Security Policy Frameworks

Overview

Security policy frameworks provide the structure and guidance needed to establish, implement, and maintain effective information security programs. This guide covers industry-standard frameworks commonly used in MSP and enterprise environments.

Why Security Frameworks Matter

Security frameworks help organizations:

• Establish Baseline Security - Define minimum security requirements
• Ensure Compliance - Meet regulatory and industry standards
• Reduce Risk - Systematically address security vulnerabilities
• Provide Consistency - Standardize security practices across the organization
• Enable Auditing - Facilitate security assessments and audits
• Support Business Goals - Align security with business objectives

Major Security Frameworks

NIST Cybersecurity Framework (CSF)

Best For: Organizations of all sizes seeking a flexible, risk-based approach

Website: nist.gov/cyberframework

The NIST Cybersecurity Framework provides a policy framework of computer security guidance for how private sector organizations can assess and improve their ability to prevent, detect, and respond to cyber attacks.

Core Functions

1. Identify - Understand organizational context and cybersecurity risks

   • Asset Management
   • Business Environment
   • Governance
   • Risk Assessment
   • Risk Management Strategy

2. Protect - Implement safeguards to limit cybersecurity incidents

   • Access Control
   • Awareness and Training
   • Data Security
   • Information Protection Processes
   • Maintenance
   • Protective Technology

3. Detect - Identify cybersecurity events

   • Anomalies and Events
   • Security Continuous Monitoring
   • Detection Processes

4. Respond - Take action regarding detected cybersecurity incidents

   • Response Planning
   • Communications
   • Analysis
   • Mitigation
   • Improvements

5. Recover - Restore capabilities impaired by cybersecurity incidents

   • Recovery Planning
   • Improvements
   • Communications

Implementation Tiers

• Tier 1: Partial - Ad hoc, reactive risk management
• Tier 2: Risk Informed - Risk management practices approved but not policy-based
• Tier 3: Repeatable - Formal policies, procedures updated regularly
• Tier 4: Adaptive - Adaptive approach based on lessons learned

Use Cases:

• General-purpose security program development
• Risk assessment and management
• Security posture evaluation
• Vendor risk management

CIS Controls (Center for Internet Security)

Best For: Practical, prioritized security actions for immediate implementation

Website: cisecurity.org/controls

The CIS Controls are a prioritized set of actions that collectively form a defense-in-depth set of best practices to mitigate the most common cyber attacks.

CIS Controls v8 (18 Controls)

Basic CIS Controls (Must implement first):

1. Inventory and Control of Enterprise Assets
2. Inventory and Control of Software Assets
3. Data Protection
4. Secure Configuration of Enterprise Assets and Software
5. Account Management
6. Access Control Management

Foundational CIS Controls: 7. Continuous Vulnerability Management 8. Audit Log Management 9. Email and Web Browser Protections 10. Malware Defenses 11. Data Recovery 12. Network Infrastructure Management 13. Network Monitoring and Defense 14. Security Awareness and Skills Training 15. Service Provider Management 16. Application Software Security

Organizational CIS Controls: 17. Incident Response Management 18. Penetration Testing

Implementation Groups

• IG1 - Basic cyber hygiene (small businesses, limited IT/security expertise)
• IG2 - Increased security for sensitive data (medium-sized organizations)
• IG3 - Advanced security programs (large organizations with security teams)

Use Cases:

• Prioritizing security investments
• Building security programs from scratch
• MSP baseline security standards
• Quick security wins

ISO/IEC 27001

Best For: Organizations requiring formal certification and international recognition

Website: iso.org/standard/27001

ISO 27001 is an international standard for information security management systems (ISMS). It provides requirements for establishing, implementing, maintaining, and continually improving an ISMS.

ISO 27001 Structure

Annex A Controls (93 controls across 4 themes):

1. Organizational Controls (37 controls)

   • Information security policies
   • Organization of information security
   • Human resource security
   • Asset management
   • Access control
   • Cryptography
   • Physical and environmental security
   • Operations security
   • Communications security
   • Supplier relationships

2. People Controls (8 controls)

   • Employment terms and conditions
   • Information security awareness, education, and training
   • Disciplinary process

3. Physical Controls (14 controls)

   • Physical security perimeters
   • Physical entry controls
   • Securing offices, rooms, and facilities
   • Equipment security
   • Storage media security

4. Technological Controls (34 controls)

   • User endpoint devices
   • Access rights management
   • Information access restriction
   • Secure authentication
   • Capacity management
   • Malware protection
   • Network security management
   • Security of network services
   • Segregation of networks
   • Web filtering
   • Secure coding
   • Security testing
   • Secure system architecture

