Cybersecurity Frameworks: NIST CSF, ISO 27001 and CIS

The first time a client asked me "should we get ISO 27001?", I asked why. The answer was that a large customer's procurement questionnaire had a box for it. That's a perfectly good reason — it's also the reason frameworks have a bad reputation. Approached as a box to tick, they become a document-generation exercise that produces certificates and changes nothing. Approached as what they actually are — the distilled experience of thousands of organisations about what a security programme needs — they save you years. Cybersecurity frameworks exist so you don't have to reinvent the discipline; this post is about using them without drowning.

This is the last foundation in the series, and it's the one that ties the others together. The CIA triad, threat modelling, risk, authentication, authorisation, cryptography, defence in depth, the human layer, visibility — a framework is a structure for making sure you've covered all of them, consistently, and can prove it.

Part 10 of 10 · Foundations of Infosec. Previous: Incident Response.

Key takeaways

Cybersecurity frameworks give completeness, a common language and prioritisation — not a guarantee.
NIST CSF 2.0 for structure and leadership language; CIS Controls IG1 as the concrete to-do list; ISO 27001 when the market demands certification.
Start with an honest self-assessment, prioritise by your own risk, implement before documenting.
Attach numbers (MFA coverage, patch time, restore time) and keep the review cycle turning.

What cybersecurity frameworks are for

A security framework does three things:

Completeness. It's a checklist of the areas a programme needs to address, so you don't discover a gap by falling into it.
Common language. When your customer, your insurer, your auditor and your board all reference the same framework, "how secure are you?" becomes a conversation with structure instead of vibes.
Prioritisation. The good ones tell you what to do first.

What a framework is not is a guarantee. Certified organisations are breached regularly. The certificate says a management system exists and was audited; it doesn't say the controls work against your actual threats. That's what your threat model and risk assessment are for, and every serious framework requires them precisely because the framework alone can't know your situation.

NIST Cybersecurity Framework 2.0

The NIST CSF began in 2014 as guidance for US critical infrastructure and became, somewhat unexpectedly, the most widely adopted security framework in the world. Version 2.0, released in February 2024, explicitly broadened its scope to all organisations of any size and sector.

The CSF organises everything into six functions, which are the best one-line summary of a security programme I know:

Govern — new in 2.0. Establish the strategy, roles, policies and oversight. Security is a leadership responsibility, not an IT one.
Identify — understand your assets, your risks and your suppliers. You can't protect what you don't know you have.
Protect — the controls: identity and access, awareness, data security, platform security, resilience.
Detect — continuous monitoring and analysis to find adverse events.
Respond — incident management, analysis, communication, mitigation.
Recover — restore operations and communicate about it.

Each function breaks into categories and subcategories — about a hundred outcomes in total — phrased as what should be true ("access to assets is limited to authorised users") rather than how to achieve it. That's the CSF's character: it's a framework for organising and communicating, not a prescriptive control list. It maps to other standards (ISO 27001, CIS Controls, NIST SP 800-53) through published crosswalks, so it works well as the top-level structure with more specific controls underneath.

Use it when you need a language for talking to leadership and a way to assess where you are. The CSF's tiers (Partial, Risk-Informed, Repeatable, Adaptive) and the notion of current versus target profiles give you a maturity conversation that boards understand. It's free, it's flexible, and there's no certification to chase.

ISO/IEC 27001

ISO 27001 is the international standard for an information security management system (ISMS) — the organisational machinery for managing security: policies, risk assessment, roles, controls, internal audits, management review and continual improvement. The current version is ISO/IEC 27001:2022, with the control catalogue in its Annex A reorganised into 93 controls across four themes (organisational, people, physical, technological). ISO 27002 gives implementation guidance for each control.

Two things distinguish it from the CSF.

First, it's certifiable. An accredited auditor examines your ISMS and issues a certificate valid for three years with annual surveillance audits. This is the thing customers ask for in procurement, because it's independent evidence that a system exists.

Second, it's risk-driven by design. The standard doesn't require you to implement all 93 controls. It requires you to assess your risks, choose controls to treat them, and justify inclusions and exclusions in a Statement of Applicability. Then you have to show the cycle keeps turning. Done properly, that's exactly the risk management discipline from earlier in this series, formalised.

Done badly — and it often is — it becomes a documentation project. The warning signs are familiar. A consultant delivers a hundred policies nobody reads. The risk assessment is a spreadsheet updated the week before the audit. The ISMS exists in a folder rather than in how the organisation operates. The certificate is real; the security isn't.

Use it when you sell to organisations that require it, operate in a regulated sector, or genuinely want the management discipline and are prepared to live it. Budget for the effort honestly: for a small company, six to twelve months to first certification, with real staff time, is typical. Don't pursue it just to have a logo.

CIS Critical Security Controls

The CIS Controls (currently version 8.1) come from a different tradition. Where the CSF and ISO 27001 are frameworks for managing security, the CIS Controls are a prioritised list of what to actually do. They are developed and maintained by a community of practitioners and grounded in observed attack data.

