Security Frameworks and Standards

An organisation can buy excellent security tools and still be badly protected, if nobody decides what they are for, who looks after them or whether they are working. An information security management system (ISMS) is the answer to that: the organisation’s whole arrangement of responsibilities, decisions, processes and checks for looking after information. It is a way of managing. It is not a product, and it is not a folder of policies.

ISO/IEC 27001 is the international standard that says what an ISMS must include. It is published jointly by two bodies, the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). An organisation can be audited against it and certified.

Two limits matter when reading a certificate.

• It covers a scope that the organisation chose, perhaps one office or one service. It is not a statement about everything the organisation does.
• It certifies the management system. It is not a promise that no attack will succeed.

ISO/IEC 27002 is its companion. It is a book of guidance about individual controls: what each is for and how to go about it. Nobody is certified against it. The usual confusion is to mix the two up: 27001 is the requirements and the certificate, and 27002 is the advice.

The diagram shows what an ISMS does, as a loop.

The third stage mentions the Statement of Applicability, and the list of reference controls it is checked against, Annex A. Security Documentation works through an example of one.

From risk to evidence and review

Follow one risk round the loop. A fictional school notices that staff keep access they no longer need after changing role.

1. Risk assessment. How many accounts are affected, and what could someone do with the extra access?
2. Treatment. The school chooses three controls: access must be approved, removed on a role change and reviewed each half term.
3. Operation. Named people carry those out and keep the approvals and review results.
4. Review. Senior managers look at the evidence. Is it working? Does it need more resources? Has anything changed?

A procedure existing does not show that every account follows it, which is why step 4 looks at evidence and not at documents. Risk explains why a control has to be shown to work before the risk is counted as reduced.

Underneath the ISMS loop is a simpler idea that applies to improving anything: Plan, Do, Check, Act, shortened to PDCA. Anyone who has learned to cook has used it. You decide what to make (plan), make it (do), taste it (check) and adjust the recipe for next time (act).

Worked access-management improvement

The documentation lifecycle keeps the written instructions up to date. PDCA is wider: it judges the whole process by its results.

It comes at two levels.

• Cyber Essentials is a verified self-assessment: the organisation answers a questionnaire about the five areas, and an assessor checks the answers.
• Cyber Essentials Plus covers the same five areas and adds independent technical testing of them. The self-assessment has to be passed first.

Plus is therefore more assurance about the same five things, not a different or longer list. See the NCSC overview and IASME’s assessment explanation.

As with ISO/IEC 27001, the certificate covers a stated scope, and neither level shows that an organisation is free of malicious software or of weaknesses. GRC explains the difference between passing an assessment and being secure.

IASME is easy to misread, because the name is used for two different things.

• IASME is an organisation. It runs Cyber Essentials on the NCSC’s behalf, as its Delivery Partner.
• IASME Cyber Assurance is a separate scheme of IASME’s own. It goes wider than Cyber Essentials, covering how security is managed, including risk management, staff awareness and keeping the organisation running after an incident. It has two levels: Level One is a verified self-assessment and Level Two is an independent audit. The IASME Cyber Assurance overview explains the current arrangements.

So “we have IASME” is not a complete statement. Ask which scheme, and at which level.

Earlier versions, 1.0 and 1.1: five Functions in the sequence Identify → Protect → Detect → Respond → Recover. It is useful for gap assessments, which compare “where are we now?” with “where should we be?”.

Current version: NIST CSF 2.0, with six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added to make direction, oversight and risk decisions explicit across the other five. NIST’s CSF 2.0 release explanation describes the change, and NIST’s framework guidance explains the structure.

The five-function list is not wrong; it describes the earlier version. When a document or a colleague refers to NIST CSF, check which version is meant.

Lining up the CSF with another standard can help to coordinate work. It does not show that the other standard is met, and it does not confer ISO certification.

The NIST Cybersecurity Framework teaches each of the six Functions from the beginning, with examples, and Gap Analysis teaches the comparison of current and desired outcomes.

PCI DSS, the Payment Card Industry Data Security Standard, is a set of security requirements written by the card companies through a body they set up, the PCI Security Standards Council (PCI SSC). It applies to any organisation that stores, handles or sends payment-card details, and also to anything connected to those systems that could affect their security. That second part surprises people: the scope is wider than the database where the card numbers sit. The PCI SSC overview explains the standard.

PCI DSS is enforced through contracts with the card industry, not by statute. How an organisation has to prove that it meets the standard depends on its size and how it takes payments.

Data-protection law is statute: UK GDPR and the Data Protection Act 2018. It applies to personal information whether or not any card is involved, and meeting PCI DSS does not satisfy it. Data Protection: UK GDPR and the DPA 2018 is the lesson on that subject, and the ICO’s guidance is the authoritative source.