Certification Process

1. Gap Analysis - Assess current state vs. ISO 27001 requirements
2. Scoping - Define ISMS boundaries
3. Risk Assessment - Identify and assess information security risks
4. Statement of Applicability (SoA) - Document which controls apply
5. Implementation - Deploy controls and document procedures
6. Internal Audit - Verify ISMS effectiveness
7. Management Review - Leadership evaluates ISMS performance
8. Certification Audit - External auditor validates compliance
9. Surveillance Audits - Annual audits to maintain certification
10. Re-certification - Full audit every 3 years

Use Cases:

• Organizations requiring formal certification
• International business operations
• Demonstrating security to customers/partners
• Comprehensive ISMS implementation

NIST SP 800-53 (Security and Privacy Controls)

Best For: Federal agencies and contractors; organizations seeking comprehensive control catalog

Website: csrc.nist.gov/publications/sp800-53

NIST Special Publication 800-53 provides a comprehensive catalog of security and privacy controls for federal information systems and organizations.

Control Families

1. Access Control (AC) - Limit system access to authorized users
2. Awareness and Training (AT) - Security awareness and training
3. Audit and Accountability (AU) - Event logging and monitoring
4. Assessment, Authorization, and Monitoring (CA) - Security assessments
5. Configuration Management (CM) - Baseline configurations
6. Contingency Planning (CP) - Backup, disaster recovery, business continuity
7. Identification and Authentication (IA) - User identification and authentication
8. Incident Response (IR) - Incident handling procedures
9. Maintenance (MA) - System maintenance activities
10. Media Protection (MP) - Protection of information media
11. Physical and Environmental Protection (PE) - Physical security
12. Planning (PL) - Security and privacy planning
13. Program Management (PM) - Information security program management
14. Personnel Security (PS) - Personnel screening and termination
15. PII Processing and Transparency (PT) - Privacy protections
16. Risk Assessment (RA) - Risk assessment activities
17. System and Services Acquisition (SA) - System development lifecycle security
18. System and Communications Protection (SC) - Network and communications security
19. System and Information Integrity (SI) - System monitoring and malware protection
20. Supply Chain Risk Management (SR) - Supply chain security

Control Baselines

• Low Impact - Minimal risk to operations, assets, or individuals
• Moderate Impact - Serious adverse effects
• High Impact - Severe or catastrophic adverse effects

Use Cases:

• Federal contractors (FedRAMP, CMMC)
• Organizations needing detailed control specifications
• High-security environments
• Aligning with federal security requirements

PCI DSS (Payment Card Industry Data Security Standard)

Best For: Organizations that handle credit card data

Website: pcisecuritystandards.org

PCI DSS is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.

12 Requirements (PCI DSS v4.0)

Build and Maintain a Secure Network and Systems:

1. Install and maintain network security controls
2. Apply secure configurations to all system components

Protect Account Data: 3. Protect stored account data 4. Protect cardholder data with strong cryptography during transmission

Maintain a Vulnerability Management Program: 5. Protect all systems and networks from malicious software 6. Develop and maintain secure systems and software

Implement Strong Access Control Measures: 7. Restrict access to system components and cardholder data by business need to know 8. Identify users and authenticate access to system components 9. Restrict physical access to cardholder data

Regularly Monitor and Test Networks: 10. Log and monitor all access to system components and cardholder data 11. Test security of systems and networks regularly

Maintain an Information Security Policy: 12. Support information security with organizational policies and programs

Compliance Levels

• Level 1: 6+ million transactions/year - Annual onsite audit
• Level 2: 1-6 million transactions/year - Annual self-assessment questionnaire
• Level 3: 20,000-1 million e-commerce transactions/year - Annual self-assessment
• Level 4: <20,000 e-commerce transactions or <1 million transactions/year - Annual self-assessment

Use Cases:

• E-commerce businesses
• Retail organizations
• Payment processors
• Any organization handling credit cards

HIPAA Security Rule

Best For: Healthcare organizations and business associates handling PHI

Website: hhs.gov/hipaa

The HIPAA Security Rule establishes national standards to protect individuals’ electronic personal health information (ePHI).

