Align to a Framework: Plan a Cybersecurity Roadmap's Route

The advantage of aligning your or your customer’s cybersecurity roadmap to a security framework is defining a route to follow using established security best practices. Think of it as referencing guideposts along your cybersecurity journey. They make it easier to reach a secure destination.

It follows that not using a framework to plan out your cybersecurity roadmap can be difficult. The challenge of doing this without a framework is twofold: one, where to start; and two, what to include.

From a starting perspective, a good set of controls may include an implementation guide or provide a best practices document. A number of organizations provide these; other supporting organizations will also contribute in this space. From an inclusion standpoint, this can be very context-dependent for a respective organization, but generally, a set of security best practices from CIS or NIST provide a comprehensive plan that can be applied across multiple industries and businesses.

Without a security framework, you deprive yourself of learning from and applying this group experience to your individual case. Many other organizations are going through the same process you’re going through. This is especially apparent if you’re a consultant. Using their example, you can streamline your own journey so that you avoid certain potholes and smooth out what you can.

Exercising Care When Using a Framework

If you decide to align your cybersecurity roadmap to a security framework, it’s important to keep in mind certain considerations.

The first is applicability to the organization’s mission. Cybersecurity is a business risk and should be seen as such throughout an organization. With this in mind, the management of security controls is context-rich. It’s a process of managing threats and mitigating risks when applying both a best practice and an achievable level of control.

The caveat to this pervious statement is “achievable.” It should be contextualized with respect to the risk an organization faces and the level of control implemented to mitigate the risk.

It also behooves us to think about how much control is needed to manage a risk appropriately. Too much control may inhibit business. This may get us into a situation where we’re dealing with a phenomenon Tony calls the “Fog of More." We’re over-burdened by security tools and technologies such that our ability to manage threats and mitigate risks begins to suffer. On the other hand, too little control may give a false sense of security. We need the right balance.

The Need for Robust Security Frameworks

Given the challenges discussed above, it’s important that you use a robust framework for planning the cybersecurity roadmap's route for yourself or helping your customers come up with a roadmap that works for them. Not all security frameworks are created equally, after all.

Specifically, you can look to the CIS Critical Security Controls (CIS Controls) Navigator and the CIS Community Defense Model (CDM) v2.0. They both use a consensus-based and operational focused-approach that provides actionable controls for organizations to follow.

When introducing CDM v2.0, for instance, Implementation Group 1 (IG1) of the CIS Controls provides the short-term stops on the roadmap for implementation. Aligned with the context of CDM v2.0, organizations can now utilize prioritization of the IG1 Controls based on identified attack patterns against organizations in the same or close to the same industry vertical. What happens is you get to implement Controls in a way that effectively reduces your exposure to common threats.

Here's more information on how you can use the CDM to design a cyber defense program.

 

Meanwhile, the Controls Navigator helps organizations visualize how the CIS Controls map to other security frameworks. In that way, they can use the CIS Controls to decide how best to align their cybersecurity roadmap to a framework.

The CIS Controls, the CIS Controls Navigator, and the CDM are available at no cost to users everywhere. But there’s even more you can do with the CIS Controls via a CIS SecureSuite Membership. It comes with benefits, tools, and resources that you can use to prioritize and track your implementation of our security best practices. This helps you go deeper with your cybersecurity roadmap, all while saving time and effort.

Now through April 30, you can save up to 20% on a new CIS SecureSuite Membership using promo code CYBER2023. Check out our promo terms to learn more.

Simplify Your Use of a Framework

By using a security framework, you can plan out the route for your cybersecurity roadmap according to guideposts that others before you have set. In the process, you’ll be able to make meaningful progress when it comes time to begin implementing your roadmap. Tony will talk about this in our next blog post.

Remember that CIS SecureSuite gives you benefits, resources, and tools to make it even easier for you to make use of a security framework.

---