Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

  • Twitter
  • Facebook
  • LinkedIn

How to Build the Most Effective Information Security Framework

How to Build the Most Effective Information Security Framework

Build a comprehensive defense against cyberattacks with a strong information security framework that leverages the world's best standards and infosec tools. 

A term like "information security framework" can be interpreted in many different ways, and as such, there are a number of overlapping standards throughout the infosec field. 

Some of these are required for legal compliance — which must be followed to the letter if they apply to you — while others are technically voluntary but highly regarded throughout the industry. It’s wise to learn about all of these mandatory and voluntary standards and decide how best to adopt them alongside the right set of vulnerability assessment and interdiction tools. 

ISO standards: Firm foundations

Given that the International Organization for Standardization (ISO) has guidelines covering all major industries, it's little surprise that they created several focused on infosec: ISO 270011 and 27701.2 Both were created alongside the International Electrotechnical Commission. 

ISO 27001: Developed around a risk-based approach to information security, in which you continuously identify hazards and select controls to properly address them. ISO 27001's "controls" for infosec are divided into categories including a written security policy, HR security, asset management, access control, cryptography, physical and environmental security, incident management, business continuity management and compliance with government regulations.3

ISO 27701: Focused more on the specific issue of data privacy. In fact, its 2019 update was a direct response to the European Union's implementation of the General Data Protection Regulation (GDPR) the previous year. It requires organizations to factor protection of personally identifiable information (PII) into all information security risk assessments, and demands that data processors or controllers make PII protections their highest priority.4

Whether you're a small business or an enterprise with facilities in multiple countries, you're responsible for safeguarding not only customer PII but also that of your workforce. The international standards shouldn't comprise the whole of your infosec practice — in fact, in some cases that would mean being noncompliant - but receiving ISO certification makes a solid foundation for any business's information security program. (Combining the practices of ISO 27001 with a tool like Tenable.sc makes for a particularly potent defense against infosec threats.) 

It's wise to learn about all of the mandatory and voluntary standards when building your information security framework

CIS benchmarks: The infosec professional's infosec guidelines

The Center for Internet Security (CIS), a nonprofit dedicated to promoting sound infosec practices, refers to its Controls and Benchmarks5 as "the global standard … for securing IT systems and data against the most pervasive attacks." 6

To call CIS Benchmarks "detailed" would be a major understatement: The manual for Windows 10 Enterprise's latest version, for example, is 1,312 pages and covers every single facet of that operating system. It'd be wise to take a look through CIS's library of Benchmarks, find the documents most closely related to your operations and spend some time poring over them as you work to develop the ideal information security framework for your organization's unique needs. 

Industry- and government-mandated standards

All of the following may be required by either industry governing bodies or the government itself, with penalties applying for noncompliance. If your organization falls under their purview, their rules have to be part of your information security program.

HIPAA: If you handle personal health information in the U.S. for any reason, whether as a health care provider or as tertiary material (like employee health data for benefits administration purposes), you must follow the Health Insurance Portability and Accountability Act's (HIPAA) Security Rule.7 This mandates the establishment of "administrative, physical and technical safeguards" for any electronically stored PII.

HIPAA doesn't list specific infosec practices to abide by or tools to use. (This is why leveraging multiple standards is necessary to create an information security framework.) One thing that isn't vague, however, is HIPAA's penalty system: Violations can mean penalties ranging from $100 to $1.5 million, depending on an organization's level of culpability.8

PCI DSS: Any business, government department or nonprofit that processes debit or credit card payments is subject to the Payment Card Industry Data Security Standards (PCI DSS) created by Visa, MasterCard and American Express.9 PCI DSS has more specific requirements for organizations, such as around firewall configurations and encryption. Like HIPAA, violations incur fines — for government and private-sector organizations alike10 — but instead of being one-time payments, they accrue monthly until the noncompliant party corrects its practices. 

NIST: If you want a lucrative federal contract for your business, you'd better be ready to adopt and maintain the National Institute of Standards and Technology's (NIST) unique Cybersecurity Framework.11 But NIST's basic phases of information security are also an undeniably solid foundation for any organization: identifying cybersecurity risks, preemptively implementing appropriate protections, searching for and detecting anomalous network activity, and enacting immediate response and containment efforts in breaches' wake and data recovery.12

DISA: Although the requirements outlined in the Defense Information Systems Agency's (DISA) Security Technical Implementation Guides13 are only mandatory for the Defense Department, they're updated more frequently than almost any other infosec protocol, making them an excellent resource for developing your own framework. 

GDPR: These requirements affect any organization that collects or processes personal data from residents of EU member states.14 Almost all modern organizations will need to implement GDPR standards to at least some extent.

Security framework development 

The first step to any security framework is to get full visibility into your assets. Regardless of which framework you decide to go with, you can’t secure what you can’t see. A vulnerability assessment or vulnerability management solution can help you get a full picture of what’s on your network. 

Once you are ready to create the ideal information security framework, you obviously must start with standards you're legally obligated to follow (HIPAA, GDPR, NIST) and those for which noncompliance is fiscally devastating (PCI DSS). But beyond them, you should consider the value other standards can bring. 

For example, maybe ISO 27001 covers your infosec needs pretty well, but you appreciate CIS's exhaustive guidance for safeguarding the assets you host on Amazon Web Services. Adopting the relevant CIS standards can't hurt your cloud operations and will almost certainly help. Other voluntary certifications may not apply directly to your business, but it's still worthwhile to understand them before deciding whether to follow their guidelines. It's also critical to use vulnerability scanning, penetration testing and threat modeling to project how damaging attacks would be handled under different configurations. 

You need the right tools to help along the way - and at Tenable, we've got them. Nessus Pro, the industry-leading vulnerability assessment solution, is the ideal complement to many information security frameworks, including custom approaches. Alternatively, we offer solutions to help observe specific protocols, such as Tenable.sc's support for ISO 27001 compliance and Tenable.io's PCI ASV variant

Learn more and choose the product that’s right for you.

Start Your Free Nessus Trial

1. ISO, "ISO/IEC 27001 Information Security Management"
2. ISO, "ISO/IEC 27701:2019 Security Techniques," August 2019
3. IT Governance Blog, "ISO 27001: The 14 Control Sets of Annex A Explained," July 2020
4. IT Governance USA, "ISO 27701: Privacy Information Management Systems"
5. Center for Internet Security, "CIS Benchmarks"
6. Center for Internet Security, "About Us," July 2020
7. American Medical Association, "HIPAA Security Rule & Risk Analysis," December 2019
8. Modern Healthcare, "HHS to Cap HIPAA Fines Based on 'Culpability'," April 2019
9. PCI Security Standards Council, "Maintaining Payment Security"
10. FivePoint Payments, "Do Governments Need to Maintain PCI Compliance?", February 2018
11. National Institute of Standards and Technology, "NIST Cybersecurity Framework"
12. IT Governance USA, "What is the NIST Cybersecurity Framework?"
13. DoD Cyber Exchange, "Security Technical Implementation Guides (STIGs)"
14. GDPR.eu, "Does the GDPR apply to companies outside of the EU?"

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

Try for Free Buy Now
Tenable.io FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Nessus Professional Free


Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning


Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.



Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security


Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try for Free Contact Sales

Try Tenable Lumin


Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.