Stop 11 · GRC: Governance, Risk & ComplianceTopics · 2/9

Security Frameworks (NIST, ISO 27001)

In short

Starting a security program from a blank page is scary. Frameworks give you a tested checklist of what good looks like, so you do not forget a whole area.

Structured, widely-adopted frameworks for building and maturing a security program — NIST's Cybersecurity Framework and ISO 27001 both provide a comprehensive checklist of controls and processes.

The blob ticks a checklist in a big wedding kitchen full of cooking pots.

Think of it like this

The wedding caterer's master list

A big wedding caterer does not cook from memory. A master list covers gas, rice, sweets, serving staff and leftovers. The list does not cook for you, but nothing gets forgotten. NIST CSF and ISO 27001 are that master list for security.

Watch it happen

The six NIST CSF 2.0 functions

Govern

Identify

Protect

Detect

Respond

Recover

1/6Govern: leaders set the strategy, roles and risk appetite. CSF 2.0 added this function in 2024.

The big ideas

What you need to know

NIST CSF is a guide

The NIST Cybersecurity Framework is free and voluntary. It organises outcomes into functions, so you can measure where you are and where you want to be.

ISO 27001 is certifiable

ISO/IEC 27001 defines an information security management system. An accredited auditor can certify you against it, which customers often ask for.

Annex A controls

ISO 27001:2022 lists 93 reference controls in four themes: organisational, people, physical and technological. You pick the ones that fit your risks.

Plan, do, check, act

Both push continuous improvement. A framework is a cycle of review, not a binder that sits on a shelf.

Save yourself the pain

Common mistakes

Oops

Thinking you must implement every control in a framework.

Do this instead

Frameworks are risk based. Pick and justify the controls that fit your risks, and record why others do not apply.

Oops

Treating NIST CSF and ISO 27001 as rivals you must choose between.

Do this instead

Many teams use both. Official mappings exist, so work done for one usually counts for the other.

Your mission

Map your college lab to CSF

~30 min

Quick check

What is the key difference between NIST CSF and ISO 27001?

Go deeper

1Read a summary of the NIST Cybersecurity Framework's 5 core functions.
2Compare NIST CSF and ISO 27001 at a high level — both cover similar ground with different structures.
3Learn why frameworks provide a shared vocabulary auditors and security teams both understand.