From standards such as checklists. Into information security that works in practice

Many organisations manage information security at multiple levels, but without sufficient coherence between strategic decisions, risk assessments and the technical security of their operations. This increases the risk of uncoordinated efforts, over-implementation and controls that do not necessarily address the greatest risks.

Information security standards and frameworks provide a common foundation for prioritising and targeting security efforts. However, their true value only becomes apparent when they are translated into specific technical and organisational measures that are aligned with a business’s needs, its risk profile and its operational model.

We help you translate standards and frameworks into concrete reality and adapt them so that they are proportionate and operational within your specific organisation. In this way, your security efforts can be targeted so that they are business-driven and support a coherent security model. The result is a more focused security approach, with fewer resources being spent on unnecessary compliance tasks.

Information security standards and frameworks work well as general checklists. They provide the organisation with a systematic overview of the aspects that need to be addressed within a given security area. It’s a bit like a vehicle inspection, where a number of aspects are checked before the car can be approved. Here, you cannot simply tick a box just because the car is, for example, fitted with brakes. What matters is also how they work and are maintained.

This analogy can be applied to information security: if there is an item on the checklist asking whether you have implemented access control, it is not enough to simply answer “yes” and move on to the next item. You need to consider things like how effective the access control is, how roles and responsibilities are set up in your Identity and Access Management (IAM) system, what is actually being done in practice regarding access control, and whether control functions, processes and policies are well aligned with the organisation’s current risk appetite.

Information security standards and frameworks do not cover the same areas and therefore do not address the same security tasks. Some operate primarily at the governance and management level, whilst others delve right down into specific, technical controls and security configurations.

ISO 27001, for example, is a management standard that deals with the management of the security organisation and the processes that support it. CIS18 is designed to protect organisations against the most common and critical cyber threats, whilst NIST is much more comprehensive and was originally developed for large, government organisations. At the same time, standards and frameworks are playing an increasingly important role in addressing regulatory requirements such as NIS2 and DORA. Both of these EU directives provide for compliance with the requirements by working in accordance with well-established, international security standards.