Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
From outcomes to controls
Domain 1’s frameworks (NIST CSF, ISO 27001 and COBIT) describe what security must achieve and how to manage it. Control catalogues answer the next question: which specific safeguards? “Industry standards and frameworks for information security” is a named Domain 3 topic.
The main catalogues
| Catalogue | Structure | Best for |
|---|---|---|
| ISO/IEC 27002:2022 | 93 controls in four themes: organisational, people, physical, technological | Organisations running an ISO 27001 ISMS |
| NIST SP 800-53 Rev. 5 | Over 1,000 controls and enhancements in 20 families, with low, moderate and high baselines | US federal agencies and suppliers; very detailed programs |
| CIS Controls v8 | 18 controls and about 150 safeguards, prioritised into implementation groups | A practical, prioritised starting point, especially for smaller organisations |
| PCI DSS v4 | 12 requirements for protecting cardholder data | Anyone storing, processing or transmitting card data |
CIS implementation groups
- IG1: essential cyber hygiene, a minimum set every organisation should have.
- IG2: adds safeguards for organisations with IT staff and more sensitive data.
- IG3: all safeguards, for organisations facing sophisticated attackers.
Mapping one control to many requirements
Most organisations face several frameworks at once. Mapping each internal control to the frameworks it satisfies avoids duplicate work and shows coverage:
| Internal control | ISO 27001 / 27002 | NIST CSF 2.0 | CIS v8 | PCI DSS v4 |
|---|---|---|---|---|
| Periodic access review | 5.18 Access rights | PR.AA | 5 and 6 (account and access management) | 7.2.4 |
| MFA for remote access | 8.5 Secure authentication | PR.AA | 6.4 | 8.4.3 |
Choosing and using a catalogue
- Start from the risk assessment and the organisation’s obligations.
- Use CIS IG1 as a quick baseline if the program is immature.
- Use ISO 27002 if running an ISO 27001 ISMS.
- Use NIST SP 800-53 where regulation or customers require it.
- Map everything to one internal control set.
Example. A healthcare company must meet HIPAA, a customer’s ISO 27001 requirement and PCI DSS for its payment desk. It builds one internal control library mapped to all three, so one access review produces evidence for every assessor.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Prioritised controls for a small organisation | CIS Controls (IG1) |
| Detailed US federal control catalogue | NIST SP 800-53 |
| Guidance supporting ISO 27001 Annex A | ISO/IEC 27002 |
| Benefit of mapping frameworks | One control set meets several requirements |
| How controls should be selected | Based on risk, not by implementing everything |
In short
- Control catalogues list specific safeguards; governance frameworks (NIST CSF, ISO 27001, COBIT) say what to achieve and how to manage it.
- ISO/IEC 27002 gives guidance on 93 controls in four themes, matching ISO 27001 Annex A.
- NIST SP 800-53 is a very detailed catalogue (20 families) with low, moderate and high baselines, used widely by US government and its suppliers.
- The CIS Controls (v8) are 18 prioritised controls with implementation groups IG1 to IG3; IG1 is essential hygiene for everyone.
- Industry standards such as PCI DSS add mandatory requirements for specific data.
- Mapping catalogues to each other avoids duplicate work and shows coverage of several requirements at once.
Exam traps
- Implementing a whole catalogue without risk-based selection wastes effort.
- ISO 27002 is guidance; certification is against ISO 27001.
- CIS IG1 is a starting point, not the finish line, for organisations with significant risk.
- Control catalogues don't replace a risk assessment; they help answer it.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The main catalogues
CIS implementation groups
1 / 9