Security framework

"Framework" covers documents of quite different kinds, and much confusion comes from comparing them as if they were alike. Programme or management-system frameworks describe how security is governed: ISO/IEC 27001 specifies requirements for an ISMS, and the NIST CSF 2.0 organises desired outcomes into six functions. Control catalogues specify what to implement: ISO/IEC 27002 with 93 controls, NIST SP 800-53 Rev. 5 with controls in 20 families, and the CIS Controls v8.1 with 18 controls and 153 safeguards sorted into three Implementation Groups, of which IG1 (56 safeguards) is presented as essential cyber hygiene. Risk frameworks describe how to assess and treat risk: ISO/IEC 27005, NIST SP 800-30 and the Risk Management Framework in SP 800-37, or FAIR for quantitative estimates. Governance frameworks such as COBIT 2019 position security inside enterprise IT governance.

A further distinction runs between voluntary frameworks and binding law. NIS2, DORA and the GDPR set legal outcomes and deadlines but rarely say how to achieve them; frameworks supply the how, and a certificate or assessment against a framework is evidence, not proof, of legal compliance. Threat-centred knowledge bases such as MITRE ATT&CK are not control frameworks either, although they are often used to check whether the chosen controls cover realistic attack techniques.

Organisations subject to several regimes usually end up with a crosswalk or common control framework: one internal set of controls, each mapped to the requirements it satisfies in 27001 Annex A, NIS2 Article 21(2), customer contracts and sector rules, so that one piece of evidence serves several audits. Public mappings help, for example NIST's OLIR programme and the CIS mappings to other frameworks, but mappings are many-to-many and approximate, and a control that "maps" to a requirement may cover only part of it.

Selection should follow the question being answered. For a certificate that customers recognise, ISO 27001 is the default in Europe; for board-level communication and gap analysis the CSF functions are popular; for a small organisation needing a prioritised technical to-do list, CIS IG1 is a realistic start; in Denmark, D-mærket offers a lighter label aimed at smaller companies. The common failure is framework collecting: adopting several in parallel without a common control set, which multiplies documentation without improving security.