What Security Framework Should my Business Follow?

February 11, 2021

There are a variety of information security frameworks, controls, and processes. Thus, deciding which one to follow can be a daunting task for businesses. It is important to understand the issue isn’t so much the one you pick, but how effectively you implement it.  A couple of items to consider are:

1. Are there requirements in your industry for specific frameworks, controls, or processes? For example, prime and many subcontractors with Department of Defense contracts will need to obtain the Cybersecurity Maturity Model Certification (CMMC). Other examples are HIPAA in the healthcare industry, PCI if you are storing or processing credit card data, and for the insurance industry, many states are requiring a formal Written Information Security Program (WISP).
2. Do you have a CISO or IT security experts in-house to implement the program and keep abreast of changes? If not, do you have outside consultants to regularly review your and make recommendations to improve your security program?
3. If you developed your own program, are the controls effective in improving your risk posture? Does management regularly review the program? Does it include regular end-user training, given that most bad actors access your data through your employees?

Although it is challenging to select the right security framework, it is a bigger risk to your business if you do not choose any framework. By starting with a quick IT security assessment, Dewpoint experts can help you choose the “right” framework for your business, or if you have a framework in place, compare it to the Center for Internet Security (CIS) or the National Institute of Standards and Technology (NIST) standards to identify areas for improvement. Simple improvements can minimize your business’ vulnerability to attacks. Learn more about Dewpoint’s security solutions by clicking here.