Framework for the implementation of Business Cybersecurity

Abstract

Information and Communications Technology is often seen as a critical organisational asset. To prevent loss of revenue and money, as well as to protect organisational reputation, this asset must be protected from threats and vulnerabilities. Organisations use different standards, frameworks and best practices when addressing cybersecurity. These governance documents could be chosen based on legislative or corporate governance requirements, and are most often industry specific. These documents typically prescribe sets of controls to be implemented, such as technical controls, administrative controls and physical controls. Most of these documents also describe very specific capabilities that a business has to develop in securing their cyberdomain. Capabilities, consisting of people, processes and technology, are meant to achieve outcomes or effects, and are applicable to the operational domain. Initial research has shown that no cybersecurity capability development framework applicable to the business domain exists. In this article, a framework called the Business Cybersecurity Capability Development Framework (BCCapDev framework) is proposed. In developing the BCCapDev, a modular approach is followed, starting with the identification of requirements for such a framework. Input into the BCCapDev framework such as legal requirements and business governance requirements are identified. Existing standards, frameworks and best practices are consulted, and capabilities identified, as well as actors and stakeholders. Mechanisms to align BCCapDev processes with business are identified, as well as a methodology to build the capability. The framework is developed in such a way that it is modular, reusable, and independent to changes in standards, frameworks or best practices. The BCCapDev is also developed flexible enough to be industry neutral.