Cybersecurity standardization is a way to describe how
to do cybersecurity in an organized way.
It's just like, for example, when we speak on the cell phone
or when we use wifi, this is a result of standardization.
So in cybersecurity there are lots
of different ways of doing things.
Standards are written by experts,
who create them in a consensus based way.
And so companies can pick up these documents,
and instead of creating something from scratch
or from their own experts, they have the benefit
of the expertise of the world at their fingertips.
So regulators also use cybersecurity standards sometimes
as a way to point to something
that the organization should do.
But regulators will also look
at standards when they are writing their regulations
as a reference point.
So companies could use standards in an effort
to get ahead of the regulators,
and anticipate what might come out at them at a later date.
Companies get numerous benefits
from cybersecurity standardization.
First and foremost, they get the benefit
of somebody else who is an expert,
multiple somebody elses who are experts,
capturing the information in a standard,
in an organized, simple way.
A company can also demonstrate compliance
for this regulatory requirements.
A company can also demonstrate
to the other companies, to its business partners
who buy its products and services
that it performs good cybersecurity.
Cybersecurity in a company is not limited
to just that business.
So let's say a utility has electricity stuff.
It might take credit cards if it's a distribution
to its utility customers, then it stores customer data.
It might also store employee data,
so it's subject to utility regulations,
then it's subject to data privacy regulations,
then it could be subject to some other things,
for example, for credit cards.
So a standard can help kind of harmonize
all of that, and create a single way
of doing business in different ways
of describing it according to the regulation.
The beauty and the benefit of the standards
is that once the company adopts a framework,
a standard framework,
they can anticipate the next thing happening.
They can anticipate the next regulation.
So standards really help us manage the fact
that cybersecurity is an evolving challenge,
and they help us put a structure
around it and ensure that we do it well.