Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

How to Build the Most Effective Information Security Framework

Build a comprehensive defense against cyberattacks with a strong information security framework that leverages the world's best standards and infosec tools. 

A term like "information security framework" can be interpreted in many different ways, and as such, there are a number of overlapping standards throughout the infosec field. 

Some of these are required for legal compliance — which must be followed to the letter if they apply to you — while others are technically voluntary but highly regarded throughout the industry. It’s wise to learn about all of these mandatory and voluntary standards and decide how best to adopt them alongside the right set of vulnerability assessment and interdiction tools. 

ISO standards: Firm foundations

Given that the International Organization for Standardization (ISO) has guidelines covering all major industries, it's little surprise that they created several focused on infosec: ISO 270011 and 27701.2 Both were created alongside the International Electrotechnical Commission. 

ISO 27001: Developed around a risk-based approach to information security, in which you continuously identify hazards and select controls to properly address them. ISO 27001's "controls" for infosec are divided into categories including a written security policy, HR security, asset management, access control, cryptography, physical and environmental security, incident management, business continuity management and compliance with government regulations.3

ISO 27701: Focused more on the specific issue of data privacy. In fact, its 2019 update was a direct response to the European Union's implementation of the General Data Protection Regulation (GDPR) the previous year. It requires organizations to factor protection of personally identifiable information (PII) into all information security risk assessments, and demands that data processors or controllers make PII protections their highest priority.4

Whether you're a small business or an enterprise with facilities in multiple countries, you're responsible for safeguarding not only customer PII but also that of your workforce. The international standards shouldn't comprise the whole of your infosec practice — in fact, in some cases that would mean being noncompliant - but receiving ISO certification makes a solid foundation for any business's information security program. (Combining the practices of ISO 27001 with a tool like Tenable.sc makes for a particularly potent defense against infosec threats.) 

It's wise to learn about all of the mandatory and voluntary standards when building your information security framework

CIS benchmarks: The infosec professional's infosec guidelines

The Center for Internet Security (CIS), a nonprofit dedicated to promoting sound infosec practices, refers to its Controls and Benchmarks5 as "the global standard … for securing IT systems and data against the most pervasive attacks." 6

To call CIS Benchmarks "detailed" would be a major understatement: The manual for Windows 10 Enterprise's latest version, for example, is 1,312 pages and covers every single facet of that operating system. It'd be wise to take a look through CIS's library of Benchmarks, find the documents most closely related to your operations and spend some time poring over them as you work to develop the ideal information security framework for your organization's unique needs. 

Industry- and government-mandated standards

All of the following may be required by either industry governing bodies or the government itself, with penalties applying for noncompliance. If your organization falls under their purview, their rules have to be part of your information security program.

HIPAA: If you handle personal health information in the U.S. for any reason, whether as a health care provider or as tertiary material (like employee health data for benefits administration purposes), you must follow the Health Insurance Portability and Accountability Act's (HIPAA) Security Rule.7 This mandates the establishment of "administrative, physical and technical safeguards" for any electronically stored PII.

HIPAA doesn't list specific infosec practices to abide by or tools to use. (This is why leveraging multiple standards is necessary to create an information security framework.) One thing that isn't vague, however, is HIPAA's penalty system: Violations can mean penalties ranging from $100 to $1.5 million, depending on an organization's level of culpability.8

PCI DSS: Any business, government department or nonprofit that processes debit or credit card payments is subject to the Payment Card Industry Data Security Standards (PCI DSS) created by Visa, MasterCard and American Express.9 PCI DSS has more specific requirements for organizations, such as around firewall configurations and encryption. Like HIPAA, violations incur fines — for government and private-sector organizations alike10 — but instead of being one-time payments, they accrue monthly until the noncompliant party corrects its practices. 

