Understanding “industry best practices” involves a simple process of distilling expectations for both cybersecurity and privacy requirements. This process is all part of identifying reasonable expectations that are “right-sized” for an organization, since every organization has unique requirements. It can be best to visualize “best practices” as a buffet of cybersecurity and privacy controls, where you select what is applicable to your organization, based on statutory, regulatory and contractual obligations.
Source: (18) Understanding Cybersecurity & Privacy Best Practices | LinkedIn