Security Frameworks and Standards

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 65

Learners sort the rules, checks and advice a café deals with by whether it could ignore them, and spot why “we use NIST, so we are certified” is wrong, before the four kinds are named. Predictions then precede why good tools can fail, the cooking cycle, what five basic controls leave out, what “we have IASME” leaves open, five or six NIST Functions and PCI against the law; checks follow GDPR, card payments, a one-office certificate, the PDCA example, CSF mapping and PCI scope. The habit to build: for any name, ask which kind of thing it is, what scope it covers and what evidence shows it is met.

Objectives

• Tell laws, certifiable standards, assessed schemes, voluntary frameworks and contractual standards apart
• Describe an ISMS, ISO/IEC 27001 and ISO/IEC 27002, and the limits of a certificate
• Apply Plan–Do–Check–Act to an improvement
• Describe Cyber Essentials, its Plus level and IASME’s schemes
• Distinguish the NIST CSF versions, PCI DSS and data-protection law

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the GRC, Treating Risk and Security Documentation lessons first.
• Versions change: check the issuing bodies’ pages before the session if you quote an edition.
• The lesson takes about 65 minutes. To teach it in two parts, stop after “Cyber Essentials and Cyber Essentials Plus”; the second part opens with “IASME and its schemes”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Tell laws, certifiable standards, assessed schemes, voluntary frameworks and contractual standards apart
   • Describe an ISMS, ISO/IEC 27001 and ISO/IEC 27002, and the limits of a certificate
   • Apply Plan–Do–Check–Act to an improvement
   • Describe Cyber Essentials, its Plus level and IASME’s schemes
   • Distinguish the NIST CSF versions, PCI DSS and data-protection law

   Purpose: Learners sort the rules, checks and advice a café deals with by whether it could ignore them, and spot why “we use NIST, so we are certified” is wrong, before the four kinds are named. Predictions then precede why good tools can fail, the cooking cycle, what five basic controls leave out, what “we have IASME” leaves open, five or six NIST Functions and PCI against the law; checks follow GDPR, card payments, a one-office certificate, the PDCA example, CSF mapping and PCI scope. The habit to build: for any name, ask which kind of thing it is, what scope it covers and what evidence shows it is met.

2. 1. Rules, checks and advice Think 5 min

   Purpose: Let learners sort a café’s rules, checks and advice into kinds.

   Ask

   • Which could the café ignore?
   • What is wrong with the NIST claim?

   Responses to expect

   • Law and certificates are clear; the voluntary guide is often forgotten.
   • On screen in turns: the opening question, its answer; then the question on a NIST certificate, and its answer.

   Discussion pause: Sort suggestions into four columns before revealing.

   In the lesson window

   • Think it through: Think of a café. List the different kinds of rules, checks and advice it might deal with, and for each say whether the café could choose to ignore it.
   • Think it through: A company says, “We use the NIST framework, so we are certified.” What is wrong?

3. 2. Why they exist Explain 6 min

   Purpose: Name the four kinds, and the contractual standard beside them.

   Ask

   • Which kind is UK GDPR?

   Responses to expect

   • A law.
   • On screen in turns: the opening; then the café’s four kinds, starting with the law; the standard it may choose; the rating; the guide; the same four kinds in security; the check question on UK GDPR, and its answer; a standard imposed by contract; the first question to ask.

   In the lesson window

   • Check your understanding: Which kind of thing is UK GDPR?

4. 3. Framework comparison Explain 3 min

   Purpose: Show the whole lesson on one page.

   Ask

   • Which entry applies to a shop taking cards?

   Responses to expect

   • PCI DSS, through the card industry.
   • On screen in turns: the opening; then the whole lesson on one page, with what each shows held back; what each shows; the check question on taking card payments, and its answer.

   Discussion pause: The “what it shows” column is held back: for each row, ask what a pass or a certificate would prove before revealing it.

   In the lesson window

   • Check your understanding: A small shop starts taking card payments. Which entry in the table now applies to it by contract?

5. 4. Information security management Predict 8 min

   Purpose: Explain the ISMS, ISO/IEC 27001 and 27002, certificate limits and the ISMS loop.

   Ask

   • How can good tools fail?
   • What does a London-only certificate say about Leeds?

   Responses to expect

   • 27001 and 27002 are routinely confused.
   • Diagram: step through the ISMS loop, then follow the school’s access risk round it one stage at a time.
   • On screen in turns: the opening question, its answer; then tools without management; ISO/IEC 27001 and the ISMS; two limits of a certificate, starting with scope; the management system, not a promise; the check question on a one-office certificate, and its answer; ISO/IEC 27002; what an ISMS does, one activity at a time; the diagram’s stages one at a time; the Statement of Applicability and Annex A; one risk round the loop, starting with the assessment; treatment; operation; review; evidence, not documents.

   Misconceptions to challenge

   • A learner may believe: “ISO/IEC 27002 is the certification.” Respond: Organisations are certified against 27001; 27002 is guidance.

   In the lesson window

   • Think it through: An organisation buys excellent security tools but is still badly protected. How could that happen?
   • Check your understanding: A firm’s ISO/IEC 27001 certificate covers its London office only. What does it say about its Leeds warehouse?

6. 5. Plan–Do–Check–Act Predict 8 min

   Purpose: Teach PDCA through cooking, then the worked access-management turn of the cycle.

   Ask

   • What are the four things you do?
   • Which step found the problem?

