Customer Service:
Mon - Fri: 8:30 am - 6 pm EST

The Financial Management of Cyber Risk

The Financial Management of Cyber Risk

IDSP Workshop Report
Measuring Identity Theft

Published by the Internet Security Alliance (ISA) and the American National Standards Institute (ANSI)

Download your free copy

Registration is required for new users.

The Financial Management of Cyber Risk introduces a new framework for managing and reducing the financial risk related to cyber attacks, which threaten businesses, national security, and the international community.

The 76-page document offers a pragmatic action plan that addresses cybersecurity from an enterprise-wide perspective. Developed by a task force of more than sixty industry and government experts, The Financial Management of Cyber Risk: An Implementation Framework for CFOs has been funded and managed by the private sector and is offered as a free resource on cyber risk mitigation for organizations across the country.

Applicable Standards, Frameworks and Guidance Documents

The following list of standards and reference documents is included in Chapter 4 Appendix of The Financial Management of Cyber Risk: An Implementation Guide for CFO’s.

1 ISO/IEC 27001 and 27002 IT Security Techniques Package
The ISO/IEC 27001 and 27002 IT Security Techniques Package provides the requirements and code of practice to initiate, implement, maintain and improve an information security management system in any size organization. This package helps to identify an organization's security requirements, risks and selecting controls for the requirements and risks using the "Plan-Do-Check-Act" model.
2 ISO/IEC 27004:2009
Information technology - Security techniques - Information security management - Measurement
3 ISO/IEC 27005:2008
Information technology – Security techniques – Information Security Risk Management
4 ISO/IEC 21827:2008
Information technology - Security techniques - Systems Security Engineering - Capability Maturity Models (SSE-CMMr)
5 NFPA 1600
Standard on Disaster/Emergency Management and Business Continuity Programs (2007)
6 INCITS/ISO/IEC 24762:2008[R2014]
Information technology - Security techniques - Guidelines for information and communications technology disaster recovery services
7 DS/ISO/IEC 27000:2018
Information technology - Security techniques - Information security management systems - Overview and vocabulary
8 ISO/IEC 20000-2:2005
Information technology - Service management - Part 2: Code of practice
9 NIST 800-30
Risk Management Guide For Information Technology Systems
10 NIST 800-55 Rev 1
Performance Measurement Guide For Information Security
11 NIST SP 800-100
Information Security Handbook – A Guide For Managers
12 NIST SP 800-53A Rev. 1
Guide for Assessing the Security Controls in Federal Information Systems
13 NIST SP 800-51 Rev. 1
Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme
14 NIST SP 800-34 Rev. 1
Contingency Planning Guide for Information Technology Systems
15 NIST SP 800-47
Security Guide for Interconnecting Information Technology Systems
16 NIST SP 800-50
Building an Information Technology Security Awareness and Training Program
17 NIST SP 800-16
Information Technology Security Training Requirements: A Role and Performance Based Model
18 NIST SP 800-61 Rev. 2
Computer Security Incident Handling Guide
19 NIST SP 800-39
DRAFT Managing Risk from Information Systems: An Organizational Perspective
20 Control Objectives for Information Technology (CobiT ®)
21 FFIEC IT Examination Handbook
22 U.S Department of Homeland Security
Information Technology (IT) Security Essrntial Body of Knowledge (EBK): ACompetency and Functional Framework for IT Security Workforce Development
23 INCITS/ISO/IEC 13335-1-2004
Information Technology - Guidelines for the Management of IT Security - Part 1: Concepts and Models for IT Security (new national adoption) (formerly ANSI/ISO/IEC TR 13335-1:1996)
24 ISO/IEC 15408-1:2009
Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model
25 ISO/IEC 15408-2:2008
Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional requirements
26 ISO/IEC 15408-3:2008
Information technology - Security techniques - Evaluation criteria for IT security - Part 3: Security assurance requirements
ANSI Logo

As the voice of the U.S. standards and conformity assessment system, the American National Standards Institute (ANSI) empowers its members and constituents to strengthen the U.S. marketplace position in the global economy while helping to assure the safety and health of consumers and the protection of the environment.

CUSTOMER SERVICE
NEW YORK OFFICE
ANSI HEADQUARTERS