Implementing NIST CSF and CIS CSC in Gas Industry: A Model's Effectiveness and Acceptance Analysis
Roberto Villarreal, Flavio Alarcón, Luis Torrejón · 2023
During 2020, the pandemic intensified global cyberattacks, increasing by 50% in 2021. Since 2022, the war in Ukraine has exacerbated this situation, particularly in the oil and gas industry. This sector, considered critical infrastructure, faces cybersecurity challenges that demand a proactive approach combining technological and behavioral controls. Therefore, a cybersecurity model based on NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and CIS CSC (Center for Internet Security Critical Security Controls) is proposed to protect the technological platform of a natural gas company. This model consists of four stages: environment analysis, scope and risk appetite, control design, and finally, its development. This model was validated through the evaluation of the implemented controls and a survey of the staff, obtaining a 92.69% effectiveness and an 81.55% acceptance, thus achieving level 2 of NIST CSF, meeting the established objective.