NIST Framework : Guide for SaaS Security Compliance - 3Columns

NIST Framework : Guide for SaaS Security Compliance NIST is the National Institute of Standards and Technology at the U.S. Department of Commerce. The NIST Cybersecurity Framework assists businesses of all sizes in better understanding, managing, and mitigating cybersecurity risk, as well as protecting their networks and data. The Framework is entirely voluntary. It provides an outline of best practices for your business to help you decide where to focus your time and money for cybersecurity protection.

The NIST Cybersecurity Framework (CSF) was first released in 2014 and was most recently updated in 2018.

The framework enables organizations to improve the security and resilience of critical infrastructure with a well-planned and easy-to-use framework.

The continuing growth in SaaS, and the major changes to the work environment due to COVID-19 bring new security challenges. Despite the fact that the CSF was written and updated during the rise of SaaS, it is still geared toward the classic legacy critical infrastructure security challenges. Organizations, on the other hand, can better respond to new risks by adapting the CSF to modern, SaaS-based work environments.

Overview of NIST CSF The NIST CSF lays out five functions of security, then splits them into categories and subcategories. The subcategories contain the actual controls. For each subcategory, the CSF includes a list of cross-references to well-known standards and frameworks such as ISO 27001, COBIT, NIST SP 800-53, and ANSI/ISA-62443.

These cross-references help organizations implement the CSF and map it to other frameworks. For example, security managers or other team members can use the

references to justify their decisions no matter what security standard the company needs to comply with.

In a single document, the Framework combines a host of approaches to dealing with cyber security threats. This includes: -Setting up procedures -Training -Defining roles -Auditing -Monitoring The framework has a five-stage core structure: Identify, Protect, Detect, Respond and Recover.

Identify NIST defines this function as follows: “Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.”

Within this function, NIST includes the following control categories: Asset Management Business Environment Governance Risk Assessment Risk Management Strategy Supply Chain Risk Management.

Protect NIST defines this function as follows: “Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.”

Within this function, NIST includes the following control categories: Access Control Awareness and Training Data Security

Information Protection Processes and Procedures Maintenance Protective Technology

Detect NIST defines this function as follows: “Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event”.

Within this function, NIST includes the following control categories: Anomalies and Events Security Continuous Monitoring Detection Processes

Respond NIST defines this function as follows: “Develop and implement the appropriate activities to take action regarding a detected cybersecurity event”.

Within this function, NIST includes the following control categories: Response Planning Communications Analysis

Mitigation Improvements

Recover NIST defines this function as follows: “Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event”.

Within this function, NIST includes the following control categories: Recovery Planning Improvements Communications How can 3Columns help you in implementing the NIST Cybersecurity Framework ?

If your organization is facing cybersecurity issues , we will not only help you by identifying and fixing the security gaps but along with that will guide you in implementing the NIST Cybersecurity Framework for your organization. Feel free to reach out to our cyber security consultants for a no obligation call. Click here to contact us.