What is the ICDM Framework?
The Israeli Cyber Defense Methodology (ICDM), also known as The Corporate Defense Methodology is part of the National Defense Concept, which includes a variety of levels of security for the Israeli economy and organizational continuity. This methodology has been developed by Israel National Cyber Directorate (INCD) for the protection of Cyberspace in the public interest. It was published on April 18, 2017.
Among other things, the Israel National Cyber Directorate (INCD) was formed to develop, implement, and integrate a national cyber protection methodology (Government Decision No. 2444). In this context, the INCD has chosen to launch the Defense Methodology for organizations in the Israeli economy, beginning with government ministries.
ICDM sees the organization as a whole and allows for increased organizational resilience.
The organization will identify the related cyber risks using this approach, formulate a security response, and use this method to mitigate the risks appropriately.
The current Defense Methodology is based on the NIST Cybersecurity Framework, which connects clusters of defense controls. This framework enables organizations to defend against attacks, detect and contain them, and quickly recover from them. These controls are based on international best practices that have been adapted for the Israeli economy, with emphases and examples to help organizations base their decisions more effectively.
What are the requirements of the ICDM?
The ICDM establishes a consistent framework for guiding corporate responsibility in the development of a multi-year work plan for the organization’s security. The organization will identify the related risks, formulate a defensive response, and implement a program to minimize the risks using the approach specified in the framework.
The following are the key elements of the methodology’s requirements:
- Determining which of the following categories the organization belongs to:
- Category A: organizations with a low risk of being harmed as a result of cyber-attacks
- Category B: organizations with a high risk of being harmed as a result of cyber-attacks
- Developing a work plan for the organization:
In terms of constructing the work plan, the company would first determine what it needs to protect, the degree of protection needed, and the protection gaps in light of the desired situation, before constructing a work plan to close the gaps.
The framework presents a detailed explanation on how to configure the organization’s security goals and the degree of protection needed for Category A and Category B organizations.
The company must now recognize the controls that are expected of it for its various assets.
- Implementing a work plan:
The organization will understand the controls that must be implemented in order to reduce the cyber risks to which it is exposed. These controls will form the foundation of the organization’s risk-reduction strategy. The work plan for organizations professionally guided by a dedicated facilitator on behalf of the Israel National Cyber Directorate (INCD) will be strongly aligned with the sector facilitator’s direct guidance.
Why should you be ICDM compliant?
Cyberspace is the result of technological advancement, connectivity and a global internet connection. The increasing reliance on cyberspace brings technological development and tremendous progress for humans and the environment.
However, a dangerous space is emerging alongside these advancements, threatening businesses, the integrity of production, and the confidentiality of corporate data. Cyber-attacks have the potential to harm organizations and cease production processes, causing economic damage and harming the company’s reputation.
The State of Israel is engaged in a national attempt to defend civil cyberspace. It encompasses a variety of levels of security for the Israeli economy and its structural continuity.
The Corporate Defense Methodology motivates the raising of the level of organizational resilience through ongoing integration of processes, practices and protection guidelines. Although not required, the use of the Corporate Defense Methodology improves organizational resilience and reliability against cyber-attacks.
How to achieve compliance?
Implementing the ICDM framework entails following a systematic approach to protecting and mitigating cybersecurity risks that pose a threat to Israeli companies and all organizations across the world.
The steps include:
- Understanding which category your organization falls into – category A or B, as well as selecting the appropriate security strategy and controls for implementation
- Creating a list of all the important assets that require strong security
- Identifying the assets security gaps against the selected security strategy
- Developing and implementing a cyber defense strategy that includes process and security controls to close all the gaps
- Updating and maintaining defense strategies to align with ongoing technology advancements
Using the Centraleyes risk management platform allows organizations to manage their security and risk assessments while streamlining and simplifying the process during all stages of implementation.
The platform provides a set of short questions that guide organizations through identifying the threat levels in their organization, helping them recognize to which category they belong – category A or category B.
Once the category has been identified, the Centraleyes platform provides integrated questionnaires that are appropriate for the selected category, as well as a full mapping to the NIST CSF framework. With its user-friendly dashboards, you can visualize security threats, assess security gaps, assign tasks to team members, and even create automated remediation tasks.
Additionally, the Centraleyes platform provides automated data collection and analysis, real-time customized scoring and automated reports to assist organizations in meeting ICDM requirements, resulting in valuable time and money savings and more accurate data.
Organizations that deploy Centraleyes save time and resources, and increase their cyber resilience in a world of ever-evolving risks. It is truly cyber risk management reimagined.
Read more:
Hebrew
https://www.gov.il/he/departments/policies/cyber_security_methodology_for_organizations
English
https://www.gov.il/en/departments/policies/cyber_security_methodology_for_organizations https://www.gov.il/BlobFolder/policy/cyber_security_methodology_for_organizations/he/Cyber1.0_english_617_A4.pdf
