NIST CSF Mapping to Security Controls and Benchmarking to CMMI Maturity Model

 

Executive Summary:

This report presents a comprehensive analysis of a healthcare company's cybersecurity controls across various sites. The analysis aligns these controls to the NIST Cybersecurity Framework and evaluates their maturity levels using the Capability Maturity Model Integration (CMMI) from Level 1 to Level 5. The goal of this assessment is to identity strengths and weaknesses in the company's cybersecurity posture, that will ultimately lead to recommendations to improve security and protect sensitive healthcare data. 

 Background:

Our client, a healthcare company has recognized the need to access their cybersecurity controls and understand their maturity levels to effectively ensure protection against emerging threats. 

Summary of Findings:

NIST CSF Control Mapping-

 The assessment mapped the cybersecurity controls to the NIST CSF controls, categorizing them into five functions: Identify, Protect, Detect, Respond, and Recover. 

Identify: The company has identified assets, assessed cybersecurity risk, and established a foundation for their cybersecurity program. 

Protect: Protection controls are in place, including encryption, access controls and security awareness training. However, there is room for improvement. The company should ensure consistent implementation across all locations. 

Detect: The company has invested in log monitoring. intrusion detection systems but refinement is needed to enhance threat detection capabilities. 

Respond: The incident respond plan is well documented but improvements could be made across the locations in terms of speed and efficiency. 

Recover: The company has a disaster recovery plan, but it needs to be more comprehensive to ensure business continuity in case of a catastrophic event. 

The CMMI Maturity Levels- 

Level 1- Initial: The company's cybersecurity controls are inconsistent and lacks a defined strategy.

Level 2- Managed: Controls are documented but there is a requirement for standardized processes and procedures to improve overall maturity. 

Level 3- Defined: The company has established cybersecurity processes and practices that are consistently applied across most locations. 

Level 4- Quantitatively Managed: Metrics and data-driven decision making are becoming part of the cybersecurity program. 

Level 5- Optimizing: The company optimizes it's controls and processes for effectiveness while improving its cybersecurity practices. 

In summary, there are opportunities for improvement in terms of detection, response, and recovery capabilities. Furthermore, there are discrepancies in the company's cybersecurity maturity levels across locations, indicating a need for standardization and reinforcement of controls in certain areas.

The following approach will help to strengthen the cybersecurity posture and align with industry best practices: 

Company Security Control	Description of Company Security Control	NIST CSF Control	Description of NIST CSF Control	Meeting with Stakeholders	Stakeholders Response	CMMI
Asset Inventory	Maintain an up-to-date inventory of all hardware and software assets, including servers, workstations, and medical devices.	Identify	Develop an understanding of managing cybersecurity risk to systems, assets, data, and capabilities.	Interview with IT Manager	The organization has processes for asset inventory management, and they update their inventory regularly.	Level 3
Risk Assessment	Conduct regular risk assessments to identify vulnerabilities and potential threats to patient data.	Identify	Assess and prioritize risks to patient data and other critical assets.	Interview with Chief Security Officer	The organization performs risk assessments periodically but lacks a process to consistently to address identified risks.	Level 2
Access Control Policies	Enforce strict access control policies and user authentication mechanisms to ensure authorized access to patient records.	Identify	Establish and maintain access controls to protect sensitive patient information.	Interview with Compliance Officer	Access control policies are defined and consistently enforced, ensuring protection of patient data.	Level 3
Data Classification	Categorize healthcare data into different levels of sensitivity and apply appropriate security measures accordingly.	Identify	Implement data classification and protection measures based on sensitivity.	Interview with Data Privacy Officer	Data classification lacks consistent implementation and associated protection measures.	Level 2
Firewalls and Intrusion Prevention Systems	Implement firewalls and intrusion prevention systems to protect the network perimeter from unauthorized access and attacks.	Protect	Implement safeguards to limit or contain the impact of a security breach.	Interview with Network Administrator	Firewalls and intrusion prevention systems are in place but require further optimization for maximum effectiveness.	Level 2
Encryption	Encrypt sensitive data both in transit and at rest to maintain confidentiality.	Protect	Implement data protection measures to safeguard patient data.	Interview with Chief Information Officer	Encryption measures are robust and effectively safeguard sensitive data in all relevant scenarios.	Level 4
Antivirus and Anti-malware	Deploy antivirus and anti-malware solutions on all endpoints to detect and mitigate threats.	Protect	Implement protective measures against malicious software.	Interview with Security Awareness Trainer	Antivirus and anti-malware solutions are present but not consistently implemented or updated, leaving endpoints vulnerable.	Level 1

