Cyber Security Frameworks (CSFs): An Assessment Between the NIST CSF v2.0 and EU Standards

The rapid increase in volume and sophistication of Advanced Persistent Threats (APTs) bring growing threat of attack on critical Communications and Information Systems (CISs). This risk prompts practitioners in the field of Cyber Security to baseline CIS to achieve a targeted security posture and perform continuous assessments to ensure both maintenance and improvements to this posture. This is especially vital in the defence industry given the criticality of CIS to mission assurance in the Air, Land, Sea and Space domains. Security in Space, which has been recognized as NATO’s newest operational domain, is vital to ensure commensurate practices are upheld to support the Space Commander with their missions. To do this, a Cyber Security Framework (CSF) can be leveraged. CSFs “…provide guidelines and best practices for developing, implementing, and maintaining a cybersecurity program tailored to an organization’s needs.” [1] Standardization of a single framework for use does not, however, exist. This paper compares the commonly adopted and broadly used NIST CSF v2.0 [2] with a standard emerging from the European Union to compare suitability and identify gaps to ensure holistic cyber security coverage for the defence sector where Cyber is viewed as an enabler to missions in the Space domain.