Maximising cyber risk management for your organisation

The importance of robust cybersecurity frameworks and cyber risk management is undeniable as businesses face increasingly sophisticated cyber threats. Adopting effective frameworks like the NIST (National Institute of Standards and Technology) Cybersecurity Framework and the Essential 8 is crucial for managing and mitigating these risks. 

These two frameworks have gained significant traction, particularly in Australia, for their ability to guide organisations in safeguarding their digital assets and maintaining a resilient cybersecurity posture.

The Essential 8, developed by the Australian Cyber Security Centre (ACSC), is a set of eight specific strategies aimed at improving an organisation’s cybersecurity posture. These strategies are designed to address the most common and impactful cyber threats. 

They include controls such as application whitelisting, patching applications, and regular backups. The Essential 8 is particularly prescriptive, offering a detailed, technical approach that provides organisations with clear actions to mitigate cyber risks. It also includes a maturity model that allows organisations to assess their current cybersecurity level and work towards improving it.

On the other hand, the NIST Cybersecurity Framework (CSF), originating from the National Institute of Standards and Technology in the United States, offers a broader, more comprehensive approach to cybersecurity. The NIST CSF is structured around the below core functions:  

• Govern 
• Identify
• Protect 
• Detect
• Respond
• Recover.
  
  

These functions provide a high-level overview of the steps an organisation should take to manage cybersecurity risks effectively. Unlike the Essential 8, NIST is not prescriptive; it doesn’t dictate specific technical controls but rather offers a flexible framework that organisations can tailor to their unique business needs and risk appetite.

According to Dr Mamello Thinyane, an expert in cybersecurity and digital inclusion and the Optus Chair of Cyber Security and Data Science, these two frameworks complement each other perfectly.  

“While the Essential 8 provides the foundational controls necessary to guard against the most common threats, the NIST CSF framework allows organisations to take a step back and consider their overall cybersecurity posture in a holistic manner,” he explains. 

By using both frameworks in tandem, organisations can ensure that they are not only covering the basics but also addressing more complex and emerging threats. 

In Australia, there is a growing emphasis on cybersecurity, driven by both regulatory requirements and the increasing frequency of cyber attacks. Government agencies and organisations that work closely with the government are often required to adhere to the Essential 8.  

However, as Thinyane points out, the Essential 8, while critical, is just the beginning. “The Essential 8 is designed to give organisations a strong foundation in cybersecurity, but it is by no means comprehensive enough to be the only framework in use. With its broader scope, the NIST CSF helps fill in the gaps by offering a more flexible approach that can adapt to the evolving threat landscape.” 

For mid-sized and large organisations, particularly those in sectors such as healthcare, finance, and government, the combination of these frameworks is invaluable. The Essential 8’s prescriptive controls provide immediate, actionable steps to mitigate shared threats, while the NIST CSF framework helps organisations think strategically about their cybersecurity posture, aligning it with business goals and risk management practices. 

Implementing these frameworks is not without its challenges. One of the most significant obstacles organisations face is the risk of treating these frameworks as mere checklists. Thinyane warns against this approach, stating, “It’s easy for organisations to fall into the trap of ticking off controls and assuming they are secure. However, cyber resilience maturity requires a continuous, organisation-wide commitment to managing and improving cybersecurity practices.” 

To overcome this, Thinyane recommends that organisations foster a culture of cybersecurity awareness that extends beyond the IT department. This involves engaging leadership and the broader organisation in discussions about cybersecurity risks and strategies. He emphasises the importance of viewing cybersecurity as a dynamic process that requires regular reassessment and adaptation as new threats emerge. 

As cyber threats continue evolving, so must the frameworks designed to combat them. Thinyane anticipates that the Essential 8 will remain relatively stable, with occasional updates to address new threats. However, he sees the NIST frameworks as having greater flexibility to adapt to emerging technologies such as artificial intelligence (AI) and the Internet of Things (IoT). 

For example, NIST has developed the AI Risk Management Framework (AI RMF) that provides organisations with a framework to manage risks associated with the design, development, and use of AI systems. For those organisations already conversant with the NIST CSF framework, the AI RMF should be immediately familiar, with the core functions of Govern, Map, Measure and Manage, which are further broken down into categories and subcategories. 

The NIST AI RMF not only complements the CSF with a specific focus on risks to AI systems; with its socio-technical framing and focus on impacts of AI on individuals, communities, organisations, and society, it should also seamlessly dovetail with ESG and GRC processes within organisations. 

“The strength of the NIST framework lies in its ability to be customised to an organisation’s specific needs and the flexibility to incorporate new types of threats as they arise,” Thinyane notes.

While the Essential 8 and NIST Cybersecurity Frameworks each offer unique benefits, their true power lies in their combined application. For organisations looking to strengthen their cybersecurity posture, starting with the Essential 8 provides a solid foundation while integrating the broader, more flexible NIST framework allows for a comprehensive and adaptive approach to managing cyber risks. As Thinyane aptly puts it, “Cybersecurity is not a one-size-fits-all solution; it’s a journey that requires both a solid foundation and a strategic, adaptive mindset.”

By leveraging both frameworks, Australian businesses can confidently navigate the complex cybersecurity landscape, ensuring they are well-prepared to defend against current and future threats.

Mamello Thinyane is the Optus Chair of Cybersecurity and Data Science and an Associate Professor in the STEM unit at the University of South Australia.

Mamello is a computer science academic, cross-disciplinary researcher, and information technology professional with an interest in collective intelligence, societal cyber resilience, human-centric cybersecurity, and critical data studies. He has over 15 years experience working with governments, industry, academia, and civil society organisations on digital development projects in Africa and Asia. He previously served as the Senior Research Advisor and Principal Research Fellow at the United Nations University institute in Macau, a Director of the Telkom Centre of Excellence in ICT for Development and an Associate Professor in the Department of Computer Science at the University of Fort Hare in South Africa, and a Visiting Researcher at the Australian Centre for Cyber Security at the University of New South Wales – Australian Defence Force Academy.

Mamello is passionate about the role of scientific research and technology innovation to advance sustainable good life for all.

Speak to one of our specialists 

With our world-class network, one of the largest teams of experts in Australia and a passion for superior account service, discover why we're the trusted partner for many of Australia's largest organisations.​ 

If you want to learn more about how to secure your network against any threats – anywhere, any time, speak to one of our network security specialists today by requesting a call back below.