DerpGRC

    Topics in this domain

    Security Frameworks and Control Standards

    Security principles · 1 min read

    NIST CSF 2.0

    NIST CSF 2.0: Govern at the centre with Identify, Protect, Detect, Respond and Recover.

    From framework to enforcement

    Framework, policy, standards and baselines, implementation, monitoring and enforcement.

    Choosing and using frameworks

    FrameworkUse
    ISO/IEC 27001Certifiable management system
    NIST CSF 2.0Outcome-based structure and maturity view
    CIS ControlsPrioritised, practical safeguards
    NIST SP 800-53 / ISO/IEC 27002Detailed control catalogues

    Example. A company adopted NIST CSF and reported “Protect: tier 3” to the board. Testing found MFA covered only 60% of remote users. The standard existed, but nobody monitored compliance; adding a KCI closed the gap within a quarter.

    How the exam asks about it

    If the question asks…The answer is usually…
    Function added in NIST CSF 2.0Govern
    Certifiable security standardISO/IEC 27001
    Where specific security settings belongStandards and baselines
    Evidence that standards are followedMonitoring and control testing

    In short

    • Security frameworks give a structure for organising and measuring security controls.
    • NIST CSF 2.0 organises security into Govern, Identify, Protect, Detect, Respond and Recover.
    • ISO/IEC 27001 is certifiable; ISO 27002, NIST SP 800-53 and CIS Controls provide control detail.
    • Policies, standards and baselines make framework requirements specific and enforceable.
    • Monitoring, exceptions and metrics show whether standards are actually followed.

    Exam traps

    • Adopting a framework without tailoring it to risk.
    • Assuming framework adoption means controls are effective.
    • Standards that exist on paper with no monitoring.
    • Confusing ISO 27001 (certifiable) with ISO 27002 (guidance).

    Slides

    Click the slide and use the arrow keys. F toggles full screen.

    CRISC · Domain 4 · Security principles

    Security Frameworks and Control Standards

    How security frameworks such as NIST CSF, ISO 27001 and the CIS Controls give structure to a security program, and how policies, standards and baselines turn them into enforced controls.

    1 / 7