3 Considerations Before Choosing a Risk Management Framework

A risk management framework (RMF) is an organization’s security controls road map for managing its cyber risks. RMFs define how the people in an organization utilize processes to manage technology, ensure oversight, and reduce risk exposure. The framework often serves multiple purposes, from evaluating the maturity of security controls to demonstrating due diligence in securing A customer’s data.

Frameworks like ISO, NIST, and RISK IT are the three most commonly adopted risk management approaches. Choosing which is best for an organization can be challenging, effectively implementing one even more so. There  are three considerations in choosing a framework:

1. Existing security culture and people
         1. Investing in and having a strong existing security culture increases the acceptance of the chosen RMF. Take the time to enroll your employees in your process, and the procedure is the             first step to quick adoption.

2. Understand your current processes
   1. Create an inventory of the risk management processes you have in place today. Then, rate the maturity of these processes: initial, repeatable, defined, capable, or efficient? Doing so will help you see which framework aligns with your current risk security procedures.
3. Determine compliance requirements
   1. Many compliance requirements tie directly to contractually based standards (PCI, SOC1, SOC2, HITRUST) and regulatory standards (GDPC, GLBA, FISMA, HIPPA, or SOX). Your compliance requirements will influence which RFM is right for you.

Making the decision may still be challenging. Instead of choosing the proper framework, Security Vitals recommends looking at the most appropriate framework. Having a list of guiding principles to help answer the challenges ahead can often keep the end goal in sight.

1. Look for alignments, not perfect matches
2. Know the external driving factors and keep them in mind
3. Treat it as a program, not a onetime project
4. Recognize the difference between a standard and a framework
5. Be adaptive

There is no one-size-fits-all correct answer to choosing an RMF. We know the selection path is full of potential stumbles and pitfalls. Keeping your organization’s goals and objectives in mind while identifying the merits of each option as they relate to your organization’s current posture through analysis, preparation, and planning will help overcome the challenge.