The newest version of the NIST Cybersecurity Framework describes a risk-based methodology for organizations, primarily businesses, to mitigate the potential harms and hazards of doing business online.
It is designed to work for organizations of any size, scope, or industry.
It is scalable, customizable, and well-suited for today’s data security needs.
The new framework has been in the making since the original was released in 2014, and it will have been officially launched at the start of November 2023.
Though it represents a dramatic enhancement of the original framework and is likely a significant departure from common cybersecurity measures, it is not intended nor does it need to be, a replacement for your company’s current cybersecurity risk management methodology.
It can replace it if you wish, but it is most likely best onboarded as a supplement for what you are currently doing to protect sensitive data.
Perhaps most noteworthy about the program is its ability to create a common cybersecurity language that will be usable and understandable to executives, entry-level employees, and everyone in between.
It is expected to empower IT personnel and enhance their problem-solving capabilities while bringing executives into the conversation.
Most importantly, it will enable you to share a common cybersecurity language with your peers and enhance your ability to share and create new security solutions.
Cybersecurity Governance for Small Businesses in Pennsylvania
Arguably, organizations with the most to lose are small to medium-sized businesses (SMBs) in Pennsylvania.
For-profit organizations of this scale and region are under especially pointed threat from bad actors online for several reasons.
These reasons include a legal climate where government protections for SMBs are inadequate.
The success rate of entrepreneurs in this part of the country is another reason for the localized nature of the threat.
The good news is that NIST 2.0 stands to benefit SMBs more than any other type of organization.
This is because bad actors on the Internet tend to target unprotected victims more than any other.
By implementing the new NIST Cybersecurity Framework, you can create an imposing security profile for hackers that will discourage them in
many cases.
Govern Function of the NIST Cybersecurity Framework
NIST 2.0 accomplished all of this largely through its governance or “govern” function.
This is because collaboration and organization are key to making it work.
Technically, NIST has five functions, namely; Identify, Protect, Detect, Respond, and Recover.
The Govern function encompasses all of these.
As the overriding operating principle of NIST 2.0, understanding it is key to making the system work for your organization.
This function encompasses the people, technology, and processes in your organization as they relate to cybersecurity and its purpose is to enhance coordination and collaboration in cyber threat mitigation.
This could well mean that it will have a direct impact on all the people, information tech, and processes in your business, or it may only involve some of each.
The nature of the govern function is that it is made up of all the functions of NIST 2.0. It also has a cross-cutting nature within any organization that deploys it.
Understanding the govern function of the framework is a bit like understanding the table of contents in a book. It will give you a quick reference guide to parts of the whole, and it will give you an overriding comprehension of the framework, its nature, processes, and purpose.
Governance: The Cornerstone Of Cybersecurity
Anyone who understands the nature of modern cyber threats knows that what is needed to mitigate threats is a coordinated, concerted, and lock-step approach to cybersecurity.
This becomes especially apparent when we consider cultural attacks against sensitive information.
Mitigating cultural threats requires every employee to have an information-security mindset, often referred to as a corporate culture of data security.
Naturally, cohesive governance is the only way to achieve this across an organization, and this is a big part of what NIST 2.0 does.
The purpose of governance in general is to create a functioning and cohesive organizational structure and to maintain it.
To understand this, we might consider the rules of the road around an intersection. In that context, traffic cannot move safely or efficiently unless everyone applies the same rules in the same way every time.
A driver needs to know when the car to his left will stop when it will proceed, and in which direction.
Short of this, collisions are inevitable.
In the same way, the govern function of NIST 2.0 makes it so that when one individual or component in an organization encounters a given cybersecurity issue, another person in that organization or a similar one will know how that person or component will behave.
Another way of saying it is that it creates uniformity of behavior so that solutions become scalable, and focused, and so that your security profile forms a consistent, united front against threats.
When your cybersecurity tool set can be described this way, you will be able to incorporate cybersecurity into broader enterprise risk management strategies, making your efforts more effective, powerful, and valuable.
Understanding the Organizational Context Of Cybersecurity
Cybersecurity is important for everyone.
Even an individual with one source of income has information online connected to personal data, payment information, and more.
If such an individual suffers a successful cyber attack, her or his situation could be dire.
However, if an organization suffers a successful attack, many people can be harmed.
What’s more, businesses that handle the payment data of customers online are at risk of having their bottom line damaged, their reputation degraded, and may even face legal repercussions.
For these reasons, your organization must recognize its specific cybersecurity needs and likely threats.
To fall short of this is to endanger everyone associated with your business.
The NIST 2.0 Framework is designed to be customizable, allowing you to use its guidance in a way that works best for your industry, business model, and the people you serve.
Establishing A Cybersecurity Strategy For Your Small Business
One of the interesting features of the new NIST framework is how closely it adheres to well-known and understood cybersecurity best practices.
Of course, this makes a lot of sense when you consider the fact that people trying to achieve a common goal are likely to develop similar means of achieving it.
That being said, Jeremiah Talamantes, cybersecurity consultant for Microsoft wrote this data security outline back in August.
- Conduct a risk assessment
- Select a security framework
- Develop a security risk management plan
- Create security policies and controls
- Secure the network
- Secure your data
This is a fairly standard plan for securing the data of any organization.
If you’ve been following our work on the new NIST framework, you will have noticed that it agrees with its guidance almost completely.
A plan like this could easily be used parallel to following the framework as NIST guidance is designed to be customizable.
What’s most important to remember about this or any other organizational cybersecurity plan, is to identify, plan for, and respond to the threats that are most relevant for your business.
This is at the heart of the framework, and working closely with a cybersecurity IT consultant may be the best way to fill this need.
Cybersecurity governance for small businesses in Pennsylvania is an indispensable part of protecting your data in this region.
Integrating the govern function will happen naturally when you learn, follow, and enforce the other functions of the framework.
That means you don’t have much to worry about as long as you follow NIST’s best practices.
After all, that is what the framework is all about.
Sources:
- https://www.comparitech.com/data-privacy-management/nist-cybersecurity-framework/
- https://csrc.nist.gov/News/2023/nist-releases-cybersecurity-framework-2-0-draft
- https://www.nist.gov/cyberframework/online-learning/five-functions
- https://caveonix.com/blog/nist-csf-understanding-the-govern-function
- https://www.linkedin.com/pulse/crafting-cybersecurity-plan-simple-guide-small-jeremiah-talamantes/
Recent Comments