Blue Team

Tools

Regulations vs Standards vs Frameworks vs Accreditation

• Regulations - 

  • Definition: Mandatory rules or laws set by a government or regulatory body.

  • Purpose: Protect public interests, e.g., health, safety, and the environment.

  • Enforcement: Enforced through legal means, with consequences for non-compliance. 

  • Examples: General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA)

• Standards - 

  • Definition: A Document that specifies the (mandatory or voluntary) requirements for a product, process, or service.

  • Purpose: Ensure a consistent level of quality and safety.

  • Enforcement: Enforced if incorporated into a contract or regulation; else it is a guideline.

  • Examples: ISO/IEC 27001 (Establishing Information Security Management Systems - ISMS) and Payment Card Industry Data Security Standard (PCI DSS).

• Frameworks - 

  • Definition: A voluntary system of rules, ideas, or beliefs used to plan or decide.

  • Purpose: Provide a structure or foundation for a system or process.

  • Enforcement: Not enforced; rather, it provides guidance.

  • Examples: NIST Cybersecurity Framework (CSF) - high-level structure (Identify, Protect, Detect, Respond, Recover, Govern) to manage risk.

• Accreditation -  

  • Definition: A voluntary process of certifying an organisation's compliance with standards.

  • Purpose: Demonstrate an organisation's commitment to quality.

  • Enforcement: Certification can be revoked if the organisation ceases to meet the defined standards.

  • Examples: ISO 27001 Certification (organisations demonstrate their ISMS meets the standard's requirements).