Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
Why frameworks?
A framework gives the security program a recognised structure:
- a checklist of what good looks like, so nothing important is forgotten
- a common language for the board, auditors, regulators and customers
- evidence of due care: following a recognised framework helps show reasonable practice
- a benchmark for measuring maturity and progress
It saves the security manager from inventing everything from scratch.
NIST Cybersecurity Framework 2.0
Published by the US National Institute of Standards and Technology and widely used around the world, the CSF organises cybersecurity outcomes into six functions. Version 2.0 (February 2024) added Govern and broadened the framework from critical infrastructure to all organisations.
| Function | Outcomes |
|---|---|
| Govern | Strategy, roles, policy, risk appetite, oversight, supply chain risk |
| Identify | Understand assets, risks and improvement opportunities |
| Protect | Safeguards: identity and access, training, data security, platform security |
| Detect | Find attacks and anomalies |
| Respond | Act on detected incidents |
| Recover | Restore assets and operations |
The three side by side
| NIST CSF 2.0 | ISO/IEC 27001:2022 | COBIT 2019 | |
|---|---|---|---|
| Purpose | Manage and communicate cybersecurity risk outcomes | Requirements for an information security management system (ISMS) | Governance and management of enterprise information and technology |
| Structure | 6 functions, 22 categories, subcategories | Clauses 4–10 (management system) plus Annex A (93 reference controls) | 5 domains (EDM, APO, BAI, DSS, MEA), 40 objectives |
| Certifiable? | No | Yes, for organisations | No |
| Typical use | Current vs target profiles; board communication | Certification; customer and regulator trust | Board-level IT governance; audit criteria |
How they fit together
They complement rather than compete:
- COBIT shows how the board and management govern IT as a whole; information security is one part of it.
- ISO 27001 provides the management system that runs security: risk assessment, Statement of Applicability, internal audit, management review and continual improvement (Plan-Do-Check-Act).
- NIST CSF describes outcomes in plain language and is useful for communicating with executives.
- Control catalogues (ISO 27002, NIST SP 800-53, the CIS Controls) give the detailed controls. These appear in Domain 3.
Many organisations map them to each other, so one control set satisfies several frameworks.
Using CSF profiles
A profile is a snapshot of which CSF outcomes the organisation achieves. A current profile compared with a target profile shows the gaps, which feed straight into the security strategy and roadmap.
Example. A hospital’s current profile shows strong Protect outcomes but weak Detect and Recover. The target profile, agreed with the board, raises both. The difference becomes the next two years of the roadmap.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Framework an organisation can be certified against | ISO/IEC 27001 |
| Function added in NIST CSF 2.0 | Govern |
| ISACA’s framework for IT governance | COBIT |
| How to use CSF profiles | Compare current and target profiles to find gaps |
| Should a framework be adopted as-is? | No; tailor it to the organisation |
In short
- NIST Cybersecurity Framework 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
- ISO/IEC 27001 sets requirements for an information security management system (ISMS); organisations can be certified against it.
- COBIT 2019 is ISACA's framework for governance and management of enterprise IT, with governance (EDM) separate from management.
- Frameworks complement each other: COBIT for IT governance, ISO 27001 for the management system, NIST CSF to describe and communicate outcomes.
- CSF profiles compare a current profile with a target profile, which feeds gap analysis and the roadmap.
- No framework should be adopted unchanged; it's tailored to the organisation's risks and needs.
Exam traps
- Only ISO 27001 is certifiable among these three; NIST CSF and COBIT aren't.
- ISO 27002 is guidance on controls; you get certified to 27001, not 27002.
- Govern is the function added in CSF 2.0; older material lists only five functions.
- A framework is a structure, not a strategy; the strategy comes from business objectives.
Slides
Click the slide and use the arrow keys. F toggles full screen.
NIST Cybersecurity Framework 2.0
The three side by side
1 / 9