Cyber Security Frameworks

Why Frameworks Exist

Without a shared structure, security work tends to become reactive — whichever risk got the most attention last week gets addressed, while less visible gaps quietly persist. Frameworks solve this by giving organizations a common set of categories, practices, or controls to organize around. They also make security comparable and auditable: a framework gives customers, regulators, and partners a shared language to ask 'how do you handle this' and get an answer that can be checked against a known standard, rather than taking a vendor's word for it.

The NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework is a voluntary framework published by the U.S. National Institute of Standards and Technology. It doesn't prescribe specific products or exact technical controls; instead it organizes cybersecurity activity into a small set of high-level functions that give organizations a common way to describe their current practices and identify gaps, regardless of industry or size.

• Govern — set up cybersecurity strategy, roles, policy, and oversight so the rest of the functions have direction.
• Identify — understand your assets, systems, data, and the risks to them.
• Protect — implement safeguards, such as access control, training, and data security, to limit or contain a potential incident.
• Detect — put in place the monitoring needed to notice a cybersecurity event in a timely way.
• Respond — take action once an incident is detected, to contain its impact.
• Recover — restore capabilities and services impaired by an incident, and improve going forward.

ISO/IEC 27001

ISO/IEC 27001 is an international standard, published by the International Organization for Standardization, that specifies requirements for an Information Security Management System (ISMS) — the ongoing set of policies, processes, and controls an organization uses to manage information security risk. Unlike the NIST CSF, ISO/IEC 27001 is formally certifiable: an accredited auditor can assess an organization against the standard and issue a certificate, which is why it's frequently requested during vendor security reviews and enterprise sales processes. It's built around a risk assessment process and a reference set of security controls (detailed in the companion standard ISO/IEC 27002), documented in what the standard calls a Statement of Applicability.

Other Frameworks and Standards You'll Encounter

• CIS Controls — a prioritized, practical list of technical safeguards published by the Center for Internet Security, often used as an implementation checklist.
• SOC 2 — an audit report (not a certification) that evaluates a service organization's controls around security, availability, and related trust criteria, common in B2B software vendor reviews.
• PCI DSS — a security standard required for any organization that stores, processes, or transmits payment card data.