Security Frameworks

Security frameworks provide structured approaches to managing cybersecurity risk. They are not checklists — they are models that help you identify gaps, prioritise investments, and communicate with stakeholders.

Why Frameworks Matter

Without a framework, security decisions are reactive: a breach happens, you fix that thing, repeat. With a framework, you have a systematic understanding of your security posture. You know what controls you have, what controls you are missing, and what to prioritise next.

NIST Cybersecurity Framework (CSF) 2.0

The CSF is the most widely adopted cybersecurity framework globally. Originally released in 2014, updated to v2.0 in February 2024.

The Six Functions

The 2024 update added a sixth function — Govern — recognising that cybersecurity governance must be elevated above technical implementation:

    graph TD
    GV[Govern — Establish cybersecurity strategy and oversight] --> ID
    ID[Identify — Understand risk to systems, assets, data] --> PR
    PR[Protect — Safeguard against threats] --> DE
    DE[Detect — Find attacks in progress] --> RS
    RS[Respond — Contain and mitigate] --> RC
    RC[Recover — Restore capabilities]
    RC --> GV
  

Detailed Breakdown

1. Govern (GV) — NEW in v2.0

The organisation’s cybersecurity strategy, oversight, and governance:

2. Identify (ID)

Understand the organisation’s current cybersecurity risk:

3. Protect (PR)

Safeguards to ensure delivery of critical services:

4. Detect (DE)

Find cybersecurity attacks in progress:

5. Respond (RS)

Take action when an incident is detected:

6. Recover (RC)

Restore capabilities after an incident:

Using the CSF

# Step 1: Determine Current and Target Profiles
# Current Profile: Where are we today?
#   Govern: 2/5 (initial)
#   Identify: 2/5
#   Protect: 3/5
#   Detect: 2/5
#   Respond: 2/5
#   Recover: 2/5

# Target Profile: Where do we need to be?
#   Govern: 3/5
#   Identify: 3/5
#   Protect: 4/5
#   Detect: 3/5
#   Respond: 3/5
#   Recover: 3/5

# Step 2: Conduct GAP Analysis
# Gap: Protect is at 3/5 → target 4/5
#   Missing control: EDR on all endpoints
#   Missing control: Automated patch management
#   Priority: High

# Step 3: Create Action Plan
# 1. Deploy EDR (Q1, $50K)
# 2. Implement patch automation (Q2, $30K)
# 3. Build detection rules for common threats (Q3, 2 months engineering)

ISO 27001

ISO 27001 is the international standard for Information Security Management Systems (ISMS). Unlike the CSF (which is guidance), ISO 27001 is a certifiable standard.

ISO 27001 Certification Process

1. Gap Analysis (2-4 weeks)
   → Compare current state against 93 controls
   → Identify missing policies, procedures, controls

2. ISMS Implementation (3-6 months)
   → Write missing policies
   → Implement missing controls
   → Train staff
   → Conduct internal audit

3. Stage 1 Audit (2-3 days)
   → External auditor reviews documentation
   → Verifies ISMS is designed correctly
   → Identifies major gaps before Stage 2

4. Stage 2 Audit (3-5 days)
   → External auditor tests controls in practice
   → Interviews staff, reviews evidence
   → If no critical findings → certification issued

5. Surveillance Audits (annually)
   → Maintain certification
   → Address changes in environment

6. Recertification (every 3 years)
   → Full reassessment

ISO 27001 Annex A Control Categories (2022)

CIS Controls

The CIS Critical Security Controls are a prioritised set of actions that form the foundation of an effective security program. They are maintained by the Center for Internet Security.

CIS Top 18 Controls (v8)

The 18 controls are grouped into three Implementation Groups (IGs):

IG1 — Basic Hygiene (Essential for Every Organisation)

IG2 — Additional Controls

IG3 — Advanced Controls

Framework Comparison

Control Mapping Across Frameworks

Frameworks overlap significantly. Most organisations map their controls to multiple frameworks:

Control: "Multi-factor authentication on all external-facing applications"
  NIST CSF: PR.AA (Identity Management)
  ISO 27001: A.8.5 (Secure authentication)
  CIS: 5.2 (MFA)
  PCI DSS: 8.3 (MFA for remote access)

Control: "Weekly vulnerability scanning of all internet-facing systems"
  NIST CSF: ID.RA (Risk Assessment)
  ISO 27001: A.8.8 (Technical vulnerability management)
  CIS: 7.1 (Vulnerability scanning)
  PCI DSS: 11.2 (Quarterly external scans, weekly internal scans)

Key Takeaways

• NIST CSF 2.0 adds a sixth function (Govern) and is the most widely adopted framework globally — best for communicating security posture to leadership
• ISO 27001 is the only certifiable standard among the major frameworks — certification demonstrates a formal security management system to customers and partners
• CIS Controls provide a prioritised, actionable list of technical controls — start with IG1 (mandatory for every organisation) and progress to IG3
• Frameworks overlap significantly — map your controls to multiple frameworks to satisfy different requirements (e.g., sell to customers with SOC 2, comply with regulations, guide your own program)
• Choose your framework based on your goal: NIST CSF for strategy, ISO 27001 for certification, CIS for technical implementation, COBIT for IT governance
• No framework is a substitute for risk management — frameworks provide structure, but you must still assess your specific risks and prioritise accordingly