Earlier this year, the National Institute of Standards and Technology (NIST) released version 2.0 of their Cybersecurity Framework (CSF), the first major update to the framework since its creation in 2014. One of the primary reasons NIST updated the CSF is to help organizations enhance their cybersecurity maturity and defense. As the threat landscapes continue to evolve, cybersecurity strategies must also evolve to keep pace. NIST CSF 2.0 helps organizations establish and support a proactive cybersecurity strategy and address the risks relevant to their business.
RSM recently hosted a webcast to educate organizations on how to leverage the updated NIST CSF 2.0 to evolve their cybersecurity maturity. The webcast, “Level up and adapt: Evolving your cybersecurity strategy to align with NIST CSF 2.0,” was hosted by Jason Broz and Chip Stewart, risk consulting directors at RSM US LLP.
According to reports from the FBI, the Identity Theft Resource Center and IBM, while the number of breaches between 2011 and 2023 has gone up at a steady rate, the cost of those breaches has grown exponentially, especially since 2017. The potential financial impact signifies an even greater need for breach prevention than a decade ago and, therefore, a better approach to cybersecurity.
To enhance that approach, RSM detailed four key lessons learned from implementing NIST CSF 2.0 in the webcast.
Taking a proactive defense approach
In the current risk environment, organizations need to assume a proactive defense approach, which RSM’s Jason Broz defined as “the ability to anticipate future issues, needs or changes through implementing continual processes and key activities with the intent to identify and reduce or prevent threats from materializing.”
Proactive defense should include threat intelligence, regular penetration testing and vulnerability scanning, monitoring, cybersecurity awareness training, and behavior-based analytics.
We recommend gauging the frequency of awareness training based on your organization’s needs, as there is a balance between performing training often enough to be effective without overloading your staff or consuming too many resources. However, conducting training upon hire and then annually moving forward is a recommended best practice. Assuming a posture of proactive defense can help your organization stop threats before they happen, respond to and recover from threats more quickly, and overall take better control of managing risk. This can result in significant cost savings.