The Department of the Air Force Chief Information Officer has published a paper explaining the ‘cyber cake‘ concept to provide a structured, transparent framework to achieve a stronger cybersecurity posture.
FIPS Strategy as the Base
The Federal Information Processing Standards, or FIPS, strategy serves as the cyber cake’s base.
According to the concept paper, organizations should begin with FIPS to establish mandatory security standards for federal information systems and ensure a baseline of security to support broader cybersecurity strategies.
Risk Management Framework as the Platter
The National Institute of Standards and Technology’s Risk Management Framework, or RMF, serves as the platter, providing a structured approach that organizations can use to identify, evaluate and mitigate risks to protect information and systems.
The Cyber Cake’s 5 Layers
The 34-page document outlines the five layers of the cyber cake: the supply chain risk management, or SCRM, strategy; cybersecurity SCRM strategy, or C-SCRM; cyber resilience engineering framework, or CREF; zero trust strategy; and the MITRE Adversarial Tactics, Techniques and Common Knowledge, also known as the MITRE ATT&CK framework.
According to the concept paper, SCRM and RMF serve as the baseline frameworks, providing the key structure for the risk management and supply chain risk management practices that CREF and C-SCRM build on to address cybersecurity and resilience.
Meanwhile, CREF integrates principles from SCRM and RMF to help improve an organization’s ability to recover from cyber incidents.
The paper also cites other components of the cyber cake, including privacy; the NIST Secure Software Development Framework; controlled unclassified information; artificial intelligence and machine learning; and the NIST Cybersecurity Framework 2.0.
