Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Selecting and Implementing a Framework
There’s no single right framework
A small software company, a national bank and a hospital all need security governance, but not the same framework. The security manager’s job is to choose the one that fits the organisation, tailor it and make it work. CISM tests the reasoning behind the choice more than the detail of any one framework.
What drives the choice
| Driver | Questions to ask |
|---|---|
| Legal and regulatory | Does a regulator expect a specific framework, such as NIST for US federal suppliers? |
| Customers and contracts | Do tenders or customers require ISO 27001 certification or a SOC 2 report? |
| Industry | Are there sector norms, such as PCI DSS for card payments or HITRUST in US health? |
| Size and maturity | Can the organisation run a formal ISMS, or should it start with the CIS Controls? |
| Culture | Does the organisation work well with formal processes, or with lighter guidance? |
| Existing investment | Is COBIT or ITIL already in use, so security can fit alongside? |
Tailor and map
- Tailor: keep what fits the organisation’s risks, and record why anything is excluded. ISO 27001’s Statement of Applicability does exactly this for Annex A controls.
- Map: crosswalk frameworks so a single control satisfies several of them, for example one access review process that meets ISO 27001, NIST CSF and PCI DSS.
- Integrate: fit security into frameworks already in use, such as COBIT for IT governance or ITIL for service management.
- Keep it proportionate: a 200-person firm doesn’t need a 900-control program.
Putting it into practice
- Sponsor and scope: a senior sponsor and a clear scope (business units, sites, systems).
- Tailor the framework to the organisation.
- Assess gaps between the current state and the tailored framework.
- Implement in phases, starting with the highest-risk gaps.
- Monitor and improve through metrics, internal audit and management review.
Example. A payments start-up must show customers it’s secure. It chooses ISO 27001 for certification, maps it to PCI DSS (which its card processing already requires), and certifies the payment platform first before extending the scope to the whole company.
A complete security governance framework covers more than a control list: strategy, roles and responsibilities, policies and standards, risk management, metrics and reporting, and assurance.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main factor in choosing a framework | Business, legal and regulatory requirements |
| Benefit of mapping frameworks | One control set meets several requirements |
| Should every control in the catalogue be implemented? | No; select based on risk |
| First step in adopting a framework | Senior sponsorship and a defined scope |
| Measure of success | Risk reduction and maturity, not the number of controls |
In short
- The framework choice is driven by business needs: legal and regulatory expectations, customers, industry, size, maturity and culture.
- Frameworks are tailored: keep what fits the organisation's risks, and document why anything is excluded.
- Mapping (crosswalking) one framework to others lets a single control set meet several requirements.
- Implementation needs a senior sponsor, a defined scope, a gap assessment and phased delivery.
- Success is measured by risk reduction and maturity improvement, not by the number of controls implemented.
- A governance framework covers decisions, roles, policies, metrics and reporting, not just a control list.
Exam traps
- Choosing a framework because it's popular, without checking business and regulatory needs, is a mistake.
- Implementing every control in a catalogue regardless of risk wastes money.
- A framework doesn't replace the strategy; it supports it.
- Starting implementation without a sponsor and scope leads to stalled, partial adoption.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What drives the choice
Putting it into practice
ExampleA payments start-up must show customers it's secure. It chooses ISO 27001 for certification, maps it to PCI DSS, which its card processing already requires, and certifies the payment platform first before extending scope to the whole company.
1 / 8