Cybersecurity Documentation
Introduction
Cyber security standards [1] are techniques generally established in published materials that attempt to protect the cyber environment of a user or organization.[2] This environment includes the users themselves, networks, devices, all software, processes, information in storage or transit, applications, services and systems that can connect directly or indirectly to networks.
The main objective is to reduce risks, including prevention or mitigation of cyber-attacks. These published materials consist of collections of tools, security policies, security concepts, security safeguards, guides, risk management approaches, actions, training, best practices, assurance and technologies.
History
Cybersecurity standards have existed for several decades as users and providers have collaborated in many national and international forums to achieve capabilities, policies and practices that generally emerge from work at the Stanford Consortium for Research on Information Security and Policy in the 1990s.[3].
A 2016 US Security Framework Adoption Study reported that 70% of organizations surveyed considered the NIST Cybersecurity Framework to be the most popular best practice for Information Technology (IT) cybersecurity, but many note that it requires significant investment.[4].
Standards
Contenido
Las subsecciones de abajo detallan los estándares más comunes.
ISO/IEC 27001 and 27002
ISO/IEC 27001, Part of the growing ISO/IEC 27000 family of standards, is an information security management system (ISMS) standard, the latest version of which was published in October 2013 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001: 2013 - Information technology - Security techniques - Systems information security management - Requirements..
ISO/IEC 27001 formally specifies a management system intended to provide information security under explicit management control.