NIST RMF, ISO 27001, and CIS Controls

Security frameworks are structured sets of guidelines, best practices, and controls that help organizations build and maintain effective security programs. Rather than starting from scratch, frameworks provide a proven methodology that can be tailored to organizational size, industry, and risk profile. The Security+ exam focuses on three widely adopted frameworks: NIST RMF, ISO 27001, and the CIS Controls — each approaching security from a different angle.

The NIST Risk Management Framework (NIST SP 800-37) is a six-step lifecycle for managing security and privacy risk in federal information systems, though it is widely adopted in the private sector too. The six steps are: Categorize (system and data sensitivity), Select (appropriate controls from SP 800-53), Implement (deploy controls), Assess (test effectiveness), Authorize (ATO decision by authorizing official), and Monitor (continuous monitoring). The RMF emphasizes ongoing authorization rather than point-in-time certifications.

NIST SP 800-53 is the control catalog that feeds the RMF Select phase. It organizes hundreds of security and privacy controls into 20 families such as Access Control (AC), Audit and Accountability (AU), Incident Response (IR), and System and Communications Protection (SC). Controls are tagged with baseline assignments (Low, Moderate, High) that match the system's FIPS-199 impact level, so organizations select the right control set for their risk category.

ISO/IEC 27001 is an international standard for Information Security Management Systems (ISMS). Unlike NIST (which is US-focused), ISO 27001 is globally recognized and organizations can achieve formal third-party certification — which is valuable for customer trust and international contracts. The standard follows the Plan-Do-Check-Act (PDCA) cycle and focuses on building a management system around information security rather than specifying individual technical controls.

Annex A of ISO 27001:2022 contains 93 controls organized into four themes: Organizational (37 controls — policies, roles, supplier relationships), People (8 controls — hiring, training, termination), Physical (14 controls — premises, equipment), and Technological (34 controls — access control, malware, encryption, logging). Not every control must be implemented — organizations select applicable controls based on their Statement of Applicability (SoA), justifying any controls that are excluded.

The CIS Critical Security Controls (formerly SANS Top 20) are a prioritized set of 18 control groups developed by the Center for Internet Security. They are highly practical and action-oriented, designed for immediate implementation rather than long-term program management. CIS Controls are organized into three Implementation Groups (IGs): IG1 (essential cyber hygiene, 56 safeguards), IG2 (adds 74 safeguards for more complex environments), and IG3 (all 153 safeguards for mature organizations facing sophisticated threats).

The CIS Controls define what to do at a high level; CIS Benchmarks define how to do it for specific platforms. CIS Benchmarks provide prescriptive, step-by-step hardening guidance for operating systems (Windows, Linux), cloud platforms (AWS, Azure, GCP), network devices, browsers, and databases. They are freely downloadable and widely used as the technical specification for CIS Control 4 (Secure Configuration). Automation tools like Chef, Ansible, and InSpec can apply CIS Benchmarks at scale.

Each framework serves a different primary need. NIST RMF is best for US government and defense contractors requiring formal authorization processes. ISO 27001 is best for organizations that want internationally recognized certification to demonstrate security to customers. CIS Controls are best for organizations seeking prioritized, actionable steps to improve defenses quickly. Many mature organizations use all three: CIS Controls for daily operations, NIST RMF for risk governance, and ISO 27001 for customer-facing certification.

Additional frameworks appear on the Security+ exam. COBIT (Control Objectives for Information Technologies) focuses on IT governance and aligning security with business objectives. SOC 2 is an auditing standard for service providers that evaluates security, availability, confidentiality, processing integrity, and privacy. PCI-DSS is a prescriptive compliance standard for payment card environments. Understanding these frameworks positions you to speak the language of different industries and regulatory environments.

When choosing a framework, consider: regulatory mandate (HIPAA requires addressable safeguards; FedRAMP requires NIST), customer requirements (enterprise customers may require ISO 27001 certification), organizational maturity (CIS IG1 is appropriate for small organizations just starting), and industry sector (financial services may require NIST CSF or SOC 2). Starting with one framework and expanding is better than attempting to implement all frameworks simultaneously, which overwhelms smaller teams.

All three frameworks share a commitment to continuous improvement. The NIST RMF Monitor step drives ongoing control testing. ISO 27001's Act phase requires corrective actions and improvement plans. CIS Controls are versioned and updated as the threat landscape evolves (currently version 8.1). Security programs that treat frameworks as a one-time compliance exercise quickly fall behind — the frameworks are designed as living programs that mature over time alongside organizational capabilities and emerging threats.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: NIST RMF provides a six-step risk lifecycle (Categorize, Select, Implement, Assess, Authorize, Monitor) with SP 800-53 controls, ISO 27001 is a globally certifiable ISMS standard based on PDCA with Annex A controls, and CIS Controls offer 18 prioritized control groups in three implementation groups for practical, actionable security improvements. Next up we explore data classification schemes and privacy requirements.