Widely accepted and trusted security-enhancing benchmarks are a fundamental driver of increased network security. Among the benefits specifically accruing to members:
IT users and network providers can use the benchmarks to evaluate their own operations.
The Center provides members with multiple benefits:
-
Enable members to base their security programs on recognized best practices from the combined expertise and knowledge of many different organizations, removing the current uncertainty that arises from multiple conflicting sources of guidance.
-
Provide better and lower cost solutions than creating in-house guidance from scratch or provide a much more fully developed starting point for customized benchmarks that they will build themselves; Provide shared audit methodologies, and accreditation of auditors and system administrators to enhance confidence in the results;
-
Increase public trust that their private data are safe;
-
Provide a best-practice benchmark based definition of ‘due diligence’ in risk management strategy.
Auditors may distinguish themselves by accreditation to the Center’s benchmarks and auditing methodologies and tools. Auditors may also license the accreditation methodologies and tools for offering as an additional service to clients.
Insurance providers may underwrite using the benchmarks as a basis, and require the insured to demonstrate and maintain compliance.
-
Benchmarks are a baseline for defining requirements for obtaining and maintaining insurance coverage;
-
Recognized benchmarks lower the cost and intrusiveness of underwriting evaluations;
-
Accrediting auditors/security evaluators provides additional confidence and quality control in overall risk assessment;
-
Overall, the center will help both to expand the market for cyber-security insurance, and to establish appropriate quality benchmarks.
B2B Networks will require compliance with the benchmarks as the basis for participation on the network – to provide a level of trust based on a common level of security actions by all network partners.
Managed Service Providers may use accreditation as a baseline requirement to define one dimension of ‘quality of service’ and distinguish themselves from non-accredited providers.