Safeguards

Administrative Safeguards (9 standards):

1. Security Management Process
2. Assigned Security Responsibility
3. Workforce Security
4. Information Access Management
5. Security Awareness and Training
6. Security Incident Procedures
7. Contingency Plan
8. Evaluation
9. Business Associate Contracts

Physical Safeguards (4 standards):

1. Facility Access Controls
2. Workstation Use
3. Workstation Security
4. Device and Media Controls

Technical Safeguards (5 standards):

1. Access Control
2. Audit Controls
3. Integrity
4. Person or Entity Authentication
5. Transmission Security

Required vs. Addressable

• Required - Must be implemented
• Addressable - Must implement or document reasonable alternative

Use Cases:

• Healthcare providers
• Health plans
• Healthcare clearinghouses
• Business associates (IT vendors, MSPs serving healthcare)

SOC 2 (System and Organization Controls)

Best For: Service providers (SaaS, cloud, MSPs) demonstrating security to customers

Website: aicpa.org

SOC 2 is an auditing procedure that ensures service providers securely manage data to protect the interests and privacy of their clients.

Trust Services Criteria

1. Security (Required for all SOC 2 audits)

   • Access controls
   • Logical and physical security
   • System operations
   • Change management
   • Risk mitigation

2. Availability (Optional)

   • System uptime and performance
   • Disaster recovery
   • Incident management

3. Processing Integrity (Optional)

   • Complete and accurate processing
   • Error detection and correction

4. Confidentiality (Optional)

   • Protection of confidential information
   • Data classification
   • Encryption

5. Privacy (Optional)

   • Personal information handling
   • Notice and consent
   • Data subject rights

SOC 2 Types

• Type I - Point-in-time assessment (controls are designed appropriately)
• Type II - 3-12 month assessment (controls are operating effectively over time)

Use Cases:

• SaaS providers
• Cloud service providers
• MSPs and IT service providers
• Organizations with enterprise customers requiring attestation

CMMC (Cybersecurity Maturity Model Certification)

Best For: Department of Defense contractors

Website: dodcio.defense.gov/CMMC

CMMC is a unified standard for implementing cybersecurity across the Defense Industrial Base (DIB).

CMMC Levels (CMMC 2.0)

Level 1: Foundational

• 17 practices from NIST SP 800-171
• Self-assessment
• For Federal Contract Information (FCI)

Level 2: Advanced

• 110 practices from NIST SP 800-171
• Third-party assessment (for priority programs)
• Self-assessment (for most programs)
• For Controlled Unclassified Information (CUI)

Level 3: Expert

• 110 practices from NIST SP 800-171 + subset of NIST SP 800-172 enhanced controls
• Government-led assessment
• For programs with highest priority CUI

NIST SP 800-171 Families

• Access Control (AC)
• Awareness and Training (AT)
• Audit and Accountability (AU)
• Configuration Management (CM)
• Identification and Authentication (IA)
• Incident Response (IR)
• Maintenance (MA)
• Media Protection (MP)
• Personnel Security (PS)
• Physical Protection (PE)
• Risk Assessment (RA)
• Security Assessment (CA)
• System and Communications Protection (SC)
• System and Information Integrity (SI)

Use Cases:

• DoD prime contractors
• DoD subcontractors
• Defense supply chain organizations

GDPR (General Data Protection Regulation)

Best For: Organizations processing EU residents’ personal data

Website: gdpr.eu

GDPR is a comprehensive data protection law in the EU that regulates how personal data is collected, processed, and stored.

Core Principles

1. Lawfulness, Fairness, and Transparency

   • Legal basis for processing
   • Transparent data practices

2. Purpose Limitation

   • Data collected for specific purposes
   • Not used for incompatible purposes

3. Data Minimization

   • Collect only necessary data
   • Adequate, relevant, limited

4. Accuracy

   • Keep data accurate and up-to-date
   • Ability to rectify inaccurate data

5. Storage Limitation

   • Retain data only as long as necessary
   • Defined retention periods

6. Integrity and Confidentiality

   • Appropriate security measures
   • Protection against unauthorized access

7. Accountability

   • Demonstrate compliance
   • Document data processing activities

Data Subject Rights

• Right to Access - Obtain confirmation of data processing
• Right to Rectification - Correct inaccurate personal data
• Right to Erasure (“Right to be Forgotten”) - Request data deletion
• Right to Restrict Processing - Limit data use
• Right to Data Portability - Receive data in machine-readable format
• Right to Object - Object to data processing
• Rights Related to Automated Decision Making - Human review of automated decisions

