Oltre la Conformità: dalle scelte strategiche ISO e NIST 2.0 alla gestione proattiva del rischio

Abstract

Beyond Compliance: from ISO and NIST 2.0 strategic choices to proactive risk management
Today’s digital landscape requires a strategic approach to cybersecurity. This study presents a model (hereinafter also “Smartlex Model”), an operational and pragmatic model designed to simplify complex regulatory compliance into an easily applicable business management system. The Model is based on a multi-level alignment between operational security measures and the two international regulatory pillars: ISO/IEC 27001:2022 and the NIST Cybersecurity Framework (CSF) 2.0. The methodology generates an innovative mapping that associates operational measures with ISO controls and NIST categories. The practical usefulness of the Model is demonstrated as a crucial adaptation tool for organisations (known as “NIS entities”) subject to the obligations of the NIS2 Directive. This allows for the operational implementation of the essential risk management elements required by the regulation. The Model is designed to be scalable to any regulatory framework, reducing compliance costs and maximising operational effectiveness. Looking ahead, the Smartlex Model aims to evolve into a quantitative IT security measurement system, providing organizations with a tangible means of demonstrating their cybersecurity posture.