Security frameworks: NIST CSF 2.0, ISO/IEC 27001 and CIS Controls

Why use a framework?

Without structure, security work becomes a list of tools bought after each scare. A framework gives you a shared vocabulary, a way to check for gaps, and a way to show progress to managers, auditors and customers. Frameworks do not make you secure on their own; they help you decide what to do and prove you did it.

Frameworks come in roughly three kinds: outcome frameworks that describe what good looks like (NIST CSF), management system standards that define how you run security as a process (ISO/IEC 27001), and control catalogues that list specific safeguards (CIS Controls, NIST SP 800-53).

NIST Cybersecurity Framework 2.0

The NIST CSF was updated to version 2.0 in 2024. Its biggest change was adding Govern as a sixth function and widening the audience from critical infrastructure to organisations of every size.

• Govern: set strategy, roles, policy, risk appetite and supply chain oversight.
• Identify: know your assets, data, suppliers and risks.
• Protect: apply safeguards such as access control, training, data security and platform hardening.
• Detect: monitor for and analyse possible attacks.
• Respond: manage, contain and communicate about incidents.
• Recover: restore systems and services after an incident.

Organisations use profiles to compare their current state with a target state, and tiers to describe how mature and rigorous their practices are.

ISO/IEC 27001 and the CIS Controls

ISO/IEC 27001:2022 specifies an information security management system (ISMS). You define scope, assess risks, pick controls, run them, measure them and improve them. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. You write a Statement of Applicability explaining which controls apply and why. An accredited body can certify you, which is often required by customers.

The CIS Controls (version 8.1) are 18 groups of practical safeguards, from asset inventory to penetration testing. Implementation Group 1 (IG1) is a minimum set of essential cyber hygiene for any organisation; IG2 and IG3 add safeguards for larger or more targeted organisations.

Choosing and combining

Frameworks map to each other, so you do not have to choose only one. A common pattern is to report to the board using CSF functions, run the programme as an ISO/IEC 27001 ISMS, and use the CIS Controls as the technical checklist.

Tip: a framework is a means, not the goal. Watch out for "paper compliance", where policies exist but nobody follows them. Test that controls actually work.

Real-world example: a growing software company

A fictional software company with 60 staff wins its first large client, who asks for evidence of good security. The company uses the CIS Controls to pick practical first steps, such as an asset inventory, MFA and secure configuration, because they are concrete and prioritised. It uses NIST CSF 2.0 to explain its overall position to the board in six simple functions. A year later, when a second client asks for a formal certificate, it builds an ISO/IEC 27001 management system on top of the work already done. Each framework answered a different need, and none of the earlier work was wasted.