CLUSIT framework, the Italian reference
A national reference for information security, assessed with the same method as the international standards. So the work done here stays valid if you need a certification one day.
For those who want to start from a national reference
CLUSIT, the Italian Information Security Association, brings together companies, professionals, universities and public bodies. It is best known for the Clusit Report, the periodic analysis of the most serious cyber attacks worldwide and in Italy.
Not every company needs an international certification to improve its security, and many prefer to start from a reference written in Italian and calibrated to the reality of Italy's economy, made up largely of small and medium-sized businesses.
The CLUSIT assessment is designed for them: a practical way to understand where you stand, without first having to tackle the language of an international standard. It is neither a legal requirement nor a certification scheme.
The areas of the assessment
Like every standard in Dottor Box, the CLUSIT framework is also read on the five security functions, so the results are comparable with those of the other frameworks.
- Identify: assets, data, risks and responsibilities
- Protect: access, configurations, training and backups
- Detect: monitoring and detection of anomalies
- Respond: incident handling and communication
- Recover: restoration and business continuity
- Organisation: roles, procedures and suppliers
The same method as the international standards
Two dimensions per requirement, a weighted score, a breakdown by function and a comparison with the other frameworks already assessed. Then the modules that close the gap.
| Area | How Dottor Box covers it |
|---|---|
| Measuring the gap | CLUSIT gap analysis on coverage (75%) and maturity (25%), comparable with the other standards |
| Assets and risks | Asset Management and Risk Assessment |
| Vulnerabilities | Vulnerability Assessment on the internal network, external network and web applications |
| Identity and cloud | Microsoft Entra ID and Google Workspace |
| People | Training and Cyber Awareness |
| Incidents | Incident Response and Data Breach |
| Continuity | Business continuity: BIA, plan and backup checks |
| Documentation | Company Documentation in a dedicated wiki, with its own login |
A starting point you will not throw away
Written in Italian
A reference designed for Italian companies, understandable even to non-specialists.
Comparable
The same coverage and maturity score as the other standards, on the same five functions.
Reusable
The work done also counts towards ISO 27001, the CIS Controls and NIS2.
Starting from a national reference does not mean falling behind: if you need a certification one day, the work done has already been measured with the same yardstick.
CLUSIT framework: frequently asked questions
Is the CLUSIT framework mandatory?
No. It is a voluntary reference: it is neither a law nor a certification scheme. It is used to measure and improve security from a perspective close to the reality of Italian companies.
Can I use it together with NIS2 or ISO 27001?
Yes. In Dottor Box all standards are assessed with the same method and read on the same five functions, so you see straight away how much of the work done for CLUSIT also counts towards your obligations or a future certification.
Does Dottor Box issue a CLUSIT certificate?
No. The platform measures and documents your situation; it does not issue certificates or certifications on behalf of third parties.
The modules that work for the CLUSIT framework
Risk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more SeeAsset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn more GovernTraining
E-learning for your staff, with a record of completed courses ready to show.
Learn more ComplianceISO/IEC 27001
The information security management system, from the SoA to the audit.
Learn more ComplianceCIS Controls · IG1
Basic cyber hygiene: the starting point for every SME.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.