NIST: If you want a lucrative federal contract for your business, you'd better be ready to adopt and maintain the National Institute of Standards and Technology's (NIST) unique Cybersecurity Framework.11 But NIST's basic phases of information security are also an undeniably solid foundation for any organization: identifying cybersecurity risks, preemptively implementing appropriate protections, searching for and detecting anomalous network activity, and enacting immediate response and containment efforts in breaches' wake and data recovery.12

DISA: Although the requirements outlined in the Defense Information Systems Agency's (DISA) Security Technical Implementation Guides13 are only mandatory for the Defense Department, they're updated more frequently than almost any other infosec protocol, making them an excellent resource for developing your own framework. 

GDPR: These requirements affect any organization that collects or processes personal data from residents of EU member states.14 Almost all modern organizations will need to implement GDPR standards to at least some extent.

Security framework development 

The first step to any security framework is to get full visibility into your assets. Regardless of which framework you decide to go with, you can’t secure what you can’t see. A vulnerability assessment or vulnerability management solution can help you get a full picture of what’s on your network. 

Once you are ready to create the ideal information security framework, you obviously must start with standards you're legally obligated to follow (HIPAA, GDPR, NIST) and those for which noncompliance is fiscally devastating (PCI DSS). But beyond them, you should consider the value other standards can bring. 

For example, maybe ISO 27001 covers your infosec needs pretty well, but you appreciate CIS's exhaustive guidance for safeguarding the assets you host on Amazon Web Services. Adopting the relevant CIS standards can't hurt your cloud operations and will almost certainly help. Other voluntary certifications may not apply directly to your business, but it's still worthwhile to understand them before deciding whether to follow their guidelines. It's also critical to use vulnerability scanning, penetration testing and threat modeling to project how damaging attacks would be handled under different configurations. 

You need the right tools to help along the way - and at Tenable, we've got them. Nessus Pro, the industry-leading vulnerability assessment solution, is the ideal complement to many information security frameworks, including custom approaches. Alternatively, we offer solutions to help observe specific protocols, such as Tenable.sc's support for ISO 27001 compliance and Tenable.io's PCI ASV variant

Learn more and choose the product that’s right for you.

Start Your Free Nessus Trial

1. ISO, "ISO/IEC 27001 Information Security Management"
2. ISO, "ISO/IEC 27701:2019 Security Techniques," August 2019
3. IT Governance Blog, "ISO 27001: The 14 Control Sets of Annex A Explained," July 2020
4. IT Governance USA, "ISO 27701: Privacy Information Management Systems"
5. Center for Internet Security, "CIS Benchmarks"
6. Center for Internet Security, "About Us," July 2020
7. American Medical Association, "HIPAA Security Rule & Risk Analysis," December 2019
8. Modern Healthcare, "HHS to Cap HIPAA Fines Based on 'Culpability'," April 2019
9. PCI Security Standards Council, "Maintaining Payment Security"
10. FivePoint Payments, "Do Governments Need to Maintain PCI Compliance?", February 2018
11. National Institute of Standards and Technology, "NIST Cybersecurity Framework"
12. IT Governance USA, "What is the NIST Cybersecurity Framework?"
13. DoD Cyber Exchange, "Security Technical Implementation Guides (STIGs)"
14. GDPR.eu, "Does the GDPR apply to companies outside of the EU?"

Verwandte Artikel

CIS Adapts Critical Security Controls to Industrial Control Systems

Von Ted Gary • 29. Juni 2018 Tenable® – 8.00 Uhr

Abonnieren Sie den Tenable Blog

Kostenlos testen Jetzt kaufen

Testen Sie Tenable.io


Wir bieten Ihnen vollen Zugriff auf eine moderne, cloudbasierte Schwachstellen-Management-Plattform, mit der Sie alle Ihre Assets mit beispielloser Genauigkeit sehen und nachverfolgen können. Melden Sie sich jetzt an.

Tenable.io kaufen

Wir bieten Ihnen vollen Zugriff auf eine moderne, cloudbasierte Schwachstellen-Management-Plattform, mit der Sie alle Ihre Assets mit beispielloser Genauigkeit sehen und nachverfolgen können. Erwerben Sie noch heute Ihre jährliche Subscription.

