CSF · ISO/IEC 27032:2023

Cybersecurity Framework
ISO 27032

The concept of Cyberspace requires a broader view of information security concepts than those that had been considered until now. This new concept combines aspects related to the interaction of people, software, and services on the Internet, supported by ICT environments distributed throughout the world with a complexity and uniqueness that was unimaginable a few years ago.

Phase I, Understanding the Organization
Immersion in processes and assets
Phase II, Risk Analysis
Threats, vulnerabilities, and impact
Phase III, Action Plan
Prioritization and alignment measures
Phase IV, Implementation
Proactive controls and measures
The standard

What is ISO/IEC 27032?

To address the challenges of Cybersecurity, which consists of security in Cyberspace, the ISO/IEC 27032 standard emerges, defining guidelines in this field and focusing on two areas: on the one hand, covering the gaps or spaces not addressed by previous security standards in this broader conceptual scope, where new attacks and their associated risks appear; and, on the other hand, the collaboration process between the agents operating in the current environment, in what is commonly called a Cybersecurity Framework or CSF.

Addressing the challenge of current Cybersecurity scenarios and thanks to the extensive experience of the Internet Security Auditors team, we designed a methodology that allows for the implementation of a CSF based on the ISO/IEC 27032:2023 standard, which includes four areas of focus or domains:

Information Security
Network Security
Internet Security
Critical Information Infrastructure Protection
Focus

Risk management in four areas

The Cybersecurity Framework that will be developed will take a risk management approach in 4 areas:

Prevention
Prevention is based on the implementation of measures and controls that limit and contain the impacts of potential cybersecurity events.
Protection and Detection
Where controls aimed at security management and security event monitoring are implemented in order to detect and protect against these types of events.
Response and Communication
We must be prepared for potential cybersecurity-related incidents, consisting of actions to mitigate adverse elements once they have materialized.
Recovery and Learning
Actions to restore cyberspace-related systems and services, and procedures will be defined to reduce the likelihood of these incidents occurring.

The process followed in our methodology is developed in five phases.

Methodology

Methodology phases

Organizational understanding
Risk Analysis
Action Plan
Implementation
Our services

How we work

01Understanding of the Organization
In this first phase, important immersion work is carried out in the company's processes to understand how they function and how their services use Cyberspace. To carry out this task, it will be necessary to:
  • Review products and services
  • Review the regulatory security framework in use
  • Collect and review security documentation
  • Understand information flows within processes
  • Understand the technical security measures implemented, etc
This phase will also allow for an inventory of assets for the services in scope.
02Risk Analysis
Decision-making regarding the security controls and measures to be implemented must be based on risk management and alignment with the company's needs. Therefore, this assessment will be carried out at this stage, considering, among others, aspects such as:
  • Critical assets
  • Threats
  • Vulnerabilities
  • Impact and risk
  • Responsibilities
This task is carried out in alignment with internationally recognized standards, which allow for its maintenance and management over time.
03Action Plan
In this phase, and thanks to the work carried out in previous phases, the plan will be drafted to identify the prioritization and measures that must be developed to achieve alignment with ISO/IEC 27032:2023 based on business requirements.

This Plan will address different strategies that will include and must be applied at different levels of the organization, including:
  • Policies
  • Role identification
  • Implementation methods
  • Affected processes
  • Technological controls
04Implementation
As such, this is typically the stage that will require the most effort, as it is where all the actions defined in the previous phase will be captured in the Action Plan. It is important to keep in mind that ISO/IEC 27032:2023 intends to compel those who implement it to be proactive in security measures, with a significant emphasis on prevention mechanisms in processes that make use of Cyberspace.

This phase of the project will therefore focus on the implementation of controls that must take into account the existing maturity level of security management and will consider, among others, aspects such as:
  • Existence of a Security Policy
  • Security procedures in SDLC
  • Existing frameworks for information exchange
  • Staff awareness plans
  • RA methodology
  • ICT monitoring
  • Incident management
In addition to this, in this phase of the project, additional controls will be established that will include:
  • Application-level controls: session management, data validation, attack protection, authentication processes, etc.
  • Server-level controls: secure configurations, patch management, monitoring, periodic reviews, etc.
  • End-user controls: OS updates, application usage, antivirus, security tools and configurations, etc.
  • Controls against social engineering attacks: Awareness programs, regular testing, security controls, etc.
Related Services
ISO 27001 Management Systems ISO 42001 AIMS Implementation NIS2 Implementation ENS implementation CRA Evaluation and Support PCI DSS Implementation and Certification GDPR / LOPDGDD Consulting

Scope of service

What this service covers

Asset inventory

Identification and cataloging of all service assets within the scope of the organization's cyberspace.

Risk analysis

Assessment of critical assets, threats, vulnerabilities, and impact aligned with international standards.

App controls

Session management, data validation, attack protection, and robust authentication processes.

Server controls

Security hardening, patch management, continuous monitoring, and periodic reviews.

End-user controls

Operating system updates, safe application usage, antivirus, and security configurations.

Social engineering

Awareness programs, regular phishing tests, and security controls against social engineering attacks.

Testimonials

What our clients say

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.

CISO
RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.

Yulian Colmenares
Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every way. Their team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

Andrés Mejía
Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón
Vice President & Associate VP CFO · Saint Louis University

As CFO of Fleurop-Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented toward online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.

Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the highest importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to conduct 4 internal and external vulnerability scans and an annual internal and external penetration test, but also because of the security and peace of mind our company wants to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.

Sergio Sainz de la Maza
CISO · Intaremit

At Grupo Arbulu, we have collaborated closely with Internet Security Auditors in the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca
CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

Miguel Acosta
Global CEO · Beruby

At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group

Frequently Asked Questions

We answer your questions

What is ISO/IEC 27032?

ISO/IEC 27032:2023 is an international standard that defines guidelines for addressing cybersecurity challenges, covering areas not addressed by previous standards and establishing collaboration processes between the various agents operating in cyberspace. It is structured into four domains: information security, network security, internet security, and critical infrastructure protection.

What is the difference between ISO 27001 and ISO 27032?

ISO 27001 focuses on information security management through an Information Security Management System (ISMS), while ISO 27032 specifically addresses cybersecurity in cyberspace, integrating aspects of the interaction between people, software, and services on the Internet. Both standards are complementary and can be implemented together.

Who is this service for?

To any organization that operates in cyberspace, has digital services and products, is governed by security regulations, or requires a comprehensive cybersecurity framework. It is especially relevant for companies with significant technological dependency and an Internet presence.

What are the four domains of the cybersecurity framework?

The four domains are: Information Security (protection of assets against unauthorized access), Network Security (protection of network infrastructure), Internet Security (protection of online users and services), and Critical Infrastructure Protection (safeguarding of systems that support essential functions).

Is ISO 27032 certifiable?

ISO/IEC 27032 is a guideline and best practice standard, not a certifiable requirements standard like ISO 27001. However, its implementation demonstrates cybersecurity maturity and can complement certifications such as ISO 27001 or frameworks like NIST CSF 2.0.

Contact

Do you need to implement a Cybersecurity Framework?

Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.

R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility. I recommend them without hesitation.

Request information

We will be in touch as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us