Security controls

Frameworks can enable an organization to manage security controls across different types of assets with consistency.

All organizations certified to ISO 27001:2013 are obliged to transition to the new version of the Standard within 3 years (by October 2025).

The catalog of minimum security controls is found in NIST Special Publication SP 800-53.

[8] [9] The intersection of security risk and laws that set standards of care is where data liability are defined.

A handful of databases are emerging to help risk managers research laws that define liability at the country, province/state, and local levels.