In the world of cybersecurity and risk management, laws, regulations and frameworks such as DORA, ISO 27001/27002, NIS2, GDPR, and NIST 800-161 form the basis for strengthening security strategies. Despite their unique characteristics, they share some important common elements:

1. Risk assessment and management: These frameworks emphasize the importance of identifying, assessing, and managing risks.
2. Security policies and procedures: Establishing detailed policies and procedures is critical for access management, data protection and incident management.
3. Compliance and Accountability: Organizations must comply with legal requirements and demonstrate this through documentation and audits.
4. Incident Management and Recovery: Frameworks place a strong emphasis on robust processes for incident management, response and recovery.
5. Awareness and Training: Staff training and awareness are essential to an effective cybersecurity strategy.

Make frameworks easier to apply

We have read and standardized all relevant laws, regulations and risk frameworks including NIS2, DORA and ISO 27001/27002, and laws and regulations. Whichever law or framework you choose as your starting point: this makes complex laws, texts and requirements much more understandable and easier to apply. After choosing one of the built-in templates, you can look at the selected regulations and associated measures (controls) from different perspectives:

Security domains

These domains represent different areas of concern within an organization's cybersecurity infrastructure, and each domain includes specific measures (controls) needed to ensure the security and integrity of information and systems.

Examples of security domains:

• Third-Party Management
• Incident Response
• Cybersecurity & Data Privacy Governance
• Risk Management
• Vulnerability & Patch Management
• Compliance Management
• Project & Resource Management
• Technology Development & Acquisition
• Information Assurance
• Identification & Authentication
• Cryptographic Protections
• Asset Management
• Human Resources Security
• Configuration Management
• Business Continuity & Disaster Recovery
• Secure Engineering & Architecture
• Maintenance Management
• Security Awareness & Training
• Network Security

Cybersecurity functions

Here the measures/controls are categorized from the perspective of cybersecurity functions. These categories form the basis of a systematic approach to managing cybersecurity risks. These functions help organizations develop and implement a wide range of security measures. They form a core structure used in various cybersecurity frameworks. Cybersecurity Functions are also called Cybersecurity Framework Core or Functional Groups:

• Identify
• Govern
• Protect
• Respond
• Detect

Risk Tiers

These tiers help organizations organize and prioritize security measures and strategies at different levels of business operations. They are referred to as Risk Tiers or Risk Management Tiers:

• Operational
• Tactical
• Strategic

RiskStudio presents complex, often lengthy laws and regulations visually and in a structured manner, making them easier to understand and apply. At the touch of a button, you can look at it from different perspectives, such as security domains, cybersecurity functions and risk layer. This helps you quickly identify key points and implement them effectively, improving compliance and risk management.

This functionality allows you to conduct Risk Surveys in your or your client's organization based on the available templates. You define the scope yourself by selecting frameworks, legislation, such as NIS2, GDPR, DORA or ISO 27001, Security Domains, Functional groups and Risk Tiers. We will discuss this functionality in more detail in a future blog.

Learn more

Do you have questions about how to apply frameworks to your work? Or would you like more information? Get in touch with us. We'd love to help!