Integrating cost–benefit analysis into the NIST Cybersecurity Framework via the Gordon–Loeb Model

TLDR

The NIST Cybersecurity Framework is a widely adopted approach that recognizes organization‑specific risk management and encourages cost‑benefit evaluation, yet it lacks guidance on how to perform such analyses. This article proposes a method to integrate cost‑benefit analysis into the NIST Framework. The method employs the Gordon–Loeb model to determine cost‑effective cybersecurity spending and to select the appropriate NIST Implementation Tier. The analysis demonstrates that the Gordon–Loeb model provides a logical basis for cost‑benefit decisions when choosing a NIST Implementation Tier and identifies conditions that incentivize moving to a higher tier.

Abstract

Abstract The National Institute for Standards and Technology (NIST) Cybersecurity Framework has rapidly become a widely accepted approach to facilitating cybersecurity risk management within organizations. An insightful aspect of the NIST Cybersecurity Framework is its explicit recognition that the activities associated with managing cybersecurity risk are organization specific. The NIST Framework also recognizes that organizations should evaluate their cybersecurity risk management on a cost–benefit basis. The NIST Framework, however, does not provide guidance on how to carry out such a cost–benefit analysis. This article provides an approach for integrating cost–benefit analysis into the NIST Cybersecurity Framework. The Gordon–Loeb (GL) Model for cybersecurity investments is proposed as a basis for deriving a cost-effective level of spending on cybersecurity activities and for selecting the appropriate NIST Implementation Tier level. The analysis shows that the GL Model provides a logical approach to use when considering the cost–benefit aspects of cybersecurity investments during an organization’s process of selecting the most appropriate NIST Implementation Tier level. In addition, the cost–benefit approach provided in this article helps to identify conditions under which there is an incentive to move to a higher NIST Implementation Tier.