Cybersecurity Compliance

Focus on Standards

Abstract

As the number of cybersecurity threats continues to increase and the technological environment evolves, organizations widely adopt various standards to reduce risks and support compliance. However, few comparisons use a uniform set of criteria and also assess the approaches’ practical applicability and their ability to align with one another. With this in mind, the study specifically examines under what environmental conditions certain standards provide effective support.

The objective of the study is to present, in a synthesizing manner, the COBIT 2019, NIST CSF, C2M2, and ISO/IEC 27001:2022 standards, to compare them along selected attributes, and to illustrate the dilemmas of selection and implementation through a practical case study.

First, the authors define the conceptual boundaries of IT security and cybersecurity, emphasizing that cybersecurity is relevant not only for technical reasons but also from the perspective of organizational and managerial responsibility. Next, they outline COBIT 2019’s IT-governance-focused approach, which centers on maturity levels and performance measurement, and discuss the NIST CSF’s risk-based, industry-agnostic, modular structure. They also present the C2M2 maturity model optimized for critical infrastructures, as well as the certifiable ISMS requirements of ISO/IEC 27001:2022. To compare the standards, the authors developed a bespoke evaluation framework, which assesses the systems’ objectives, applicability, certifiability, industry focus, and implementation complexity, while also underscoring that there is no single “best solution” suitable for all organizations, since selection must take into account, among other factors, an organization’s specific goals and risk profile. As a complementary element, the article includes a case study that aims to illustrate the challenges of practical implementation and the need to formulate improvement recommendations through a gap analysis against ISO/IEC 27001:2022 conducted at a large industrial enterprise.

Based on the comparative analysis, the authors highlight that COBIT 2019 can provide a high level of support for aligning corporate IT governance with business objectives and incorporates a maturity perspective; however, it is not certifiable. Owing to its modular structure and industry-agnostic nature, the NIST CSF is particularly well-suited to managing cybersecurity risks. Although it does not rely on a maturity-based approach, it has the advantage of being able to be maintained alongside other standards. The strength of C2M2 lies in assessing the maturity of critical infrastructure and clearly identifying areas for improvement, and it is applicable not only to IT but also to OT environments. The formal requirements of an Information Security Management System (ISMS) are primarily based on ISO/IEC 27001:2022, which provides the implementing organization with a risk-based control system. Due to its certifiability and wide recognition, it can be regarded as a trust-building instrument in establishing and maintaining business relationships. It should be noted, however, that its implementation may require substantial resources, primarily because of administrative burdens. Complementing these findings, the case study shows that, in a large-enterprise IT environment, a gap analysis requires a deliberate definition of scope and prioritization based on system criticality; otherwise, conducting it may entail disproportionate resource expenditure. As a practical outcome, a structured classification of gaps was developed, which directly supported mitigating high risks, identifying areas with significant improvement potential, and preparing a prioritized action plan.

The most important conclusion of the study is that, also in the context of cybersecurity compliance, there is no single “best solution” that fits all organizations, since the choice must consider, among other factors, an organization’s specific objectives and risk profile; therefore, in many cases, the parallel or combined application of frameworks may deliver the greatest value. Accordingly, the authors identify, as a direction for future research, the development of methodologies that support, in a measurable way, the integration of different standards.