A preliminary study of cyber-security guideline using nist and iso 27001 standard : a case study of retailing and consumer business sector

Abstract

Today, the current COVID-19 crisis has altered people's lives and inspired them to conduct more business online. This increases susceptibility to cyberattacks. Retail is another business sector that is growing significantly during COVID-19; as a result, there is a greater likelihood of being the target of cyber-attacks. This may cause businesses to seek out measures that can help reduce vulnerability and the severity of potential risks. They hope to implement cybersecurity standards aiming at improving self-defense in order to effectively prevent, detect, respond to, and recover from cyber incidents. However, cybersecurity standards are a common topic of discussion and have generic structures and solutions that can be implemented by all organizations, regardless of business type, size, or industry. For this reason, business requires a new cybersecurity guideline that is specific, wherein key controls of various standard frameworks are integrated to decrease the amount of time for studying and understanding, and to be easy to manage. The result of this research is an analysis of the strengths, weaknesses, and overlap control areas of cybersecurity standards, aiming at developing a preliminary guideline for retail-specific cybersecurity that incorporates ISO 27001 and NIST standards. Consequently, the Preliminary Guideline is a valuable resource for retail industry organizations. Understanding what controls should be implemented and how to organize fundamental security measures can be beneficial. Additionally, it has the ability to improve the quality of security controls of businesses. Implication of the Thematic paper: This research is helpful for peopleware and Information Technology executives. This also has practical implications for a company's operation. It can help improve the effectiveness of network security operations and establish the foundation for future research in this area.