 

Company Security Control	Description of Company Security Control	NIST CSF Control	Description of NIST CSF Control	Meeting with Stakeholders	Stakeholders Response	CMMI
Security Awareness Training	Regularly educate employees on cybersecurity best practices to prevent social engineering attacks.	Protect	Promote cybersecurity awareness and best practices among staff.	Interview with HR Manager	Security awareness training is conducted regularly, improving overall employee awareness and cybersecurity practices.	Level 3
Intrusion Detection Systems	Employ IDS to detect and alert on potential security breaches and anomalies in network traffic.	Detect	Implement monitoring and detection mechanisms for security incidents.	Interview with SOC Analyst	IDS is in place, but there is room for improvement in fine-tuning alerts and response capabilities.	Level 2
Security Information and Event Management	Utilize SIEM tools to aggregate and analyze security event data for early threat detection.	Detect	Establish continuous monitoring and timely detection of security events.	Interview with SIEM Administrator	The SIEM system effectively collects and analyzes security event data, providing timely threat detection.	Level 3
Log Monitoring	Continuously monitor and review system logs for signs of suspicious activities or unauthorized access.	Detect	Monitor and analyze system activities for security events and policy violations.	Interview with Compliance Officer	Log monitoring processes are robust, ensuring timely detection of security events and policy violations.	Level 5
Incident Response Plan	Maintain a well-defined incident response plan outlining roles, responsibilities, and procedures in the event of a security breach.	Respond	Develop and implement an incident response capability.	Interview with Incident Response Team Lead	The incident response plan is comprehensive and well-implemented, enabling a rapid and effective response to security incidents.	Level 3
Security Incident Reporting	Establish a process for employees to promptly report security incidents to the designated incident response team.	Respond	Report security events and incidents to appropriate internal and external authorities.	Interview with Legal Counsel	While incidents are reported, there is room for improvement in ensuring timely reporting to external authorities.	Level 2
Communication Plan	Develop a communication plan to inform affected parties, such as patients and regulatory authorities, in case of a data breach.	Respond	Communicate effectively with stakeholders during and after security incidents.	Interview with Public Relations Manager	The communication plan is effective in transparently communicating with stakeholders during security incidents.	Level 3
Data Backups	Regularly back up patient data and critical systems to ensure data recovery in case of data loss or ransomware attacks.	Recover	Ensure timely recovery and restoration of systems and data after an incident	Interview with Backup and Recovery Specialist	Data backups are in place, but recovery procedures need refinement for faster restoration.	Level 2
Business Continuity Plan	Develop a comprehensive business continuity plan to maintain essential operations during and after a security incident.	Recover	Ensure continuity of healthcare services in the face of disruptions.	Interview with Business Continuity Manager	The business continuity plan effectively maintains essential operations during and after security incidents.	Level 3
Incident Review and Lessons Learned	After an incident, conduct a post-incident review to identify areas for improvement and update security controls accordingly.	Recover	Continuously improve response and recovery processes based on lessons learned.	Interview with Chief Information Security Officer	The organization conducts thorough post-incident reviews, driving continuous improvement in response and recovery processes.	Level 3

 

The healthcare company has received this report, the following recommendations are proposed:

1. Implement the cybersecurity controls across all locations and focus on the NIST CSF functions. 

2. Continue to access and update the cybersecurity practices to achieve higher CMMI maturity levels.