Insights: security frameworks, audits and ICS
What a security framework is, which one fits you and how to check it in everyday work – explained for management, IT leads and advisers. Without jargon, with sources.
Fundamentals
What is a security framework?
Framework, standard, control, evidence: the terms clearly separated – and how ISO/IEC 27001, the ICT Minimum Standard and the NIST CSF are built.
7 min read
FundamentalsWhy use a security framework?
Completeness, risk-based priorities, a common language and solid evidence: what a framework brings – and what it does not.
6 min read
FundamentalsWhich framework fits whom?
SMEs, companies, groups, municipalities, critical infrastructure operators and advisers: which framework is the obvious choice and why.
6 min read
Frameworks compared
ISO 27001 vs. ICT Minimum Standard
A certifiable management system or a pragmatic federal catalogue of measures? The differences in detail and a guide to choosing.
7 min read
Frameworks comparedThe ICT Minimum Standard for SMEs
Five functions, 23 categories, 108 measures: how the Swiss standard is built and how an SME can get started pragmatically.
6 min read
In practice
Understanding maturity levels: 0 to 5
What the levels mean, how to assign them consistently, which target makes sense – and why an average alone says little.
6 min read
In practiceThe internal security audit in 6 steps
From scope through assessment, data requests and findings to the report and follow-up – a proven sequence.
6 min read
In practiceInternal control system (ICS)
What an ICS is, what Swiss company law says about it, how it is structured according to COSO and where it touches information security.
6 min read
See Audhive in the demo
Catalogues, assessment, data requests and reports with fictitious data – access by e-mail.