1. FISASCORE is easy to understand.
Information security is a complex discipline with many moving parts, but FISASCORE simplifies the communication about how your
information security program is performing. You don’t need to be an information security expert with years of experience to understand what FISASCORE is telling you. One simple number represents your overall risk, and additional indicators show where your most significant risks are.
2. FISASCORE can tell you what everyone else is doing.
Hundreds of organizations have received their FISASCORE and this allows for good, fact-based comparisons. One of the common questions we receive about information security is, “What is everybody else doing?” This question comes from the responsibility for due care/due diligence, liability, and knowing that there’s “protection in the herd.”
3. With a FISASCORE, you can track progress.
FISASCORE is a point of reference that should be used to track progress and
to determine whether risk is maintained within your tolerance. Your information security program and risks are always getting better or worse; they never stay the same. Questions about progress, regular reporting, and support for maintaining your information security program are all answered through the FISASCORE. The average FISASCORE is 567.72. An “acceptable” level of security is 660.
4. FISASCORE is objective.
FISASCORE is maintained by an independent organization that doesn’t do consulting work, and has no other
purpose but to provide accurate measurements of information security risk. In addition to organizational objectivity, the score is also objective. FISASCORE is calculated through the measurement of thousandsof objective characteristics that take much of the guesswork and opinion out of the equation.
5. FISASCORE is credible.
FISASCORE was developed over the course of more than 15 years through the work of seasoned information security practitioners and is now on its fifth major release.
FISASCORE is based on generally well-accepted information security standards. The
criteria for measurement are all referenceable to the NIST Cybersecurity Framework (CSF), and its supporting standards: NIST SP 800-53, COBIT, ISO 27001:2013, and CIS CSC.
6. FISASCORE represents risk.
Risk is the combination of vulnerabilities and applicable threats that manifest themselves into the likelihood of something bad happening and the impact if™it did. If there is no vulnerability (or weakness) in a control, there is no risk. If there is a vulnerability in a control without an applicable threat, there is also no risk. FISASCORE represents the analysis of hundreds of
controls, thousands of vulnerabilities and thousands of threats, resulting in likelihoods and impacts of bad events.
7. FISASCORE is comprehensive.
Fundamental to FISASCORE is our definition of information security: The application of
administrative, physical, and technical controls to protect the confidentiality, integrity and availability of information.
There are four Phases within FISASCORE:
• Phase 1 – Administrative Controls
• Phase 2 – Physical Controls
• Phase 3 – Internal Technical Controls
• Phase 4 – External Technical Controls
All four parts of the information security program must work well together. A weakness in one control can lead to a collapse of all others. The phases are further segmented into sections, and the sections are further segmented into controls. The final FISASCORE report is presented both high level and then digs deep in the details.
8. FISASCORE is an indicator of future losses.
As FISASCORE continues to evolve, we get closer to understanding the true losses behind information
security incidents and breaches. FISASCORE provides the framework for predicting future information security losses accurately, using the best information available.
Today FISASCORE is tied to research conducted by the Ponemon Institute for loss data.
9. There is fast-growing community support for FISASCORE.
The partner community behind FISASCORE is critical to its success. Partners works to generate
FISASCOREs for their clients, but the partner community is also vital to future improvements and considerations. The partner community participates in further improvements of the methodology, shares critical information, and evangelizes the need for a common information security language (provided by FISASCORE). Our partners include IT service companies, CPA firms, insurance brokers and security consulting companies.
10. FISASCORE is a competitive advantage.
Information security as a competitive advantage?
Yes, absolutely! FISASCORE is a representation of the efforts you’ve put into information security and it’s a demonstration that you know where your most significant information security risks are. Armed with this information, you can make an objective case to your customers that you take information security seriously, backed by experienced information security experts, a community of partners, and a clean methodology. Don’t forget the fact that you can now invest your information security dollars where they will have the greatest benefit.
