The Financial Management of Cyber Risk
IDSP Workshop Report
Measuring Identity Theft
Published by the Internet Security Alliance (ISA) and the American National Standards Institute (ANSI)
Registration is required for new users.
The Financial Management of Cyber Risk introduces a new framework for managing and reducing the financial risk related to cyber attacks, which threaten businesses, national security, and the international community.
The 76-page document offers a pragmatic action plan that addresses cybersecurity from an enterprise-wide perspective. Developed by a task force of more than sixty industry and government experts, The Financial Management of Cyber Risk: An Implementation Framework for CFOs has been funded and managed by the private sector and is offered as a free resource on cyber risk mitigation for organizations across the country.
Applicable Standards, Frameworks and Guidance Documents
The following list of standards and reference documents is included in Chapter 4 Appendix of The Financial Management of Cyber Risk: An Implementation Guide for CFO’s.
ISO/IEC 27001 and 27002 IT Security Techniques Package
The ISO/IEC 27001 and 27002 IT Security Techniques Package provides the requirements and code of practice to initiate, implement, maintain and improve an information security management system in any size organization. This package helps to identify an organization's security requirements, risks and selecting controls for the requirements and risks using the "Plan-Do-Check-Act" model.
ISO/IEC 27004:2009
Information technology - Security techniques - Information security management - Measurement
ISO/IEC 27005:2008
Information technology – Security techniques – Information Security Risk Management
ISO/IEC 21827:2008
technology - Security techniques - Systems Security Engineering - Capability Maturity Models (SSE-CMMr)
NFPA 1600
Standard on Disaster/Emergency Management and Business Continuity Programs(2007)
INCITS/ISO/IEC 24762:2008[R2014]
Information technology - Security techniques - Guidelines for information and communications technology disaster recovery services
DS/ISO/IEC 27000:2018
Information technology - Security techniques - Information security management systems - Overview and vocabulary
ISO/IEC 20000-2:2005
Information technology - Service management - Part 2: Code of practice
NIST 800-30
Risk Management Guide For Information Technology Systems
NIST 800-55 Rev 1
Performance Measurement Guide For Information Security
NIST SP 800-100
Information Security Handbook – A Guide For Managers
NIST SP 800-53A Rev. 1
Guide for Assessing the Security Controls in Federal Information Systems
NIST SP 800-51 Rev. 1
Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme
NIST SP 800-34 Rev. 1
Contingency Planning Guide for Information Technology Systems
NIST SP 800-47
Security Guide for Interconnecting Information Technology Systems
NIST SP 800-50
Building an Information Technology Security Awareness and Training Program
NIST SP 800-16
Information Technology Security Training Requirements: A Role and Performance Based Model
NIST SP 800-61 Rev. 2
Computer Security Incident Handling Guide
NIST SP 800-39
DRAFT Managing Risk from Information Systems: An Organizational Perspective
INCITS/ISO/IEC 13335-1-2004
Information Technology - Guidelines for the Management of IT Security - Part 1: Concepts and Models for IT Security (new national adoption) (formerly ANSI/ISO/IEC TR 13335-1:1996)
ISO/IEC 15408-1:2009
Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model
ISO/IEC 15408-2:2008
Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional requirements
ISO/IEC 15408-3:2008
Information technology - Security techniques - Evaluation criteria for IT security - Part 3: Security assurance requirements