GDPR Requirements

• Data Protection Officer (DPO) - Required for certain organizations
• Data Protection Impact Assessment (DPIA) - For high-risk processing
• Privacy by Design and Default - Build privacy into systems
• Breach Notification - Report breaches within 72 hours
• Consent - Clear, explicit consent when required
• Cross-Border Data Transfers - Special protections for data leaving EU

Use Cases:

• Organizations with EU customers/users
• International businesses
• Organizations processing EU residents’ data
• Cloud service providers serving EU clients

Framework Comparison Matrix

Choosing the Right Framework

By Organization Type

Small Business (1-50 employees):

• Start with: CIS Controls IG1
• Add: NIST CSF for risk management structure
• If applicable: PCI DSS (e-commerce), HIPAA (healthcare)

Medium Business (50-500 employees):

• Core: CIS Controls IG2 or NIST CSF
• Consider: ISO 27001 for customer assurance
• If applicable: SOC 2 (if service provider), GDPR (EU operations)

Large Enterprise (500+ employees):

• Core: ISO 27001, NIST SP 800-53, or NIST CSF
• Enhanced: CIS Controls IG3
• If applicable: Industry-specific frameworks

Managed Service Provider (MSP):

• Baseline: CIS Controls IG2 for client environments
• Own operations: SOC 2 Type II
• Consider: ISO 27001 for competitive advantage

Government Contractor:

• Required: CMMC (DoD), NIST SP 800-53 (federal)
• Baseline: NIST SP 800-171 (CUI)

By Industry

Implementation Approach

Phase 1: Assessment (Weeks 1-4)

1. Select Framework(s)

   • Identify regulatory requirements
   • Consider customer expectations
   • Assess organizational capabilities

2. Conduct Gap Analysis

   • Document current security posture
   • Identify framework requirements
   • Map gaps between current and target state

3. Prioritize Controls

   • Risk-based prioritization
   • Quick wins vs. long-term projects
   • Resource availability

4. Develop Roadmap

   • Implementation timeline
   • Resource allocation
   • Milestones and deliverables

Phase 2: Planning (Weeks 5-8)

1. Define Scope

   • Systems and data in scope
   • Organizational boundaries
   • Exclusions and justifications

2. Assign Responsibilities

   • Control owners
   • Implementation teams
   • Management oversight

3. Document Policies

   • Information security policy
   • Acceptable use policy
   • Access control policy
   • Incident response policy
   • Business continuity policy

4. Create Procedures

   • Step-by-step implementation guides
   • Configuration standards
   • Operational runbooks

Phase 3: Implementation (Weeks 9-24+)

1. Technical Controls

   • Access controls
   • Encryption
   • Network security
   • Endpoint protection
   • Security monitoring

2. Administrative Controls

   • Security awareness training
   • Background checks
   • Vendor management
   • Risk assessments

3. Physical Controls

   • Physical access controls
   • Environmental protections
   • Media handling

4. Documentation

   • Control implementation evidence
   • Configuration baselines
   • System inventories

Phase 4: Testing and Validation (Ongoing)

1. Internal Audits

   • Quarterly control testing
   • Vulnerability scanning
   • Penetration testing

2. Management Review

   • KPI tracking
   • Incident review
   • Continuous improvement

3. External Assessment

   • Third-party audits
   • Certification audits
   • Penetration testing

Common Controls Across Frameworks

Most frameworks require these foundational controls:

Access Control

• User account management
• Multi-factor authentication
• Least privilege principle
• Access reviews

Asset Management

• Hardware inventory
• Software inventory
• Data classification

Vulnerability Management

• Patch management
• Vulnerability scanning
• Remediation tracking

Logging and Monitoring

• Centralized log collection
• Security monitoring
• Log retention

Incident Response

• Incident response plan
• Incident detection and reporting
• Forensics and recovery

Business Continuity

• Backup procedures
• Disaster recovery plan
• Business continuity plan
• Regular testing

Security Awareness

• Annual security training
• Phishing simulations
• Security policies acknowledgment

Vendor Management

• Third-party risk assessment
• Vendor contracts with security terms
• Vendor access controls

Mapping Between Frameworks

Many frameworks have significant overlap. Organizations can map controls to satisfy multiple frameworks simultaneously:

Example: Multi-Framework Control Mapping

Control: Multi-Factor Authentication (MFA)

Implementation: Deploy MFA for all remote access and privileged accounts, document in a single procedure that references all applicable frameworks.

