James Xuereb
Who's this article for?
- If your cyber security posture is important to you and your IT team.
- Working in G&R or compliance role that is researching for relevant frameworks.
- You are planning to embrace a new security framework.
- Trying to lower your cyber security insurance premiums.
- Researching what are the pros and cons of iso27001 vs essential 8 vs NIST
- Particularly exploring the school / education sectors
Cyber Security for Education organisations
When considering cybersecurity frameworks for Australian Education organisations, it’s important to weigh the pros and cons of each option: ISO 27001, Essential 8, and the NIST Cybersecurity Framework all have compelling reasons to choose them as a benchmark or framework.
Why
In this article we review some of the key points that frequently come up when talking with our clients and prospective clients when completing audits or environment reviews. Some org’s have identified what frameworks to work with and are on their pathway, many others have completed some infrastructure projects and nearing to their roadmap to improve Cyber security and are at a crossroads.
We thought it would be beneficial to give a brief summary or each of the 3 frameworks we get asked about the most and then categorise what are typically agreed by our team as a pro or possible cons.
ISO 27001: International Standard for information security
Brief origin story:
ISO 27001 originated as a International standard for information security management systems. It was developed by the International Organization for Standardisation (ISO) and the International Electrotechnical Commission (IEC).
Its adoption by Australian schools was driven by their increasing need to protect sensitive student and faculty data to ensure compliance with stringent regulatory requirements.
Pros:
Comprehensive Coverage: ISO 27001 addresses all aspects of information security, including people, processes, and technology.
Scalability: It can be adapted to schools of various sizes and complexities.
Credibility: Certification enhances the school’s reputation and demonstrates a commitment to best-practice security.
Risk-Based Approach: Focuses on managing and mitigating information security risks, ensuring efforts are directed where they matter most.
Cons:
Cost: Implementing and maintaining ISO 27001 can be expensive, requiring significant resources.
Complexity: The comprehensive nature of ISO 27001 can make it challenging to implement, especially for schools with limited IT staff.
Time-Consuming: Achieving certification involves a lengthy process of documentation, implementation, and audits.
Essential 8: the local Australian approach to Cyber Security
Brief origin story:
The Essential 8 framework was developed by the Australian Cyber Security Centre
(ACSC) as a practical guide for organisations, including schools, to bolster their cybersecurity defences. Introduced to simplify and prioritise security measures, it provides a set of baseline strategies to mitigate common cyber threats effectively.
The Essential Eight can be thought of as a local framework for the Australian market but is similar to other frameworks in other parts of the world. In England, the Cyber Essentials scheme serves as a similar framework to the Essential 8, providing basic cybersecurity measures to protect against common online threats.
Pros:
Simplicity: Essential 8 is straightforward to implement and understand, making it accessible for schools with limited cybersecurity resources.
Cost-Effective: Implementation can be achieved with minimal financial investment.
Effectiveness: The Australian Cyber Security Centre (ACSC) claims that implementing the Essential 8 can mitigate 85% of targeted cyberattacks by establishing a solid baseline.
Scalable: There are levels for Essential 8 that have varying degrees of compliance and governance. Level 1 is a good aspirational goal for those new the Cyber. Level 2 could be road mapped as an north star.
Cons:
Limited Scope: Focuses primarily on technical controls and may not address broader organisational and management aspects of cybersecurity such as people or process controls. For example: Level 1 maybe to basic for some boards appetite for stronger controls by IT.
Maturity: While a strong foundation, it might not be sufficient for schools with complex IT environments or those facing sophisticated threats.
NIST Cybersecurity Framework: An adaptable and comprehensive Cyber Security Approach
Brief origin story:
The NIST Cybersecurity Framework was developed by the National Institute of Standards and Technology (NIST) in the United States as a response to growing cyber threats targeting critical infrastructure. Over the years it has an adaptable approach which has been adopted internationally, including by schools in around the globe including Australia, primarily to enhance their cybersecurity posture.
Pros:
Comprehensive and Flexible: Provides a risk-based, customisable schema suitable for various organisational sizes, including schools.
Enhanced Communication: Establishes a universal language for cybersecurity, improving communication between stakeholders.
Adaptability: Allows schools to tailor their cybersecurity measures based on evolving threats.
Reputation: Adherence to the NIST framework can enhance the school’s reputation by demonstrating a commitment to best practices and going beyond an established baseline.
Cons:
Voluntary Nature: Being voluntary, it may not compel all schools to adopt it fully.
Resource Intensive: Effective implementation requires significant resources and coordination across departments.
Complexity: The framework’s comprehensive nature can be challenging to manage, especially for schools with limited cybersecurity expertise.
Sponsorship: For the reasons above NIST often requires backing in a commercial sense as well as the conceptual but departments and faculties.
Which one is right?
Each framework has its strengths and weaknesses, and the best choice depends on the specific needs, resources, and risk profile of your org,.
Perspective is an interesting thing and can often play a big part as to where such considerations reside on our list.
We see many schools adopt Essential 8 as establishing a baseline leverage their IT infrastructure. Which has a lower barrier to entry compared to Iso27001 involves more than just technical controls rather people and processes are impacted as well, depending on the schools baseline of communications and awareness this could also be a great place to start.
Essential 8 can go beyond a healthy baseline as ACSC has implemented levels systems to increase governance up from Level 1 to Level 2.
NIST offers IT admins a different perspective and levels of protection could be the right “glass slipper” for your team if you have the appetite and support of more resources.
If after reading this something stood out as a light bulb moment or potential risk to explore, feel free to reach out and start a conversation.
Article references
https://www.educationalwave.com/pros-and-cons-of-nist-framework/
As certified IT security experts, we can help you fortify your defences, uphold regulatory compliance, improve your company's security posture and proactively maintain your servers and networks to protect you from evolving cyber risks.
