Chapter 1: Conducting a gap analysis

Step 1: Understand the client’s industry and regulatory requirements

In your role as a vCISO, aligning your client’s security strategy with the appropriate cybersecurity framework is critical. Frameworks provide structured guidelines and best practices that help organizations manage and reduce cybersecurity risks. 

The first step is understanding your clients’ specific needs, such as what industry they operate in and where they are located. These factors influence the regulatory environment they must adhere to, as different industries and regions have unique legal requirements and standards. Identifying these details helps ensure compliance and informs the selection of the appropriate framework to meet both regulatory obligations and business goals effectively.

How to determine your clients’ needs: 

• Identify industry/geographic regulations: Determine the specific regulations that apply to your client’s industry and geography. For example:

• Healthcare
• Finance
• Defense industry
• General businesses

HIPAA (Health Insurance Portability and Accountability Act)

PCI-DSS (Payment Card Industry Data Security Standard), NYS DFS Cybersecurity Regulation or DORA (EU specific)

NIST SP 800-171 or CMMC (Cybersecurity Maturity Model Certification)

GDPR (General Data Protection Regulation) if they handle personal data of EU citizens

• Review existing compliance needs: If your client is already subject to certain regulations, start with frameworks that align with these requirements.

Step 2: Align client’s needs to frameworks

Once you have a clear understanding of the industry regulations, business goals, and risk appetite, you can begin to match these with the most appropriate frameworks.

Popular Frameworks:

NIST Cybersecurity Framework (CSF)

 

A widely adopted framework that provides a comprehensive approach to managing cybersecurity risks, suitable for various industries.

ISO/IEC 27001

 

An international standard focusing on information security management systems (ISMS), ideal for organizations needing to prove their security posture through certification.

CIS Controls

 

A prioritized set of actions that help protect against common cyber threats, often used by organizations looking for a practical, actionable framework.

PCI-DSS

 

Specifically for organizations that handle credit card transactions, this framework ensures the security of payment card data.

HIPAA

 

Mandated for healthcare organizations, this framework focuses on protecting sensitive patient information.

CMMC

 

Required for U.S. government contractors, this framework ensures that contractors have adequate cybersecurity controls in place.

How to align client needs to frameworks:

• Align needs to frameworks: Align the regulatory requirements, business goals, and risk appetite with the appropriate frameworks. For instance, if your client is a healthcare provider, HIPAA is mandatory, but they may also benefit from the broader scope of the NIST CSF.
• Consider multiple frameworks: Some clients may choose to follow more than one framework. For example, a financial services firm may choose to comply with both PCI-DSS and ISO/IEC 27001.

Step 4: Evaluate the resources required

Each framework comes with its own set of requirements and complexity. It’s important to assess whether your client has the resources—time, budget, and personnel—to implement and maintain the relevant framework(s).

How to assess the required resources:

• Assess current resources: Evaluate the client’s existing IT and security teams, budgets, and tools to determine the level at which they can support the chosen framework.
• Consider scalability: If resources are limited, start with a basic framework like CIS Controls that can be scaled up to more complex and intensive frameworks like NIST or ISO/IEC 27001 as the client grows.
• Plan for certification: If certification is a goal (e.g., ISO/IEC 27001), consider the additional time and costs involved in the certification process.

Step 5: Communicate the decision to stakeholders

Once you’ve agreed upon the appropriate framework(s), it’s crucial to communicate this decision clearly to your client’s stakeholders, including management, IT teams, and other relevant departments.

How to do it:

• Create a clear rationale: Explain why specific frameworks were proposed, linking them to the client’s regulatory requirements, business goals, and risk appetite.
• Outline the implementation plan: Provide an overview of how the framework will be implemented, including timelines, responsibilities, and expected outcomes.
• Address concerns: Be prepared to answer any questions or concerns from stakeholders, especially regarding resource allocation, timelines, and potential impacts on business operations.