Compliance by Design

Designing Cybersecurity for Compliance Simplicity

Security Standards – What are they and why they matter

Security standards are sets of guidelines, best practices, and requirements that help organizations manage and reduce their cybersecurity risks. Security standards can be developed by various entities such as governments, industry associations, or international organizations. Security standards can also be used as a basis for compliance audits or certifications that demonstrate an organization’s adherence to a certain level of security.

We can help you with security standards by:

• Helping you understand the security standards that apply to your industry or customers

• Helping you select the most appropriate security standards for your organization’s needs and goals

• Helping you implement the security standards in your organization’s policies, processes, and systems

• Helping you prepare for and pass security audits or certifications based on the security standards

• Helping you maintain and improve your security posture according to the security standards

Some of the security standards that we work with include:

• ISO 27001: This is an international standard that specifies the requirements for an information security management system (ISMS). An ISMS is a framework that helps you manage the security of your information assets in a systematic and consistent way. ISO 27001 covers all aspects of information security, such as risk assessment, policy development, control implementation, monitoring, review, and improvement.

• PCI DSS: This is a standard that applies to any organization that processes, stores, or transmits credit card data. It covers six domains of security such as network security, data protection, vulnerability management, access control, monitoring and testing, and information security policy.

• HIPAA: This is a federal law that protects the privacy and security of health information. It covers four rules such as privacy rule, security rule, breach notification rule, and enforcement rule.

• CMMC: This is a new certification program that applies to any organization that works with the DoD. The CMMC aims to ensure that the DoD’s supply chain is secure from cyber threats and covers the spectrum basic hygiene to advanced practices.  Due to concerns regarding implementation cost to SMBs at the mid and high level, the CMMC framework has undergone multiple revisions over the last 3 years with the current set of guidelines slated for implementation this summer. 

  • One thing is certain, CMMC will be required for all government contract work, the only questions are when and exactly what requirements are needed for your organization. 

  • Overall the meat of the program has remained unchanged, and anyone who has already done an assessment to a prior version of CMMC will have the majority of the work completed to be in compliance, or will already be in compliance with the pending version.  This means that will be able to immediately accept work upon approval of CMMC.

  • CMMC classifies a company into different maturity levels based on your organization’s implementation of controls across a number of security domains.  Each CMMC level unlocks additional work for your organization, while prohibiting organizations that have not shown enough adherence to security principles.  Given the flow down requirements of CMMC, all sub-contractors will be required to meet various CMMC levels.

  • The CMMC domains cover areas like access control, asset management, audit and accountability, awareness and training, configuration management, identification and authentication, incident response, maintenance, media protection, personnel security, physical protection, recovery, risk management, security assessment, situational awareness, system and communications protection, and system and information integrity.

We can help you with CMMC by:

• Helping you understand the CMMC requirements and expectations for your organization

• Helping you determine your current CMMC maturity level and identify any gaps or weaknesses

• Helping you implement the CMMC practices and processes in your organization

• Helping you prepare for and pass the CMMC audit by a certified third-party assessor

• NIST Cybersecurity Framework: This is a voluntary framework that helps organizations manage and reduce their cybersecurity risks. The framework is based on existing standards, guidelines, and practices from various sources. The framework provides a common language and structure for organizations to assess their current cybersecurity posture, identify their goals and priorities, and implement and monitor their cybersecurity activities. The framework consists of five core functions: Identify, Protect, Detect, Respond, and Recover. Each function has a number of categories and subcategories that describe specific cybersecurity outcomes and activities.

  • Many of the principles in NIST are included in the CMMC framework​