MASS UK Industry Conduct Principles and Code of Practice 2022 (V6)

5. CIS v7
The body responsible for developing and maintaining the CIS v7 framework is the Center for Information Security
(CIS). CIS v7 lists 20 actionable cyber security requirements meant for enhancing the security standards of all
organisations. Most companies perceive the security requirements as best practices since the CIS has a credible
reputation for developing baseline security programs. The framework categorises the information security controls
into three implementation groups. Implementation group 1 is for businesses that have limited cyber security
expertise and resources. Implementation group 2 is for all organisations with moderate technical experience and
resources in implementing the sub controls, whereas implementation group 3 targets companies with vast cyber
security expertise and resources. CIS v7 stands out from the rest since it enables organisations to create budgetfriendly
cyber security programs. It also allows them to prioritise cyber security efforts.
https://www.cisecurity.org/controls/
6. NIST 800-53
NIST created NIST 800-53 publication for enabling federal agencies to realise effective cyber security practices.
The framework focuses on information security requirements designed to enable federal agencies to secure
information and information systems. Besides, NIST 800-53 provides governmental organisations with the
requirements for allowing them to comply with FISMA (Federal Information Security Management Act)
requirements. NIST 800-53 is unique as it contains more than 900 security requirements, making it among the
most complicated frameworks for organisations to implement. The requirements recommended in the framework
include controls for enhancing physical security, penetration testing, guidelines for implementing security
assessments and authorisation policies or procedures, among others. NIST 800-53 is a useful framework for
organisations maintaining federal information systems, companies with systems that interact with federal
information systems, or institutions seeking FISMA compliance.
https://nvd.nist.gov/800-53
7. COBIT
COBIT (Control Objectives for Information and Related Technologies) is a cyber security framework that integrates
a business’s best aspects to its IT security, governance, and management. ISACA (Information Systems Audit
and Control Association) developed and maintains the framework. The COBIT cyber security framework is useful
for companies aiming at improving production quality and at the same time, adhere to enhanced security practices.
The factors that led to the creation of the framework are the necessity to meet all stakeholder cyber security
expectations, end to end procedure controls for enterprises, and the need to develop a single but integrated
security framework.
http://www.isaca.org/cobit/pages/default.aspx
8. COSO
COSO (Committee of Sponsoring Organisations) is a framework that allows organisations to identify and manage
cyber security risks. The core points behind the development of the framework include monitoring, auditing,
reporting, controlling, among others. Also, the framework consists of 17 requirements, which are categorised into
five different categories. The categories are control environment, risk assessments, control activities, information
and communication, and monitoring and controlling. All of the framework’s components collaborate to establish
sound processes for identifying and managing risks. A company using the framework routinely identifies and
assess security risks at all organisational levels, thus improving its cyber security strategies. Also, the framework
recommends communication processes for communicating information risks and security objectives up or down in
an organisation. The framework further allows for continuous monitoring of security events to permit prompt responses.
https://www.coso.org/Pages/default.aspx
9. TC CYBER
The TC CYBER (Technical Committee on Cyber Security) framework was developed to improve the telecommunication
standards across countries located within the European zones. The framework recommends a set of requirements
for improving privacy awareness for individuals or organisations. It focuses on ensuring that organisations and
individuals can enjoy high levels of privacy when using various telecommunication channels. Moreover, the framework
recommends measures for enhancing communication security. Although the framework specifically addresses
telecommunication privacy and security in European zones, other countries around the world also use it.
https://www.etsi.org/cyber-security/tc-cyber-roadmap
10. HITRUST CSF
HITRUST (Health Information Trust Alliance) cyber security framework addresses the various measures for
enhancing security. The framework was developed to cater to the security issues organisations within the health
industry face when managing IT security. This is through providing such institutions with efficient, comprehensive,
and flexible approaches to managing risks and meeting various compliance regulations. In particular, the
framework integrates various compliance regulations for securing personal information. Such include Singapore’s
Personal Data Protection Act and interprets relevant requirement recites from the General Data Protection
Regulation. Also, the HITRUST cyber security framework is regularly revised to ensure it includes data protection
requirements that are specific to the HIPPA regulation.
https://hitrustalliance.net/hitrust-csf/
11. CISQ
CISQ (Consortium for IT Software Quality) provides security standards that developers should maintain when
developing software applications. Additionally, developers use the CISQ standards to measure the size and quality
of a software program. More so, CISQ standards enable software developers to assess the risks and vulnerabilities
present in a completed application or one that is under development. As a result, they can efficiently address all
threats to ensure users access and use secure software applications. The vulnerabilities and exploits which the
Open Web Application Security Project (OWASP), SANS Institute, and CWE (Common Weaknesses Enumeration)
identify forms the basis upon which the CISQ standards are developed and maintained.
https://www.it-cisq.org/
12. Ten Steps to Cyber security
The Ten Steps to Cyber security is an initiative by the UK’s Department for Business. It provides business
executives with a cyber security overview. The framework recognises the importance of providing executives with
knowledge of cyber security issues that impact business development or growth, and the various measures used
to mitigate such problems. This is to enable them to make better-informed management decisions in regards to
organisational cyber security. As such, the framework uses broad descriptions but with lesser technicalities to
explain the various cyber risks, defences, mitigation measures, and solutions, thus enabling a business to employ
a company-wide approach for enhancing cyber security.
https://www.ncsc.gov.uk/collection/10-steps-to-cyber-security.
48
MASS UK Industry Conduct Principles and Code of Practice Version 6
MASS UK Industry Conduct Principles and Code of Practice Version 6 49