65 Assets

Wählen Sie Ihre Subscription-Option:

Jetzt kaufen
Kostenlos testen Jetzt kaufen

Testen Sie Nessus Professional kostenlos


Nessus® ist der umfassendste Schwachstellen-Scanner auf dem Markt. Nessus Professional unterstützt Sie bei der Automatisierung des Scan-Prozesses, spart Zeit in Ihren Compliance-Zyklen und ermöglicht Ihnen die Einbindung Ihres IT-Teams.

Nessus Professional kaufen

Nessus® ist der umfassendste Schwachstellen-Scanner auf dem Markt. Nessus Professional unterstützt Sie bei der Automatisierung des Scan-Prozesses, spart Zeit in Ihren Compliance-Zyklen und ermöglicht Ihnen die Einbindung Ihres IT-Teams.

Mehrjahreslizenz kaufen und sparen! Mit Advanced Support erhalten Sie rund um die Uhr, 365 Tage im Jahr Zugang zum Support – per Telefon, Chat und über die Community. Vollständige Details finden Sie hier.

Kostenlos testen Jetzt kaufen

Tenable.io Web Application Scanning testen


Profitieren Sie vom vollen Zugriff auf unser neuestes Angebot zum Scannen von Web-Applikationen, das als Teil der Tenable.io-Plattform für moderne Applikationen entwickelt wurde. Scannen Sie auf sichere Weise Ihr gesamtes Online-Portfolio auf Schwachstellen – mit hoher Genauigkeit und ohne großen manuellen Aufwand oder Unterbrechung kritischer Web-Applikationen. Melden Sie sich jetzt an.

Tenable.io Web Application Scanning kaufen

Wir bieten Ihnen vollen Zugriff auf eine moderne, cloudbasierte Schwachstellen-Management-Plattform, mit der Sie alle Ihre Assets mit beispielloser Genauigkeit sehen und nachverfolgen können. Erwerben Sie noch heute Ihre jährliche Subscription.


3.578,00 USD

Jetzt kaufen

Kostenlos testen Vertrieb kontaktieren

Tenable.io Container Security testen


Profitieren Sie von vollem Zugriff auf die einzige Lösung für Containersicherheit, die in eine Schwachstellen-Management-Plattform integriert ist. Überwachen Sie Container-Images auf Schwachstellen, Malware und Richtlinienverstöße. Kann in Systeme für kontinuierliche Integration und Bereitstellung (CI/CD) eingebunden werden, um DevOps-Praktiken zu unterstützen, die Sicherheit zu stärken und die Einhaltung von Unternehmensrichtlinien zu fördern.

Tenable.io Container Security kaufen

Tenable.io Container Security ermöglicht eine nahtlose und sichere Umsetzung von DevOps-Prozessen, indem es die Sicherheit von Container-Images – einschließlich Schwachstellen, Malware und Richtlinienverletzungen – durch Integration in den Build-Prozess transparent macht.

Erfahren Sie mehr über Industrial Security

Demo für Tenable.sc anfordern

Bitte tragen Sie Ihre Kontaktdaten in das Formular unten ein. Ein Vertriebsmitarbeiter wird Sie in Kürze kontaktieren, um einen Termin für die Demo zu vereinbaren.Sie können auch einen kurzen Kommentar mitschicken (begrenzt auf 255 Zeichen). Bitte beachten Sie, dass Felder mit einem Sternchen (*) Pflichtfelder sind.

Kostenlos testen Vertrieb kontaktieren

Tenable Lumin testen


Mit Tenable Lumin können Sie Ihre Cyber Exposure visualisieren und genauer untersuchen, die allmähliche Reduzierung von Risiken nachverfolgen und Benchmark-Vergleiche mit ähnlichen Unternehmen anstellen.

Tenable Lumin kaufen

Kontaktieren Sie einen Vertriebsmitarbeiter, um zu erfahren, wie Lumin Sie dabei unterstützen kann, Einblick in Ihr gesamtes Unternehmen zu erhalten und Cyberrisiken zu managen.

Demo von Tenable.ot anfordern

Passgenauer Schutz Ihrer operativen Technologien –
durch effektive Risikoreduzierung.