US Chamber

Have something special to share?

Redding Chamber of Commerce members can request to share information on the Chamber’s social media pages and via the Chamber’s monthly e-newsletter.

Send us your information and we’ll promote it for you!

Common Cybersecurity Standards and Frameworks for Business

 Two business associates look at a desktop computer monitor and discuss a information technology issue. The man works on the computer while a woman colleagues stands next to him looking at the computer monitor.

Business owners must be more cyber savvy, as they are a common target for hackers. Staying current on cybersecurity standards can help mitigate your risk. — Getty Images/Luis Alvarez

Today’s small business owners need to be increasingly tech savvy to ensure the security of sensitive digital information stored by their businesses. Small businesses are especially vulnerable to cyberattacks due to limited budgets and a potential lack of awareness and preparedness. Staying updated on cybersecurity standards, also known as frameworks, is the best way to avoid dangerous cyberattacks.

[Read more: Protecting Your Business Data in a Hybrid World]

Types of cybersecurity frameworks

Frameworks minimize your risk from cyberattacks and provide guidelines and best practices to limit your exposure to cybercriminals. There are three different types of frameworks. Each one serves a different cybersecurity purpose:

  • Control frameworks are a list of instructions or requirements that an organization can follow to protect its data.
  • Program frameworks focus on training, response planning, analysis, and ongoing monitoring to stay ahead of cyberattacks.
  • Risk frameworks assess the risk an organization has with the aim of identifying weak points that leave an organization vulnerable to potential attacks.

[Read more: How to Protect Your Business From Being Hacked]

Frameworks minimize your risk from cyberattacks and provide guidelines and best practices to limit your exposure to cybercriminals.

The most common cybersecurity standards

There are many unique sets of standards developed by information technology (IT) organizations that address the specific digital security needs of an organization. Some standards are more thorough than others, and it is vital to understand the functions and benefits of each to choose the best option for your business.

The National Institute of Standards and Technology

The National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity protects U. S. infrastructure, such as dams and power plants, from cyberattacks. While the NIST framework is complex, it is also broad, listing how organizations can respond and recover from threats. It focuses on five key functions that are critical to the framework’s success: identify, protect, detect, respond, and recover. The implementation of this framework can involve thousands of working hours and hundreds of pages of instructional documentation.

The Center for Internet Security

The Center for Internet Security (CIS) framework may be the best option for your company if you are starting out with the basics of cybersecurity. It was created to protect companies that do not necessarily need the most robust frameworks for mandatory protocols but want to establish a secure foundation. The framework can also be very effective when paired with an existing standard. CIS uses guidelines known as benchmarks that are divided into two levels: One level is more basic and the second one is more advanced.

The Health Insurance Portability and Accountability Act

The Health Insurance Portability and Accountability Act (HIPAA) is the federally regulated standard that all health care systems, hospitals, qualifying health care providers, and business associates must follow. In short, HIPAA protects the privacy of a patient’s health care information. It is also designed to give patients more rights in what information they choose to share and make it easier to transfer health insurance plans to a new employer. Failure to comply with HIPAA can result in hefty fines and criminal penalties, so it is crucial that systems meet the standards with their security measures and IT teams.

The International Organization for Standardization 27001 and 27002

The International Organization for Standardization (ISO) 27001/27002, or ISO 27K, framework is the international standard used by governments and companies to mitigate cybersecurity risks and manage information. ISO 27001/27002 is mainly used for entities to become certified in the standard and prove they have an ongoing process to ensure all technology is up to date and compliant.

To obtain certification, an organization must prove they are using a PDCA — plan, do, check, act — cycle to implement the standard. An experienced consultant will audit and certify the organization has properly implemented and is managing an information security management system.

The Payment Card Industry Data Security Standard

The Payment Card Industry Data Security Standard (PCI DSS) secures all credit card data and transactions with requirements to combat unauthorized access to customer information. This standard was created by well-known credit card companies like American Express, Visa, and MasterCard. Any business that accepts credit cards or online payments must comply with this standard. Organizations should routinely assess their implementation of PCI DSS to ensure there is no vulnerability that could expose information like names and credit card numbers to cybercriminals.

[Read more: Does Your Small Business Need Cyber Insurance?]

CO— aims to bring you inspiration from leading respected experts. However, before making any business decision, you should consult a professional who can advise you based on your individual situation.

Applications are open for the CO—100! Now is your chance to join an exclusive group of outstanding small businesses. Share your story with us — apply today.

CO—is committed to helping you start, run and grow your small business. Learn more about the benefits of small business membership in the U.S. Chamber of Commerce, here.

Apply for the CO—100!

The CO—100 is an exclusive list of the 100 best and brightest small and mid-sized businesses in America. Enter today to share your story and get recognized.


Stephanie Leader

This post was originally published on this site

Share this article >>
Redding Chamber of Commerce
California Chamber of Commerce
US Chamber of Commerce