Why apply a security framework?
Many organisations already do quite a lot for their information security: firewall, antivirus, backups. What is often missing is the big picture. A security framework turns individual measures into a system that can be managed, demonstrated and improved.
The problem without a framework
Without a framework, information security usually grows out of events: an incident at a partner, a question from the board, a questionnaire from a large customer. Each event leads to measures – sensible, but unconnected. After a few years nobody knows exactly what is in place, who is responsible and where the biggest gaps are.
Typical consequences:
- Technical topics are well covered, organisational ones hardly at all – such as roles, suppliers or incident planning.
- The same questions are answered anew every year because evidence cannot be found.
- Budgets go into visible projects, not necessarily into the biggest risks.
- Management receives individual reports but no overall picture.
Seven benefits at a glance
1. Completeness instead of blind spots
A framework covers organisation, people, technology and processes. The ICT Minimum Standard, for example, ranges from the inventory through access rights and monitoring to recovery after an incident. If you align your approach with it, you see gaps that go unnoticed in daily business – for instance that nobody has assessed the dependency on a single IT service provider.
2. Priorities based on risk
Not every gap is equally important. Frameworks link measures to risks: ISO/IEC 27001 requires a risk assessment and risk treatment; the ICT Minimum Standard asks you to set your own protection level based on your risk appetite. This lets you explain why one topic comes first – to management and to auditors alike.
3. A common language
“We are secure” means one thing to IT and another to management. A framework gives everyone the same terms and the same structure. A statement such as “we are below target in the Detect function” is clear to everyone and can be checked.
4. Evidence for third parties
Customers, partners, auditors and insurers ask about information security. With a framework the answers are organised: for each control the status, the responsibility and the evidence. Questionnaires can be answered from existing documents instead of starting from scratch each time. Where formal proof is required, certification to ISO/IEC 27001 is possible.
5. Meeting obligations in a structured way
Several rules require appropriate security without prescribing how. The Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023, requires in Art. 8 data security appropriate to the risk through suitable technical and organisational measures. A framework helps to define and document such measures systematically. It does not, however, replace a legal assessment of the individual case.
6. Less effort with every repetition
The first round takes time: selecting controls, assigning owners, collecting evidence. After that, each review builds on the last. What is unchanged is confirmed, what is new is added. This saves effort above all when internal and external reviews use the same basis.
7. Making progress measurable
With maturity levels per control, “better than last year” becomes a number. You see which topics have improved, where the target has not yet been reached and – in groups with several companies – where one company lags behind the others.
What a framework does not do
A framework is a tool, not protection in itself. Three misunderstandings are common:
- Paper instead of effect: a policy nobody knows is not an implemented control. This is why good reviews distinguish between design and effectiveness.
- Everything at once: trying to bring every control to the highest level at the same time rarely gets you far. A realistic target per topic and an order based on risk work better.
- Ticking boxes instead of understanding: a framework describes what should be achieved. How to get there in your organisation is your decision – with expertise and a sense of proportion.
How to make use of the benefits
- Choose a framework: for Swiss SMEs the ICT Minimum Standard is an obvious starting point, for organisations close to certification ISO/IEC 27001. The article Which framework fits whom? helps you decide.
- Define the scope: which companies, sites and systems are included?
- Assess the starting point: honestly, control by control, with evidence.
- Plan measures: biggest risks first, with owners and deadlines.
- Repeat regularly: at least once a year so the picture stays current.
How such a review works in practice is shown in The internal security audit in 6 steps.
Frequently asked questions
Is a framework worthwhile for a small company?
Yes, if it fits the size. A small company does not have to document every control in full. Even a single, honest assessment reveals the most important gaps and helps to spend the budget where it matters. The ICT Minimum Standard is a lean way in.
How long does the first round take?
That depends on the scope, the number of systems and how much is already documented. Allow more time for the first round than for the following ones: selecting controls, assigning owners and finding evidence is a one-off effort.
Do we need outside help?
Not necessarily. Many organisations assess themselves and bring in specialists for individual topics or for an independent review. An outside view is especially useful for calibrating your own assessment.
How Audhive helps
Audhive keeps catalogue, assessment, evidence, risks and reports in one place. Data requests with due dates and reminders make sure evidence arrives; dashboards and the Executive Board show the status per tenant and across all tenants. More under Product.
Sources
- Fedlex: Federal Act on Data Protection (FADP), Art. 8
- Federal Office for Cybersecurity (BACS): ICT minimum standards (page in German)
- ISO: ISO/IEC 27001:2022