Get your CPA firm aquainted with new FTC rules. The National Institute of Standards and Technology’s (NIST) publications sometimes seem abstract. In particular, the NIST Cybersecurity Framework (CSF). “Framework” sounds so technical. But what is the CSF? Should your company use it? Why should you use it? Are its recommendations required? How can this document from the federal government apply to the real-life cybersecurity of your small to medium-sized business? Read on for the big change to the CSF.
What Is NIST?
NIST (now a part of the U.S. Department of Commerce) was founded in 1901 as one of the U.S. physical science laboratories. Its technology, measurement, and standards are made for everything from smart power grids and electronic health records to nanotechnology, computer chips, and atomic clocks. Its mission is to advance these technologies, measurements, and standards to enhance innovation, competition, and economic security. NIST wants to improve citizens’ quality of life.
But the federal behemoth of agencies and contractors who handle government data must be NIST-compliant. Failing to meet NIST compliance can cost contractors their government contracts.
What is the Cybersecurity Framework?
The CSF is a collection of NIST suggestions agencies and contractors have used to minimize risk. As the Cyber Risk Management podcast noted, CSF version 1 is targeted at critical infrastructure, e.g., transportation, power generation, and hospitals. However, the new guidelines, standards, and best practices in version 2 (the first new version since 2018) are no longer geared toward just infrastructure and provide more guidance to a broader swath of organizations.
Enterprises have used version 1 to minimize their cybersecurity risks like legal, financial, sales, fulfillment, and accounts receivable risks–critical aspects of their business. But now, your small to medium-sized business can also minimize its cyber risk using the framework, closing up the gaps in your cybersecurity.
The framework divides its suggestions into six areas: Govern (new for version 2), Identify, Protect, Detect, Respond, and Recover, and provides 360 examples of its implementation. The new version now includes online tools with more functionality, like browsing related content like NIST publication 800-53, ISO 27001, the Artificial Intelligence Risk Management Framework, and helpful content on privacy.
It’s Not Law – Yet
The CSF is not law, but as the Cyber Risk Management podcast noted, frameworks can eventually become law, e.g., the New York Department of Financial Services cybersecurity rule is based on version 1 of the framework.
The CSF is still a voluntary set of guidelines and best practices designed to help organizations—your small or medium-sized business (SMB)–manage and improve your cybersecurity posture. Just know that the framework is not a list of requirements for you to check off, as are the specific requirements of the Payment Card Industry Data Security Standard (PCI DSS). Your cybersecurity provider must determine how to apply the framework to your organization, prioritize your cybersecurity efforts, and identify and address your security risks. Through this, your business can enhance its cybersecurity posture by reducing the likelihood of cyberattacks and data breaches and protecting your sensitive customer data and company assets.
The Big New Changes: How Can My Business Benefit?
Here’s how the NIST Cybersecurity Framework can now affect SMBs:
Previously, the framework was geared toward the enterprise. The update will now help you determine what your SMB’s vulnerabilities are. Are your cybersecurity controls adequate (your cybersecurity posture)? The CSF will help you prioritize your SMB’s actions based on a risk-based approach. It will help you decide where and how to allocate your staff and resources to manage risk and attain an effective cybersecurity posture.
And to make sure you are on the same page, the framework provides a common language and structure for your staff and cybersecurity provider to better communicate and collaborate. SMBs can also align their practices with the framework and reduce their risk for non-compliance with regulatory requirements.
Your work with third-party vendors and partners will benefit if you adhere to the CSF. You can better assess and manage your cybersecurity risks associated with your vendors and partners, specifically by helping them meet some of their security standards.
How Can It Help My Customers?
So, how can the Cybersecurity Framework help you in your relationships with your customers? Beyond the technical aspects of the framework, demonstrating a commitment to cybersecurity by implementing the CSF can enhance customer trust. If your customers know you seriously protect their data and systems, they will be more likely to trust your business.
You will also gain a competitive advantage by adopting the Cybersecurity Framework. Your small to medium-sized business can stand out by showcasing your commitment to security in a world of rapidly evolving cybersecurity threats.
Now Small Businesses Get Support
Since the NIST Small Business Cybersecurity Act became law in 2018, the organization has been required to provide clear and concise resources to help small and medium-sized businesses identify, assess, manage, and reduce their cybersecurity risks. SMBs have historically not received the same support as larger companies, so the act seeks to close that gap.
NIST consequently provided more resources for SMBs and organizations on its Small Business Cybersecurity Corner website. The (ever-expanding) site offers videos, planning guides, case studies, topical guidance, and other vital information to help small to medium-sized businesses prepare against cybersecurity threats.
When Will It Be In Effect?
Thousands of people have already been involved in the Cybersecurity Framework feedback process, which will close in November, with finalization anticipated by March 31 next year.
Conclusion: You Need Help to Implement It
While the CSF can seem technical, a cybersecurity provider can help your organization implement its recommendations tailored to your needs and resources. Spending to implement sufficient cybersecurity measures aligned with the Cybersecurity Framework can reduce the risk of costly cyberattacks and data breaches on your business. By preparing, you can achieve long-term savings for your small to medium-sized business.
While the National Institute of Standards and Technology Cybersecurity Framework is not a one-size-fits-all solution, it provides a valuable framework for your cybersecurity provider to enhance your cybersecurity efforts and protect your business interests.
If you want to appear above the fray, have a cybersecurity provider use the CSF to develop an incident response plan, which is crucial for effectively responding to and recovering from cyberattacks or data breaches. To know where your vulnerabilities are, try our simple security self-assessment and then schedule your Strategy Session with Tech Kahunas. We will let you know what actions are needed to protect against potential threats.
