The Cyber Risk Handbook

Chapter 6 Standards and Frameworks for Cybersecurity

Stefan A. Deutscher, Principal, Boston Consulting Group (BCG), Berlin Germany William Yin, Senior Partner and Managing Director, Boston Consulting Group (BCG), Hong Kong

As Tom scrambled to put together his board presentation, he had three very practical concerns: First, how to get up to speed quickly, and avoid reinventing the wheel—or just parts of a wheel? Secondly, how to make sure nothing essential was overlooked, so that the wheel (reused or new) kept on turning in the right direction and at the right speed? And third, how to communicate such an elusive topic at the right level of detail, or aggregation, to his target audience—in this case, his supervisory board?

Putting Cybersecurity Standards and Frameworks in Context

There are a multitude of cybersecurity standards in existence today that have been developed by various bodies addressing specific needs, and the list continues to grows, but it is important for an enterprise to identify those that bring the most value to the agenda of organization. More importantly, aligning to the “right” standards help facilitate the sharing and transparency on the most recent cyber attacks within the industry and beyond the internal enterprise.

Diversity as a Blessing and Curse

According to Merriam-Webster’s Dictionary, a framework is “the basic structure of something.” That underlying something can be fairly diverse—for instance, ideas, concepts, guidelines, rules, check lists, ...