defines three assurance levels: Level 1 self-assessment, Level 2 third-party certification, and Level 3 continuous assessment (not yet available).
• CIS Controls define three Implementation Groups broadly aligned to organizational size: IG1 (tens of employees), IG2 (hundreds), IG3 (thousands).

• “It is now not a question of ‘if’ your organization will be the target of a cyber attack but ‘when’.”
• “In any case the ultimate responsibility for managing access to organizational data usually lies with the user organization and many cyber incidents stem from failures by the service user.”
• “An Information Security Management System (ISMS) provides a systematic and consistent approach to cyber security.”
• “A cyber security framework must cover the complexities introduced by the hybrid IT delivery model.”
• “The framework should provide a logical structure that enables a consistent approach to cyber risk management where IT services are provided by different suppliers using different control sets.”
• “The most practical approach for most organizations will be evolutionary rather that revolutionary since they will already have some structure in place.”
• “Identifying what is in use and what is already working is the essential first step to a structured approach to cyber security.”
• “In most circumstances it is better to make whatever framework your organization is already using work effectively rather that to change.”
• “The most effective approach is to manage cyber security as another business risk.”
• “While many service providers will claim that they follow or adhere to the spirit of standards, best practices and frameworks these claims can only be verified by independent certification / attestation.”