Nobody should invent a security programme from scratch. Frameworks and standards capture what many organisations learned the hard way, give a common language to auditors, engineers and executives, and let you measure progress. This page maps the landscape; detailed content of each is out of scope.
Laws, Frameworks, Standards, Policies
| Item | Mandatory? | Who writes it | Example |
|---|---|---|---|
| Law / regulation | Yes (legal penalties) | Government | GDPR, HIPAA, CRA |
| Framework | Voluntary, flexible guidance | Standards bodies, government | NIST CSF, COBIT |
| Standard | Voluntary unless contractually or legally required; may be certifiable | ISO, PCI SSC, industry | ISO 27001, PCI DSS |
| Policy | Yes, inside the organisation | Management | Security Policy |
| Procedure / guideline / baseline | Procedure and baseline yes; guideline advisory | Teams | Hardening baseline |
Flow: laws and contracts set obligations; frameworks and standards suggest how to meet them; the organisation turns that into policies, then controls and procedures. Background in Law and Ethics and the Governance, Regulation lab note.
NIST Cybersecurity Framework (CSF) 2.0
A voluntary, outcome-based framework for organisations of any size. Version 2.0 (2024) added a sixth function, Govern, and widened the scope beyond critical infrastructure. The older five-function summary is in Security Concepts; this extends it.
+-------- GOVERN --------+
| strategy, roles, policy |
+------------+------------+
IDENTIFY -> PROTECT -> DETECT -> RESPOND -> RECOVER
| Function | Outcome | Examples |
|---|---|---|
| Govern | Context, risk strategy, roles, oversight and supply-chain risk are set | Policy, risk appetite, accountability |
| Identify | Assets, risks and weaknesses are understood | Inventory, risk assessment |
| Protect | Safeguards limit impact | IAM, training, encryption, hardening |
| Detect | Attacks are found in time | Monitoring, anomaly analysis |
| Respond | Incidents are handled | IR plan, containment, communication |
| Recover | Normal operations restored | Backups, recovery plans |
Organisations pick an Implementation Tier (1 Partial to 4 Adaptive) and compare a Current Profile with a Target Profile - the same idea as the gap analysis in Security Concepts.
NIST SP 800-53 and the Risk Management Framework
- SP 800-53: a large catalogue of security and privacy controls grouped into families (Access Control, Audit and Accountability, Incident Response, System and Communications Protection, and more). Baselines (low, moderate, high) select controls by system impact. Mandatory for US federal systems, widely borrowed elsewhere.
- RMF (SP 800-37): the process that applies those controls. Overview of steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. It connects directly to Risk Management and Risk Monitoring.
ISO/IEC 27001 and 27002
- ISO/IEC 27001: requirements for an Information Security Management System (ISMS) - scope, risk assessment and treatment, a Statement of Applicability, internal audit, management review, continual improvement (Plan-Do-Check-Act). Certifiable by accredited auditors.
- ISO/IEC 27002: the supporting guidance on controls (Annex A of 27001 lists them). Not certifiable on its own. The 2022 revision groups controls into four themes: organisational, people, physical, technological.
CIS Critical Security Controls
A short, prioritised list of defensive actions (18 controls in v8, such as inventory of assets and software, secure configuration, access control management, continuous vulnerability management, audit log management, incident response). Implementation Groups (IG1-IG3) scale advice to organisation size, so IG1 gives small teams a realistic starting point. The related CIS Benchmarks are detailed hardening guides for specific products (System Hardening).
MITRE ATT&CK
Not a compliance framework: a knowledge base of real-world adversary behaviour, organised as tactics (the goal, e.g. Initial Access, Persistence, Lateral Movement) and techniques (how). Defenders use it to map detections, find coverage gaps and plan threat hunts and red-team exercises; attackers' playbooks map onto it. See Attack Methodologies and Threat Modeling.
Sector and Assurance Standards
| Name | One-liner |
|---|---|
| PCI DSS | Industry standard for organisations handling payment card data; prescriptive requirements (network security, encryption of card data, access control, logging, testing); enforced via card brands and acquirers, assessed by QSAs |
| SOC 2 | Audit report (AICPA) on a service organisation's controls against Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy. Type I = design at a point in time, Type II = operating effectiveness over a period |
| HIPAA | US law protecting health information (Privacy, Security and Breach Notification Rules); requires administrative, physical and technical safeguards |
| COBIT | IT governance and management framework linking IT to business goals; used by boards and auditors |
| ITIL | IT service management practices (incident, change, problem); security overlaps with Change Management |
Comparison
| Framework / standard | Purpose | Typical users | Certifiable? |
|---|---|---|---|
| NIST CSF 2.0 | Describe and improve cyber risk outcomes | Any organisation, executives, security leads | No (self-assessed) |
| NIST SP 800-53 | Control catalogue | US government, contractors, GRC teams | No (assessed for authorization) |
| NIST RMF | Risk-based process for authorising systems | US federal agencies, contractors | No |
| ISO/IEC 27001 | Build and run an ISMS | Global enterprises, service providers | Yes |
| ISO/IEC 27002 | Control implementation guidance | ISMS implementers | No |
| CIS Controls | Prioritised practical safeguards | SMBs and engineering teams | No |
| MITRE ATT&CK | Adversary behaviour model | SOC, threat intel, red teams | No |
| PCI DSS | Protect cardholder data | Merchants, payment processors | Validated by assessment or SAQ |
| SOC 2 | Prove controls to customers | SaaS and cloud vendors | Attestation report |
| HIPAA | Legal protection of health data | US healthcare and business associates | No (legal compliance) |
| COBIT / ITIL | IT governance / service management | IT management, auditors | Practitioner certs only |
Choosing and Using One
- Start from obligations: laws, contracts and customers (what are you required to do?).
- Pick a primary framework for the programme (CSF or ISO 27001 are common) and map others to it, since controls overlap heavily.
- Run a gap analysis, rank gaps by risk (Risk Assessment), then fix and re-measure.
- Compliance is not security: passing an audit shows controls existed at a point in time, not that you are unbreachable.
Key Points
- Laws are mandatory, frameworks and standards guide, policies bind internally.
- CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, Recover.
- 800-53 is the controls catalogue, RMF is the process; 27001 is certifiable, 27002 is guidance.
- CIS Controls prioritise; ATT&CK describes attackers; PCI DSS, SOC 2 and HIPAA are sector or assurance driven.