03. Frameworks and Maturity

Business Needs¶

Organizations require structured approaches to manage security, compliance, and risk. These needs drive the adoption of frameworks.

Explanation
Businesses must protect data, ensure compliance, and manage risks efficiently. Without structure, security becomes inconsistent.

Example
A company handling customer data implements security policies to avoid data breaches and legal penalties.

Frameworks¶

Frameworks provide standardized guidelines and best practices for implementing security and governance.

Explanation
They act as a blueprint to design, implement, and manage security controls.

Example
Using a framework like ISO 27001, a company defines policies, controls, and procedures for securing information.

Common Security Frameworks¶

As shown in the document (page 5), major frameworks include ISO/IEC 27000, COBIT, NIST, CIS, CMMC, and ASD.

ISO/IEC 27000 Series¶

Explanation
A globally recognized standard for Information Security Management Systems (ISMS). It is broad and applies to all organizations.

Key Parts

ISO 27001 → Requirements for ISMS
ISO 27002 → Security controls and best practices

Example
A bank uses ISO 27001 to implement access control, encryption, and risk management policies.

Explanation
A framework for IT governance and management, focusing on aligning IT with business goals.

Example
An enterprise uses COBIT to ensure IT investments support business strategy and reduce operational risks.

NIST SP 800-53¶

Explanation
A catalog of security and privacy controls used mainly by U.S. federal systems.

Example
A government agency applies NIST controls like access control, incident response, and auditing.

CIS Controls¶

Explanation
A set of 18 prioritized security controls designed to prevent common cyber-attacks.

Example
Implementing CIS Control 1 (Inventory of Assets) helps track all devices in a network to prevent unauthorized access.

CMMC (Cybersecurity Maturity Model Certification)¶

Explanation
A certification model used in the U.S. Defense Industrial Base to assess cybersecurity maturity across 5 levels.

Levels Overview (from diagram on page 12)

Level 1 → Basic hygiene
Level 2 → Documented
Level 3 → Managed
Level 4 → Reviewed
Level 5 → Optimizing

Example
A defense contractor must achieve a required CMMC level to work with the Department of Defense.

ASD Essential Eight¶

Explanation
A security framework developed by the Australian Cyber Security Centre focusing on 8 critical controls.

Controls (from page 14 image)

Application control
Patch applications
Configure macros
User application hardening
Restrict admin privileges
Patch OS
Multi-factor authentication
Daily backups

Example
A company enables MFA and regular patching to reduce ransomware attacks.

Maturity Models¶

Frameworks often include maturity levels to measure how well security practices are implemented.

Explanation
Maturity models help organizations understand their current security posture and improve over time.

Example
An organization at Level 1 may have basic controls, while Level 5 continuously improves and optimizes security.

Why Frameworks Matter¶

Explanation
Frameworks provide structure, consistency, and measurable security improvements.

Example
Without a framework → random security practices
With a framework → standardized, auditable, and scalable security

Implementation Concept¶

As indicated in the final slide (page 17: "How to implement?"), implementation involves adopting a framework and aligning it with business needs.

Basic Steps

Identify business requirements
Choose appropriate framework
Implement controls
Monitor and audit
Improve maturity level

Example
A startup adopts CIS Controls first, then gradually moves toward ISO 27001 certification as it grows.