Security framework vs Security policy

Why they differ

A framework is an outside, shared structure; a policy is the organisation's own document of its goals and rules.

Compliance & regulation

A ready-made, shared structure of goals and controls that an organisation follows to build and check its security work.

Formal

A published, structured set of principles, processes and controls - such as ISO 27001, the NIST CSF or the CIS Controls - that an organisation adopts to decide what to protect, in which order, and how to measure progress.

In plain English

A well-tested cookbook - you do not invent the dish from scratch, you follow proven steps and adjust to taste.

In practice

The newly hired IT manager at a Danish housing association uses the CIS Controls as a checklist to see which basic protections are already in place and which to add first.

Why it matters

Without one, each organisation guesses at what good security looks like and misses whole areas; a shared framework also gives a common language with auditors, partners and authorities.

Security policy

Fundamentals

A document that sets out an organisation's goals, responsibilities and principles for information security.

Formal

A leadership-approved statement of the organisation's intent for information security - its goals, who is responsible for what, and the rules everyone must follow. It is reviewed at set times and backed by more detailed rules for specific topics.

In plain English

Like the house rules on a fridge - short, agreed by the grown-ups, and meant to settle arguments before they start.

In practice

A new case worker at a Danish municipality reads and accepts the security policy on day one; among other things it says that work files may only be stored in approved places, never on a private cloud account.

Why it matters

It turns leadership's intent into something written and shared, which every later rule, control and audit can point back to.

Shared connections

Security control Governance ISO 27001 ISO 27002