Tools and Resources

Assessment Tools

Free:

• NIST CSF - NIST Cybersecurity Framework Self-Assessment
• CIS Controls - CIS-CAT Lite
• Microsoft - Microsoft Compliance Manager

Commercial:

• OneTrust - GRC platform supporting multiple frameworks
• ServiceNow GRC - Integrated risk and compliance management
• RSA Archer - Enterprise GRC platform
• Hyperproof - Compliance operations platform
• Vanta - Automated compliance for SOC 2, ISO 27001, HIPAA
• Drata - Security and compliance automation

Documentation Templates

• NIST - Risk Management Framework Documentation
• SANS Institute - Policy Templates
• CIS - Implementation Groups Guides

Training and Certification

• NIST CSF - NIST CSF Training
• ISO 27001 - Lead Auditor/Implementer courses
• CISSP - (ISC)² Certified Information Systems Security Professional
• CISM - ISACA Certified Information Security Manager
• CISA - ISACA Certified Information Systems Auditor

Maintaining Compliance

Continuous Monitoring

1. Automated Scanning

   • Vulnerability scanning (weekly)
   • Configuration compliance (daily)
   • Asset inventory (continuous)

2. Manual Reviews

   • Access reviews (quarterly)
   • Policy reviews (annual)
   • Vendor assessments (annual)

3. Metrics and KPIs

   • Mean time to patch
   • Security incidents per quarter
   • Audit findings remediation time
   • Security awareness training completion

Annual Cycle

Q1:

• Management review
• Budget planning
• Risk assessment

Q2:

• Internal audit
• Security awareness training
• Policy updates

Q3:

• Third-party assessments
• Penetration testing
• Disaster recovery testing

Q4:

• Vendor reviews
• Control effectiveness review
• Planning for next year

Common Pitfalls to Avoid

1. Choosing Wrong Framework

   • Select frameworks based on actual requirements, not perceived prestige
   • Don’t pursue ISO 27001 certification if customers don’t require it

2. Over-Engineering

   • Start with basics (CIS Controls IG1) before advanced controls
   • Implement controls appropriate to risk level

3. Documentation Overkill

   • Balance documentation with operational efficiency
   • Keep documentation concise and actionable

4. Set and Forget

   • Compliance is continuous, not one-time
   • Schedule regular reviews and updates

5. Ignoring People

   • Security awareness training is critical
   • Controls fail without user buy-in

6. Lack of Executive Support

   • Security programs require leadership commitment
   • Secure budget and resources upfront

7. Checkbox Mentality

   • Focus on actual risk reduction, not just compliance
   • Implement controls effectively, not just to check boxes

MSP-Specific Considerations

Client Security Baselines

Establish Baseline Security Standards:

1. Use CIS Controls IG1 as minimum for all clients
2. Document exceptions and risk acceptance
3. Regular compliance monitoring

Multi-Tenant Security

Isolate Client Environments:

• Separate logical or physical networks
• Separate credentials and access controls
• Separate backup environments

Supply Chain Risk

MSP as Business Associate/Service Provider:

• SOC 2 Type II for service assurance
• Liability insurance (E&O, cyber)
• Clear service level agreements
• Security addendums in contracts

Documentation Requirements

Per-Client Documentation:

• Network documentation
• Asset inventory
• Security configurations
• Incident response contacts
• Business continuity plans

Next Steps

1. Assess Current State

   • Inventory existing security controls
   • Document policies and procedures
   • Identify regulatory requirements

2. Select Framework(s)

   • Review framework comparison matrix
   • Consider organizational context
   • Align with business goals

3. Conduct Gap Analysis

   • Compare current state to framework requirements
   • Prioritize gaps by risk and effort

4. Develop Roadmap

   • Create implementation plan
   • Assign responsibilities
   • Establish timeline and milestones

5. Begin Implementation

   • Start with quick wins
   • Build momentum with visible progress
   • Communicate progress to leadership

Additional Resources

Official Framework Documentation

• NIST Cybersecurity Framework
• CIS Controls
• ISO 27001
• NIST SP 800-53
• PCI Security Standards Council
• HHS HIPAA Security Rule
• AICPA SOC 2
• CMMC
• GDPR Official Text

Industry Organizations

• SANS Institute - Security training and resources
• (ISC)² - CISSP and security certifications
• ISACA - CISM, CISA certifications
• Cloud Security Alliance - Cloud security guidance
• National Cyber Security Centre (NCSC) - UK government cyber security

Related Documentation

• Incident Response Runbook
• Backup and Recovery Procedures
• Network Documentation Standards

Last Updated: November 3, 2025

This guide provides a foundation for understanding and implementing security policy frameworks. Always consult official framework documentation and qualified security professionals for implementation guidance.