The NIST CSF can help small businesses evaluate their cyber security risks and develop or improve their defenses

Last week, the NIST Small Business Cybersecurity Act (S. 770) passed the U.S. Senate and was sent to the White House, where the president is expected to sign it into law shortly. The bipartisan measure directs NIST to provide resources to small businesses to help them implement the NIST Cybersecurity Framework (aka the NIST CSF) and to keep the needs of small enterprises in mind when developing future standards.

The law does not require businesses to use the NIST CSF; it simply provides government resources to help small businesses implement it. This article will explain what the NIST CSF is and the benefits of using it to secure your small business’ systems and data.

What Is the NIST CSF?

The NIST CSF is based on NIST 800-53, which mandates security requirements for federal government IT systems. The NIST CSF is far more concise and uses less technical language. It provides guidance to organizations, based on existing standards, guidelines, and practices, to better manage and reduce their cyber security risk. It also encourages communications about risk and cybersecurity management among internal and external organizational stakeholders.

The most recent version of the NIST CSF, v. 1.1, was released in April 2018. It includes updates on authentication and identity, IoT risks, self-assessing cyber security risk, managing cyber security within the supply chain, and vulnerability disclosure.

The NIST CSF consists of three main components: the Core, Implementation Tiers, and Profiles. These are further broken down into five “functions” – Identify, Protect, Detect, Respond, and Recover – which are subdivided into 22 “categories” outlining cyber security outcomes and security controls.

It is important to note that the NIST CSF was designed to complement, not replace, enterprise cybersecurity programs and risk management processes. It helps enterprises identify areas where existing security processes may be strengthened or where new processes can be implemented.

Who Should Use the NIST CSF?

The NIST CSF was originally designed for companies that are part of the nation’s critical infrastructure, such as energy and water utilities, transportation, financial services, communications, healthcare and public health, food and agriculture, chemical and other facilities, dams, key manufacturers, and emergency services. However, a wide variety of private and public-sector enterprises utilize it. It is inherently versatile and scalable, and it can be customized for use by organizations of all sizes, in all sectors, whether they are just developing a cyber security program or have had one in place for some time.

Why Should an Organization Use the NIST CSF?

There are numerous benefits to using the NIST CSF.

• Currently, there is no federal cyber security law that all organizations can turn to when developing their cyber security programs. Instead, they must reconcile their efforts with numerous industry regulations, standards, and state laws. The NIST CSF provides a consistent, universal set of standards that any organization can use to evaluate their risk levels and determine appropriate cyber security controls.
• The NIST CSF is flexible and scalable. It focuses on outcomes, not specific procedures. Regardless of their industry or size, organizations can achieve these outcomes in a way that is feasible for them, and they can continue using the framework as they expand.
• The NIST CSF lays the foundation for compliance with other common standards and regulations, such as HIPAA, FISMA, and SOX.
• Because it is written in plain language, many enterprises use it to obtain security buy-in from internal decision-makers, external partners, and suppliers who do not have technical backgrounds.

Using the proprietary Continuum GRC IT Audit Machine (ITAM), Lazarus Alliance can help your organization use the NIST CSF to evaluate your cyber security risks, develop new defenses or strengthen existing ones, and ensure that your organization is secure and compliant with any other applicable industry standards or regulations.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.