Understanding Cybersecurity Frameworks and Information Security Standards—A Review and Comprehensive Overview

Abstract

Businesses are reliant on data to survive in the competitive market, and data is constantly in danger of loss or theft. Loss of valuable data leads to negative consequences for both individuals and organizations. Cybersecurity is the process of protecting sensitive data from damage or theft. To successfully achieve the objectives of implementing cybersecurity at different levels, a range of procedures and standards should be followed. Cybersecurity standards determine the requirements that an organization should follow to achieve cybersecurity objectives and facilitate against cybercrimes. Cybersecurity standards demonstrate whether an information system can meet security requirements through a range of best practices and procedures. A range of standards has been established by various organizations to be employed in information systems of different sizes and types. However, it is challenging for businesses to adopt the standard that is the most appropriate based on their cybersecurity demands. Reviewing the experiences of other businesses in the industry helps organizations to adopt the most relevant cybersecurity standards and frameworks. This study presents a narrative review of the most frequently used cybersecurity standards and frameworks based on existing papers in the cybersecurity field and applications of these cybersecurity standards and frameworks in various fields to help organizations select the cybersecurity standard or framework that best fits their cybersecurity requirements.

Building a thematic framework of cybersecurity: a systematic literature review approach

“…(2022) suggest that staff training should be implemented to achieve human-centric cybersecurity. Szczepaniuk and Szczepaniuk (2022) found that knowledge gained during training or courses can positively influence employees’ behaviors and attitudes toward data protection and privacy.…”

“…In response to the challenges posed by cybersecurity, numerous open standards and frameworks such as the ISO/IEC 27000, The National Institute for Standards and Technology's (NIST) Risk Management Framework, ISF SoGP, COBIT, and more were established to address a wide range of security concerns and have been widely adopted by organizations (Taherdoost, 2022). The White House has also recently introduced its 2023 national cybersecurity strategy, which aims to enhance cybersecurity practices in critical industries by enforcing regulations (Collier, 2023).…”

Information Security and Privacy in Railway Transportation: A Systematic Review

“…Although the stakeholders are not obliged to implement all the measures on the list (which will vary depending on the case), they will be requested to comply with national guidelines and regulations. Related to the railway sector also is that [ 74 ] provides a comprehensive review to help the industry adopt the appropriate standard or framework based on the cybersecurity requirements.…”

Advancing Wearable Biosensors for Congenital Heart Disease: Patient and Clinician Perspectives: A Science Advisory From the American Heart Association

“…Wearables often collect and transmit sensitive health data, which may include personally identifiable information, and transaction standards are under development. 46 Robust privacy regulations for protection of privacy of children and infants are essential to ensure data collected are used responsibly and securely.…”