Business cyber security challenges fall into six areas that match the NIST Cybersecurity Framework functions. Those areas are governance, risk visibility, protection, detection, response and recovery. Organizations of every size can use the framework. Start with the weakest area and add basic account protection for your staff.
Your business stores customer data, sends email and relies on cloud tools. Every one of those habits creates a security duty.
This guide sorts the challenges into six areas that official guidance already uses. You can then see which area needs your attention first.
How do You Organize Cyber Security Challenges?
NIST Cybersecurity Framework 2.0 describes six functions and states that the framework is tailored for use by all organizations regardless of size. See NIST Cybersecurity Framework 2.0.
| Function | What NIST States | Business Challenge |
|---|---|---|
| Govern | Strategy, expectations and policy are established, communicated and monitored | Nobody owns security decisions |
| Identify | Current cybersecurity risks are understood | You do not know which data and systems matter most |
| Protect | Safeguards manage the organization risks | Weak passwords, missing updates and open access |
| Detect | Possible attacks and compromises are found and analyzed | Attacks go unnoticed |
| Respond | Actions regarding a detected incident are taken | No plan exists when an incident starts |
| Recover | Affected assets and operations are restored | Backups are missing or untested |
My plain language reading fills the third column and it is not a NIST quote.
Why is Governance the First Challenge?
Security decisions stall when no person owns them. Name one leader for policy and budget and write down who approves access to company data.
How do Staff Habits Create Risk?
CISA lists four basic behaviors for everyone. Recognize and report phishing, use strong passwords with a password manager, enable multifactor authentication and update software. See Secure Our World.
Your staff handle these four tasks every day. One missed update or reused password can open a path into your systems.
Why do Visibility and Detection Matter?
You cannot protect data that you have not listed. Maintain a current list of systems, cloud services and data types. Review logs and alerts on a schedule so an attack does not go unseen.
What should You Prepare for Response and Recovery?
- Write a short incident plan with names and phone numbers.
- Decide who speaks to customers and regulators.
- Store backups on a separate system and test a restore.
- Practice the plan once a year.
For a ransomware example see what a ransomware playbook contains. For cloud specific threats see the top security issues in cloud computing.
Frequently Asked Questions
What is the Biggest Cyber Security Challenge for Small Business?
NIST does not rank challenges. It states that its framework applies to every organization regardless of size, so start with the area where you have the least protection.
What are the NIST Cybersecurity Framework Functions?
Govern, Identify, Protect, Detect, Respond and Recover.
Does My Business Need an Incident Plan?
Yes. NIST describes Respond as the actions taken after an incident is detected. Your plan decides those actions before you need them.
What Basic Steps does CISA Recommend?
Recognize phishing, use strong passwords, enable multifactor authentication and update software.
Do Backups Count as Security?
Yes. NIST describes Recover as restoring assets and operations after an incident, and backups make that possible.
Key Takeaways
- Business cyber security challenges fit six NIST functions.
- NIST tailors the framework for organizations of every size.
- Four staff habits address basic attack paths.
- Visibility and detection need a current list of systems and data.
- Tested incident plans and tested backups make recovery possible.
Sources and References
This guide follows NIST and CISA documentation.
- The NIST Cybersecurity Framework 2.0 (NIST) nvlpubs.nist.gov
- Secure Our World (CISA) www.cisa.gov