Security frameworks and standards

Frameworks are shared vocabularies for what good looks like. Pick one as the backbone, map the others to it, and never confuse passing an audit with being secure.

ISO/IEC 27001NIST Cybersecurity Framework (CSF)CIS Critical Security ControlsPCI DSSSOC 2control-mapping spreadsheets

The main ones

ISO/IEC 27001: a certifiable standard for an (ISMS): scope, risk assessment, a set of controls and continual improvement. Certification is by an external auditor.
NIST Cybersecurity Framework (CSF): a voluntary framework organized in functions (Govern, Identify, Protect, Detect, Respond, Recover) that is popular for describing and communicating a program's maturity. Not certifiable.
CIS Critical Security Controls: a prioritized, practical list of safeguards, grouped into implementation levels so small teams know where to start.
PCI DSS: a mandatory standard from the card networks for organizations that store, process or transmit payment card data, with specific technical and process requirements.
: an attestation report by an auditor on a service provider's controls relating to security and related criteria; widely requested by customers.
Privacy laws (such as the EU's GDPR and Brazil's LGPD) are legal obligations rather than frameworks, but they drive security requirements for personal data.

Choosing and combining

Start from what is required: contracts, regulation and customers decide which ones you must meet. Use one framework as the internal backbone, often or ISO 27001, use to prioritize the practical work, and map the rest onto it so that one control satisfies many requirements. Controls that implement the same idea (for example, multi-factor authentication) appear in all of them under different numbers.

control-mapping.ymlyaml

- control: MFA required for all administrative and remote access
  owner: it-security
  maps_to:
    nist_csf: PR.AA
    cis_controls: "6"
    iso_27001: A.8.5
    pci_dss: "8.4"
  evidence: [idp-policy-export, quarterly-access-review]

Reading a framework without getting lost

Start with the structure (functions, domains, control families), not the full text.
Read each control for its intent: what risk is it meant to reduce?
Implement the intent in a way that fits your technology; the wording rarely names your tools.
Note what is out of scope for you and record why, so an auditor sees a decision rather than an omission.

Compliance is not security

A framework sets a floor and a language. It does not know your threats, your architecture or your weakest system.
Audits sample the past; attackers test the present. Passing last quarter's audit says little about today.
Scoping can hide risk: a narrow certification scope covers only part of the business.
Use frameworks to drive real improvement: take the gaps and put them in the with owners.

ISMSinformation security management systemThe set of policies, processes and controls that an organization uses to manage information security, as required by ISO 27001.see in glossary →SOC 2An auditor's report on a service provider's controls for security and related criteria, commonly requested by customers.see in glossary →NIST CSFA voluntary framework that organizes a security program into functions: Govern, Identify, Protect, Detect, Respond and Recover.see in glossary →CIS ControlsA prioritized list of practical safeguards grouped in implementation levels, helpful for deciding where to start.see in glossary →Risk registerThe working record of identified risks: owner, rating, controls, treatment, actions and review date.see in glossary →

connections on the map

Security risk managementis structured bySecurity frameworks and standards
Security frameworks and standardsis implemented throughSecurity architecture principles
Security frameworks and standardsis evidenced byCompliance in practice: controls, evidence and audits

updated on 14/10/2026 · sources to go deeper · report an error

Unlocks

test what you learned

Loading questions…