Risk Frameworks: NIST CSF and ISO 27001

Security teams face infinite potential controls and limited resources. Risk frameworks provide structured vocabularies, control catalogs, and assessment methods that help organizations prioritize security investments, communicate risk to executives, and demonstrate compliance.

The NIST CSF (version 2.0) organizes cybersecurity activities into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Each function contains categories and subcategories mapping to specific security outcomes. It is widely adopted across US critical infrastructure and beyond.

Identify covers asset management, risk assessment, risk management strategy, and supply chain risk management. You cannot protect what you don't know you have. Complete asset inventories and risk assessments are the foundation of all subsequent security controls.

Protect encompasses access control, training, data security, process hardening, and maintenance. Detect covers anomalies, security events, and continuous monitoring. A mature Detect function prevents long attacker dwell times by catching intrusions quickly.

Respond defines incident response planning, communications, analysis, mitigation, and improvements. Recover covers recovery planning, improvements, and communications. Testing IR plans and recovery procedures ensures they work when needed.

ISO 27001 is an international standard for Information Security Management Systems (ISMS). It specifies requirements for establishing, implementing, maintaining, and continuously improving an ISMS. ISO 27001 certification demonstrates third-party validated security to customers and regulators.

ISO 27001:2022 Annex A contains 93 controls organized into four themes: Organizational (37 controls), People (8), Physical (14), and Technological (34). Annex A is a menu — select controls appropriate to your risk profile via the Statement of Applicability (SoA).

The ISMS risk treatment process: identify assets, identify threats and vulnerabilities, assess likelihood and impact, choose treatment (accept, avoid, transfer, mitigate), select Annex A controls, and document in the SoA. Annual risk assessment reviews keep the ISMS current.

NIST CSF is a framework for organizing and improving cybersecurity practices — not a certification standard. ISO 27001 is a certifiable standard with an ISMS scope and third-party audit. Many organizations use both: NIST CSF for operational guidance, ISO 27001 for certification and customer trust.

NIST CSF defines four tiers of maturity (Partial → Risk-Informed → Repeatable → Adaptive). CMMI security maturity levels map similarly. Use maturity assessments to identify gaps and set improvement roadmaps with measurable, staged progress toward higher security maturity.

NIST CSF and ISO 27001 map to major regulations: PCI-DSS, HIPAA, GDPR, SOC 2, and NIST 800-53. Using a framework simplifies multi-regulation compliance: demonstrating a NIST CSF Protect control typically satisfies similar requirements across multiple regulatory frameworks simultaneously.

What is the purpose of the Statement of Applicability (SoA) in ISO 27001?

NIST CSF and ISO 27001 provide complementary approaches to security governance. NIST CSF organizes security activities across Govern/Identify/Protect/Detect/Respond/Recover for operational guidance, while ISO 27001 provides a certifiable ISMS framework with a formal risk treatment process and Annex A control catalog.