Analysis of Cybersecurity Standard and Framework Components

Abstract

Satisfactory cybersecurity protection, encompassing all data security solutions, can only be achieved by adopting a cybersecurity framework that provides a structure and methodology for protecting critical digital assets. In addition, security experts recommend using cybersecurity standards which consist of a collection of best practices to protect organizations from cyber threats. However, many organizations, companies and governments lack experienced personnel in the cybersecurity domain, so they have difficulty adopting a standard approach or cybersecurity framework. Protecting organizations from cyber threats while demonstrating compliance with laws and standards is seen as extremely complex due to the difficulty on choosing the appropriate standard to be used. Moreover, lack of knowledge on the elements needed that offered by the standard is lead to the problem on identifying the started point where the protection will be began. Therefore, in this paper, a literature and the analysis is presented in identifying the elements of cybersecurity standard and framework that can be facilitate the organization or government on choosing the appropriate standard and framework to be used and utilized. The literature review was carried out to understand the various types of cybersecurity standards and frameworks and the analysis is conducted to identify the elements in each of them. In this paper, eight steps are presented and include the types of international standards, which are general, local regulation, as well as specific standards used in the industrial sector, to conclude the findings of the analysis. Furthermore, a relation map is presented using Writing a Literature Review release 2.0 approach to show the relationship between the literature review and future research.

The stability of State information in the face of terrorist threats

“…Standardisation of countermeasures and use of cybersecurity standards (Nespoli et al, 2021), (Syafrizal et al, 2020). 2 9 Threat simulation and risk assessment (Välja et al, 2020), (Cascavilla et al, 2021).…”

The impacts of the cyber-trust program on the cybersecurity maturity of government entities in the Kingdom of Bahrain

“…According to the Cambridge (2021) Dictionary, a model is “a simple description of a system, used to explain how something works or calculating what might happen, etc.” According to the US energy sector and the Department of Energy (DOE), usually, the model content represents standards and best practices. Stevanović (2011) Stated that MM is structured with several components that illustrate a particular side of enhancement (maturity) in an organization, which can be used as an assessment tool. US energy sector and the DOE defined the MM as “a set of characteristics, attributes, indicators, or patterns that represent capability and progression in a particular discipline” (C2M2, 2021).…”

“…The hybrid, however, is a combination of both the progression and the MMs (Allen and Mehravari, 2014). In another study by Akinsanya et al (2019), the researchers define the cyber security MM as “a tool that can track improvements made over time from embedding security within an organization’s daily and strategic workflows and between similar organizations in an industry.” There is a big necessity for cybersecurity MMs, which can enable people to better manage organizations (Stevanović, 2011) and assist in evaluating their current procedures for cybersecurity assurance (Payette et al , 2015). Rea-Guaman et al (2017) defined the Cybersecurity MM as a benchmark that helps provide goals and priorities for the future.…”

“…The literature defined cybersecurity standards as a series of technical requirements or best practices usually used to protect organizations' information technology and cyberspace. Cybersecurity standards are highly recommended by Syafrizal et al (2020) to protect organizations against cyber-attacks and threats. There are many information security and cybersecurity standards and frameworks.…”

Developing a simulated intelligent instrument to measure user behavior toward cybersecurity policies

“…Organizations make great efforts to protect their network and information security infrastructure from significant threats and security risks [1,17,18,19]. Concentrating on technical solutions to cybersecurity often fails to acknowledge efficient systems, because users must understand and engage with the network and cybersecurity systems [2].…”