COP_2023_V7_pages

automatically. Others are testing and verifying the security configurations of implemented systems and
investigating incidences that can compromise system or network security.
https://www.open-scap.org/features/standards/
20. ANSI
The ANSI (American National Standards Institute) framework contains standards, information, and technical
reports which outline procedures for implementing and maintaining Industrial Automation and Control Systems
(IACS). The framework applies to all organisations that implement or manage IACS systems. The framework
consists of four categories as defined by ANSI. The first category contains foundational information like security
models, terminologies, and concepts. The second category addresses the aspects involved in creating and
maintaining IACS cyber security programs. The third and fourth categories outline requirements for secure system
integration and security requirements for product development, respectively.
https://www.ansi.org/
21. NIST SP 800-12
This framework provides an overview of control and computer security within an organisation. Also, NIST SP 800-12
focuses on the different security controls an organisation can implement to achieve a strengthened cyber security
defence. Although most of the control and security requirements were designed for federal and governmental
agencies, they are highly applicable to private organisations seeking to enhance their cyber security programs. NIST
SP 800-12 enables companies to maintain policies and programs for securing sensitive IT infrastructure and data.
https://csrc.nist.gov/CSRC/media/Publications/sp/800-12/rev-1/draft/documents/sp800_12_r1_draft.pdf
22. NIST SP 800-14
NIST SP 800-14 is a unique publication that provides detailed descriptions of commonly used security principles.
The publication enables organisations to understand all that needs to be included in cyber security policies. As a
result, businesses ensure to develop holistic cyber security programs and policies covering essential data and
systems. Besides, the publications outline specific measures which companies should use to strengthen already
implemented security policies. In total, the NIST SP 800-14 framework describes eight security principles with a
total of 14 cyber security practices.
https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=890092
23. NIST SP 800-26
Whereas the NIST SP 800-14 framework discusses the various security principles used to secure information
and IT assets, NIST SP 800-26 provides guidelines for managing IT security. Implementing security policies alone
cannot enable a company to realise optimum cyber security since they require frequent assessments and
evaluations. For example, the publication contains descriptions for conducting risk assessments and practices
for managing identified risks. It is a highly useful framework that ensures organisations maintain effective cyber
security policies. A combination of different NIST publications can ensure businesses maintain adequate cyber
security programs.
https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01
52 MASS UK Industry Conduct Principles and Code of Practice Version 7