The Financial Management of Cyber Risk
IDSP Workshop Report
Measuring Identity Theft
Published by the Internet Security Alliance (ISA) and the American National Standards Institute (ANSI)
Registration is required for new users.
The Financial Management of Cyber Risk introduces a new framework for managing and reducing the financial risk related to cyber attacks, which threaten businesses, national security, and the international community.
The 76-page document offers a pragmatic action plan that addresses cybersecurity from an enterprise-wide perspective. Developed by a task force of more than sixty industry and government experts, The Financial Management of Cyber Risk:
An Implementation Framework for CFOs has been funded and managed by the private sector and is offered as a free resource on cyber risk mitigation for organizations across the country.
Applicable Standards, Frameworks and Guidance Documents
The following list of standards and reference documents is included in Chapter 4 Appendix of The Financial Management of Cyber Risk: An Implementation Guide for CFO’s.
1
ISO/IEC 27001 and 27002 IT Security Techniques Package
The ISO/IEC 27001 and 27002 IT Security Techniques Package provides the requirements and code of practice to initiate, implement, maintain and improve an information security management system in any size organization. This package helps to identify an organization's security requirements, risks and selecting controls for the requirements and risks using the "Plan-Do-Check-Act" model.
The ISO/IEC 27001 and 27002 IT Security Techniques Package provides the requirements and code of practice to initiate, implement, maintain and improve an information security management system in any size organization. This package helps to identify an organization's security requirements, risks and selecting controls for the requirements and risks using the "Plan-Do-Check-Act" model.
2
ISO/IEC 27004:2009
Information technology - Security techniques - Information security management - Measurement
Information technology - Security techniques - Information security management - Measurement
3
ISO/IEC 27005:2008
Information technology – Security techniques – Information Security Risk Management
Information technology – Security techniques – Information Security Risk Management
4
ISO/IEC 21827:2008
Information technology - Security techniques - Systems Security Engineering - Capability Maturity Models (SSE-CMMr)
Information technology - Security techniques - Systems Security Engineering - Capability Maturity Models (SSE-CMMr)
5
NFPA 1600
Standard on Disaster/Emergency Management and Business Continuity Programs(2007)
Standard on Disaster/Emergency Management and Business Continuity Programs(2007)
6
INCITS/ISO/IEC 24762:2008[R2014]
Information technology - Security techniques - Guidelines for information and communications technology disaster recovery services
Information technology - Security techniques - Guidelines for information and communications technology disaster recovery services
7
DS/ISO/IEC 27000:2018
Information technology - Security techniques - Information security management systems - Overview and vocabulary
Information technology - Security techniques - Information security management systems - Overview and vocabulary
8
ISO/IEC 20000-2:2005
Information technology - Service management - Part 2: Code of practice
Information technology - Service management - Part 2: Code of practice
9
NIST 800-30
Risk Management Guide For Information Technology Systems
Risk Management Guide For Information Technology Systems
10
NIST 800-55 Rev 1
Performance Measurement Guide For Information Security
Performance Measurement Guide For Information Security
11
NIST SP 800-100
Information Security Handbook – A Guide For Managers
Information Security Handbook – A Guide For Managers
12
NIST SP 800-53A Rev. 1
Guide for Assessing the Security Controls in Federal Information Systems
Guide for Assessing the Security Controls in Federal Information Systems
13
NIST SP 800-51 Rev. 1
Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme
Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme
14
NIST SP 800-34 Rev. 1
Contingency Planning Guide for Information Technology Systems
Contingency Planning Guide for Information Technology Systems
15
NIST SP 800-47
Security Guide for Interconnecting Information Technology Systems
Security Guide for Interconnecting Information Technology Systems
16
NIST SP 800-50
Building an Information Technology Security Awareness and Training Program
Building an Information Technology Security Awareness and Training Program
17
NIST SP 800-16
Information Technology Security Training Requirements: A Role and Performance Based Model
Information Technology Security Training Requirements: A Role and Performance Based Model
18
NIST SP 800-61 Rev. 2
Computer Security Incident Handling Guide
Computer Security Incident Handling Guide
19
NIST SP 800-39
DRAFT Managing Risk from Information Systems: An Organizational Perspective
DRAFT Managing Risk from Information Systems: An Organizational Perspective
21
INCITS/ISO/IEC 13335-1-2004
Information Technology - Guidelines for the Management of IT Security - Part 1: Concepts and Models for IT Security (new national adoption) (formerly ANSI/ISO/IEC TR 13335-1:1996)
Information Technology - Guidelines for the Management of IT Security - Part 1: Concepts and Models for IT Security (new national adoption) (formerly ANSI/ISO/IEC TR 13335-1:1996)
22
ISO/IEC 15408-1:2009
Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model
Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model
23
ISO/IEC 15408-2:2008
Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional requirements
Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional requirements
24
ISO/IEC 15408-3:2008
Information technology - Security techniques - Evaluation criteria for IT security - Part 3: Security assurance requirements
Information technology - Security techniques - Evaluation criteria for IT security - Part 3: Security assurance requirements
