Should You Buy A DSP or CDPP?
ANSWER: In simple terms, the Cybersecurity & Data Protection Program (CDPP) is designed to address a specific framework (e.g., ISO 27002, NIST 800-53 or the NIST Cybersecurity Framework), whereas the Digital Security Program (DSP) is designed to address them all as a hybrid, "best-in-class" metaframework.
- The CDPP is designed to help a company align with a single cybersecurity framework (e.g., NIST CSF, ISO 27002 or NIST 800-53).
- The DSP is designed for companies that need to align with multiple cybersecurity and privacy frameworks and cannot be constrained by aligning with just ISO or NIST. This is also applicable to companies that need to efficiently manage both cybersecurity and privacy principles.
If your organization needs to address EU GDPR, CCPA, or any other privacy requirement, you should seriously consider the DSP instead of the CDPP, since the DSP contains a robust privacy section, in addition to its cybersecurity sections. When considering any of the newer laws, regulations and industry frameworks, they can be considered "two-sided coins" in regards to the interconnected nature of privacy and cybersecurity where there is a clear expectation that in addition to a formal cybersecurity program, that your organization also maintains a privacy program to maintain "secure practices" for both privacy and security:
When you lay out the various frameworks in a spectrum from "weaker" to "robust" the DSP provides the most comprehensive coverage. However, some companies only need/want to align with a single framework.
There are two main factors that will assist you in determining which product is best suited to your business: (1) content and (2) functionality. However, while both cover common requirements, only your organization's needs (current AND future needs in terms of meeting specific statutory, regulatory and contractual requirements) will ultimately determine which is the best fit for you.
|DSP vs CDPP Comparison||
|Procedures (separate product is available - CDPP or DSP Cybersecurity Standardized Operating Procedures (CSOP))|
|Metaframework (multiple cybersecurity & privacy framework alignment)|
|Single cybersecurity framework (e.g., NIST CSF, ISO 27002 or NIST 800-53)|
|Privacy coverage (e.g., GDPR, CCPA, etc.)|
|Metrics (including KPIs & KRIs)|
|Capability Maturity Model|
|Reference Mapping (Excel spreadsheet)||limited to CDPP framework selected|
|GRC-Importable (Microsoft Word & Excel formats)|
In terms of content, the scope of the DSP surpasses both versions of the CDPP, due to its structure and additional materials.
- “Best-In-Class” Structure – The CDPP versions are designed to stay true to NIST CSF, ISO 27002 or NIST 800-53, so their scopes are constrained by those specific frameworks.
We designed the DSP to avoid similar constraints by creating a hybrid framework that takes of best components of leading frameworks, while avoiding their weaknesses.
- The DSP currently covers over 100 laws, regulations and industry frameworks to allow alignment with multiple requirements with one document!
- The DSP is directly mapped to the Secure Controls Framework (SCF), which is a free resource for companies that need cybersecurity and privacy controls.
Controls & Metrics - While both the CDPP and DSP contain policies, control objectives, standards and guidelines, the DSP in unique in that it contains controls and metrics (including KPIs and KRIs).
- This added content can save a company several months’ work from developing their own control wording and associated metrics!
This allows organizations to rapidly advance their cybersecurity program’s maturity by being able to PROVE that security is in place through metrics reporting!
Graphically, the difference in content can be seen in the comparison below (note – this just shows a fraction of what the DSP is mapped to, due to space limitations).
In terms of functionality, the CDPP and DSP both come in Microsoft Word formats, so that it is easy to edit for your needs and gives our clients a wide range of methods to share the content. The difference is in added functionality that can save hundreds of hours in staff and consultant time!
- With the DSP, we did something different where we also put the DSP’s content into a Microsoft Excel format, so that it is importable into other tools or databases.
- Specifically, this Excel formatting makes it a breeze to import it into a Governance, Risk & Compliance (GRC) tool, such as Archer, RSAM, MetricStream, MyVCM, ZenGRC, ServiceNow, etc.
- If you are currently using a GRC tool or are planning one within the next few years, the DSP is the product you will want to buy, since it can save you hundreds of hours in formatting and preparation time.
One of the biggest differences in functionality is in the controls used by the CDPP vs the DSP. The CDPP does its best to stay true to the aligned framework (e.g., NIST CSF, ISO 27002 or NIST 800-53). However, the DSP leverages the Secure Controls Framework (SCF) to map to over 100 different laws, regulations and industry frameworks.
US GOVERNMENT & DOD CONTRACTORS
On a daily basis, we receive questions from government / DoD contractors about both NISPOM and NIST 800-171 (DFARS). Both the NIST 800-53 version of the CDPP and the DSP will allow an organization to comply with both NISPOM and NIST 800-171. Just as explained above, the DSP will just give you far more usefulness if you want to mature your security program beyond policies and standards.