Cybersecurity Maturity Models
HC3 Intelligence Briefing Cybersecurity Maturity Models
08/06/2020
Report #: 202008061030
Agenda
? Executive Summary
? Background ? What is Cybersecurity Maturity Model(CMM) ? History of CMM ? Why use CMM ? How to use CMM
? Notable Cybersecurity Maturity Models ? Cybersecurity Capability Maturity Model (C2M2) ? NIST Cybersecurity Framework ? Cybersecurity Maturity Model Certification
? How can CMM be used to protect the Health/Public Health Sector ? Using CMMs to provide customer with continuous service ? Using CMMs to protect sensitive information ? Using CMMs to comply with laws and regulations
Slides Key:
Non-Technical: managerial, strategic and high-level (general audience)
Technical: Tactical / IOCs; requiring in-depth knowledge (sysadmins, IRT)
TLP: WHITE, ID# 202008061030 2
Executive Summary
? Cybersecurity Maturity Models: ? Attempt to collect the best cybersecurity practices; ? Are developed by a collaboration of experts from diverse backgrounds; ? Consider the dispersion in size, knowledge, skills, abilities, and experience of organizations that will use the model; ? Take a life cycle and continuous improvement approach to cybersecurity
? Cybersecurity Models help organizations ? Provide services for their customers without interruption; ? Protect sensitive customer and proprietary information; and ? Comply with laws and regulations that govern their operations.
TLP: WHITE, ID# 202008061030
3
Cybersecurity Maturity Model
? Provides a structure for organizations to baseline current capabilities in cybersecurity workforce planning, establishing a foundation for consistent evaluation
? Management tool for leadership in identifying opportunities for growth and evolution
NICCS (2014)
Optimizing Managed/Review Defined/Maintenance
Developing Initial
TLP: WHITE, ID# 202008061030
4
Maturity Model History
1986 Capabilities
Maturity Model (CMM)
2012 Cybersecurity
Capability Maturity Model (C2M2)
2020 Cybersecurity
Maturity Model Certification (CMMC)
2006 Capability Maturity
Model Integration
(CMMI)
2013
NIST Cybersecurity
Framework (CSF)
TLP: WHITE, ID# 202008061030
5
Why do you need a Cybersecurity Maturity Model
Help CISOs to communicate
security to Board
Provide current security posture
Benchmarking against industry
NICCS (2014)
Security strategy and
roadmap
Balancing cyber security
portfolio
Help in optimizing
security investments
TLP: WHITE, ID# 202008061030
6
How to use a Cybersecurity Maturity Model
ACT
? Develop lessons learned
? Establish baselines, ? Make adjustments as
needed ? Continue cycle again
Plan
? Select Cybersecurity Maturity Model or Framework
? Identify Assessment Tool
? Conduct Security Assessment
NICCS (2014) Demming, E. W. (1982)
Check
? Verify the Security Controls
? Self-Assessment ? Third Party
verification
Do
? Implement Security Controls
? Develop Policies ? Conduct training
TLP: WHITE, ID# 202008061030
7
Notable Cybersecurity Maturity Models
Cybersecurity Capabilities Maturity NIST Cybersecurity Framework
Model (C2M2)
(CSF)
DOD Cybersecurity Maturity Model Certification
? Developed in 2012, updated in 2014 and 2019.
? Developed collaboratively with an industry advisory group from government, Industry, and academia led by the Department of Energy in partnership with the Department of Homeland Security.
? Derived from cybersecurity best practices from government and industry.
? Originally developed for critical infrastructure but updated to be applied to all sectors with information and operations technology. [1]
? Published first in 2014. Updated in ? Created in 2019 and updated in
2017 and 2018.
2020.
? Collaborative effort of industry,
? Developed in concert with
academia, and government
Department of Defense
coordinated by the National
stakeholders, University Affiliated
Institute of Standards and
Researchers, Federally Funded
Technology (NIST).
Research Centers, and the
? Mandated by the Cybersecurity
Defense Industrial Base and led
Enhancement Act of 2014 (CEA).
by the Office of the Under
? Brings best practices from industry
Secretary of Defense for
and government but practices are
Acquisition and Sustainment.
derived directly from NIST 800-53, ? From NIST SP 800-171, Security
Security and Privacy Controls for
Requirements for Controlled
Federal Information Systems and
Unclassified Information, and the
Organizations, April 2013.
Defense Acquisition Supplement.
? Developed to improve
? For Defense Industrial Base
cybersecurity risk management for
Contractors and will require a
critical infrastructure but can be
third- party certification. [3]
used by any sector or community.
[2]
[1] Department of Energy (n.d.) [2] NIST (n.d.) [3] CMMC (2020)
TLP: WHITE, ID# 202008061030
8
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- paper open access information technology models for the adaptation of
- review of technology adoption models and theories to measure readiness
- analysis of information technology and business model alignment
- theories of ict system tkk
- model of information and communication technology ict acceptance and
- next gen it operating model
- models of technology diffusion cepr
- technology reference model framework high level overview oregon
- information technology acceptance models into practice an kau
- literature review of information technology adoption models at firm level
Related searches
- nist cybersecurity risk assessment template
- cybersecurity resources for small businesses
- best cybersecurity stocks to buy
- cybersecurity policy for small business
- cybersecurity risk assessment template
- cybersecurity for businesses
- cybersecurity policy and procedures
- cybersecurity protection small business
- small business cybersecurity act
- privileged user cybersecurity responsibility
- cybersecurity architect
- cybersecurity position descriptions