   Responses to expect

   • Learners often think Do proves success.
   • On screen in turns: the opening question, its answer; then Plan, Do, Check, Act, one stage at a time; do; check; act; one turn of the cycle, starting with Plan; Do; Check; Act; the result; the check question on which step found it, and its answer; PDCA and the documentation lifecycle.

   If the explanation does not land: Use revising for a test: plan topics, revise, take a practice paper, change what you revise.

   In the lesson window

   • Think it through: You are learning to make a new dish. Describe the four things you do, in order, so that it comes out better each time.
   • Check your understanding: In the worked example, which step revealed that three staff still had their old access?

7. 6. Cyber Essentials and Cyber Essentials Plus Predict 5 min

   Purpose: Describe Cyber Essentials, its five areas and the Plus level.

   Ask

   • What does a five-area baseline leave out?

   Responses to expect

   • Management, people, suppliers and recovery.
   • On screen in turns: the opening; then the question on what five areas leave out, and its answer; two levels, starting with Cyber Essentials; Cyber Essentials Plus; more assurance, not a longer list; scope, and what neither level shows.

   Misconceptions to challenge

   • A learner may believe: “Cyber Essentials Plus tests different controls.” Respond: Plus tests the same five areas independently.

   In the lesson window

   • Think it through: Cyber Essentials checks five basic technical areas. What kinds of risk does a list like that leave out?

8. 7. IASME and its schemes Predict 3 min

   Purpose: Separate IASME the organisation from IASME Cyber Assurance.

   Ask

   • What do you ask after “we have IASME”?

   Responses to expect

   • Which scheme, and which level.
   • On screen in turns: the opening question, its answer; then two meanings of IASME, starting with the organisation; IASME Cyber Assurance; ask which scheme and level.

   In the lesson window

   • Think it through: A supplier says, “We have IASME.” What do you still need to ask?

9. 8. NIST Cybersecurity Framework Predict 6 min

   Purpose: Distinguish CSF 1.x’s five Functions from CSF 2.0’s six, and mapping from certification.

   Ask

   • Could five and six both be right?
   • Does mapping certify?

   Responses to expect

   • Govern is the Function people forget.
   • On screen in turns: the opening; then the question on five Functions or six, and its answer; the earlier versions; the current version; check which version is meant; the check question on mapping and certification, and its answer; what mapping does and does not show; where the Functions are taught.

   Misconceptions to challenge

   • A learner may believe: “Mapping to NIST CSF makes us ISO certified.” Respond: Certification needs an audit against the standard itself.

   To go further

   • Why might the authors of CSF 2.0 have made Govern a Function of its own?

   In the lesson window

   • Think it through: One colleague lists the NIST framework’s Functions as five; another lists six. Could both be right?
   • Check your understanding: A company maps its controls to NIST CSF 2.0. Does that make it ISO/IEC 27001 certified?

10. 9. Legal and payment-card obligations Predict 6 min

    Purpose: Explain PCI DSS scope and enforcement, and that data-protection law applies separately.

    Ask

    • Are connected laptops in scope?
    • Does PCI DSS satisfy the law?

    Responses to expect

    • Scope wider than the database surprises many.
    • On screen in turns: the opening; then PCI DSS; the check question on laptops in scope, and its answer; enforced by contract; the question on PCI DSS and the law, and its answer; data-protection law; current versions, and when they were checked; placing a framework quickly.

    Misconceptions to challenge

    • A learner may believe: “PCI DSS stands in for data-protection law.” Respond: It is an industry standard; UK GDPR duties apply separately.

    In the lesson window

    • Check your understanding: A shop’s card database is well protected, but staff laptops on the same network can reach it. Could the laptops be in PCI DSS scope?
    • Think it through: A company fully meets PCI DSS. Has it met its data-protection duties too?

11. 10. Apply it in a new situation Apply 5 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The charity tests choosing a baseline; the review tests Act; the manager tests starting from needs.
    • On screen in turns: the opening; then the question on a charity’s baseline, and its answer; the question on removing accounts without asking why, and its answer; the question on covering everything, and its answer.

    In the lesson window

    • Apply it: A small charity wants to show funders, cheaply and quickly, that it has basic technical security in place. Which would you suggest first?
    • Apply it: An access review finds old accounts still active, and the team removes them. In PDCA terms, what is still missing?
    • Apply it: A manager asks whether to adopt ISO/IEC 27001, Cyber Essentials and NIST CSF “to cover everything”. What is the best first question?

12. 11. Check your understanding Check 6 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The Govern question links to the NIST step.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

13. 12. Revision takeaway Consolidate 4 min

    Purpose: Consolidate the takeaway, the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the four kinds of thing in this lesson.

    Responses to expect

    • Law, certifiable standard, assessed scheme, voluntary framework.
    • On screen in turns: the opening; then what to remember; the key terms; the common misunderstandings.

14. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Ask which kind of thing it is.
    • The ISMS is managed; 27001 certifies it; 27002 advises.
    • Improve by results, then go round again.
    • Cyber Essentials is a baseline; Plus tests it.
    • Frameworks organise, contracts bind, laws apply.

Consolidation

• Ask which kind of thing it is.
• The ISMS is managed; 27001 certifies it; 27002 advises.
• Improve by results, then go round again.
• Cyber Essentials is a baseline; Plus tests it.
• Frameworks organise, contracts bind, laws apply.