There are 18 controls, each with specific safeguards (153 in total), and — this is the important part — they're grouped into three Implementation Groups by organisational capacity:

IG1 — 56 safeguards that constitute "essential cyber hygiene". This is the minimum every organisation should do, and CIS's own analysis suggests it defends against the large majority of common attack techniques catalogued in ATT&CK. Asset inventory, software inventory, secure configuration, account management, MFA, patching, backups, basic logging, awareness training.
IG2 — adds safeguards for organisations with some dedicated IT and security staff and more sensitive data.
IG3 — the full set, for organisations facing sophisticated adversaries.

The Controls are refreshingly concrete. Control 5 doesn't say "manage identities"; it says establish an inventory of accounts, use unique passwords, disable dormant accounts after 45 days, restrict administrator privileges to dedicated accounts. You can hand IG1 to a competent IT person and they'll know what to do on Monday.

Use it when you want to know what to do, especially as a small or medium organisation without a security team. IG1 is the best starting checklist in existence. It also maps cleanly to the CSF and ISO 27001, so implementing CIS Controls is real progress toward either.

The others you'll hear about

NIST SP 800-53 — the enormous control catalogue behind US federal compliance, with over a thousand controls. Comprehensive, and overkill for anyone not required to use it; but if you need detail on a specific control area, it's the reference.

SOC 2 — not a framework but an audit report, based on the AICPA's Trust Services Criteria, common among SaaS companies selling to US customers. A Type II report covers controls operating over a period (usually 6–12 months). Procurement teams ask for it the way they ask for ISO 27001; the two are often pursued together since they share most of the underlying work.

PCI DSS — mandatory if you handle payment card data, with version 4.0 now in force. Prescriptive and specific to cardholder data; most small merchants reduce their scope to almost nothing by using a payment processor and never touching card numbers.

Sector and national frameworks — in Qatar, the National Cyber Security Agency's National Information Assurance policy and sector-specific requirements from regulators such as the Qatar Central Bank define baselines for organisations in scope. The NIS2 directive in the EU, the UK's Cyber Essentials, Australia's Essential Eight — each is a national floor, and most map to the same underlying controls.

Cyber Essentials deserves a special mention for small businesses even outside the UK: five controls (firewalls, secure configuration, access control, malware protection, patching), a self-assessment, and an inexpensive certification. As a first target, it's hard to beat.

How to choose, and how to use

The honest answer to "which framework?" is usually "more than one, at different layers":

CSF 2.0 as the top-level structure and the language for leadership.
CIS Controls IG1 as the concrete to-do list, moving to IG2 as you grow.
ISO 27001 when the market or regulation demands certified evidence.

And a few principles that separate frameworks that help from frameworks that decorate:

Start with an honest assessment, not a target. Score yourself against CIS IG1 or the CSF categories with the people who actually run the systems in the room. It will be uncomfortable. It will also be the first accurate picture of your security you've had.

Prioritise by risk, not by the framework's order. The framework tells you what's in scope; your threat model and risk register tell you what matters most for you. A company whose whole business runs on one SaaS platform should sweat identity and access; one with a warehouse full of unpatched industrial controllers has a different first problem.

Implement, then document — not the reverse. Policies should describe what you do, written after you're doing it. A policy that describes an aspiration is a liability in an audit and useless in an incident.

Measure something. Percentage of endpoints with EDR. Days to patch critical vulnerabilities. Number of accounts without MFA. Time to restore from backup. Frameworks become real when they're attached to numbers that leadership sees quarterly.

Keep the cycle turning. Every framework is built around plan–do–check–act. The check is the part that dies first: internal audits skipped, reviews postponed, the risk register untouched for a year. Put the reviews in the calendar with names attached, and treat a missed review as the incident it is.

Bringing the series together

Ten posts ago, this series began with three words — confidentiality, integrity, availability — and the claim that everything else in information security is in service of them. A framework is the proof of that claim. Open the CSF or the CIS Controls and you'll find the triad in every outcome. Threat modelling and risk assessment are the required starting point. Authentication and least privilege are the core protective controls. Cryptography and defence in depth are the architecture. The human layer is its own category. Logging, detection and response are the functions that make everything else accountable.

None of it is mysterious. All of it is work — consistent, unglamorous, cumulative work that compounds over years. The organisations that are hard to breach are not the ones with the largest budgets or the cleverest tools. They're the ones that decided what they were protecting and understood who was coming for it. They made deliberate choices about the risks. Then they kept the cycle turning long after the initial enthusiasm faded.

That's the foundation. Everything else is built on it.

Further reading

NIST, The NIST Cybersecurity Framework (CSF) 2.0 (February 2024)
ISO/IEC 27001:2022 and ISO/IEC 27002:2022
Center for Internet Security, CIS Critical Security Controls v8.1 and CIS Community Defense Model
AICPA, Trust Services Criteria (SOC 2)
PCI Security Standards Council, PCI DSS v4.0.1
Qatar National Cyber Security Agency — National Information Assurance Policy
NCSC (UK), Cyber Essentials scheme

This series