COP_2023_V7_pages

2. NIST Cyber security Framework
NIST (The US National Institute of Standards and Technology) is part of the U.S. Department of Commerce.
The NIST Cyber security Framework was developed to respond to the presidential Executive Order 13636.
The executive order purpose to enhance the security of the country’s critical infrastructure, thus protecting them
from internal and external attacks. Although the design of the framework aims at securing critical infrastructures,
private organisations implement it to strengthen their cyber defenses. NIST CSF describes five functions that
manage the risks to data and information security. The functions are: identify; protect; detect; respond; and recover.
n The identify function guides organisations in detecting security risks to asset management, business
environment, and IT governance through comprehensive risk assessment and management processes.
n The detect function defines security controls for protecting data and information systems. These include
access control, training and awareness, data security, procedures for information protection, and maintaining
protective technologies.
n Detect provides guidelines for detecting anomalies in security, monitoring systems, and networks to uncover
security incidences, among others.
n The response function includes recommendations for planning responses to security events, mitigation
procedures, communication processes during a response, and activities for improving security resiliency.
n The recovery function provides guidelines that a company can use to recover from attacks.
https://www.nist.gov/cyberframework
3. IASME Governance
IASME governance refers to cyber security standards designed to enable small and medium-sized enterprises
to realise adequate information assurance. The IASME governance outlines a criterion in which a business can
be certified as having implemented the relevant cyber security measures. The standard enables companies to
demonstrate to new or existing customers their readiness in protecting business or personal data. In short, it is
used to accredit a business’s cyber security posture. The IASME governance accreditation is similar to that of an
ISO 27001 certification. However, implementing and maintaining the standard comes with reduced costs,
administrative overheads, and complexities. IASME standards certification includes free cyber security insurance
for businesses operating within the UK.
https://www.iasme.co.uk/audited-iasme-governance/
4. SOC 2
The American Institute of Certified Public Accountants (AICPA) developed the SOC 2 framework. The framework
purpose to enable organisations that collect and store personal customer information in cloud services to maintain
proper security. Also, the framework provides SaaS companies with guidelines and requirements for mitigating
data breach risks and for strengthening their cyber security postures. Also, the SOC 2 framework details the
security requirements which vendors and third parties must conform. The requirements guide them in conducting
both external and internal threat analysis to identify potential cyber security threats. SOC 2 contains a total of 61
compliance requirements, and this makes it among the most challenging frameworks to implement. The
requirements include guidelines for destroying confidential information, monitoring systems for security anomalies,
procedures for responding to security events, internal communication guidelines, among others.
https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/aicpasoc2report.html
MASS UK Industry Conduct Principles and Code of Practice Version 7 47