Should I use ISO 27001 or the NIST Cybersecurity Framework?
Short answer
They serve different purposes and work well together. NIST CSF is free, voluntary guidance for organizing and improving a security program. ISO 27001 is a certifiable standard that proves to outsiders that you run a managed program. Many organizations use CSF to plan and ISO 27001 to certify.
The details
If no customer or regulator is asking for certification, CSF or the CIS Controls are a practical, low-cost starting point.
Terms explained
- CIS Controls
- The CIS Critical Security Controls are a prioritized set of security safeguards from the Center for Internet Security, grouped into Implementation Groups, with IG1 as a baseline for small organizations.
- ISO/IEC 27001
- ISO/IEC 27001 is the international standard for an information security management system (ISMS), against which organizations can be independently certified.
- NIST Cybersecurity Framework
- The NIST Cybersecurity Framework (CSF) 2.0 is voluntary guidance for managing cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Sources
Related questions
Related Guides
GuideGRC
How to Conduct a Cybersecurity Risk Assessment in 7 Steps
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
Read more GuideGRC
How to Build a Security Policy Framework: Policies, Standards and Procedures That People Follow
A practical guide to writing, approving and maintaining information security policies: the policy hierarchy, the core policy set, ownership, review cycles and how to prove people follow them.
Read more GuideGRC
10 Steps to Implement ISO 27001 and Get Certified
A step-by-step ISO/IEC 27001:2022 implementation plan: scope, leadership, risk assessment, Statement of Applicability, Annex A controls, internal audit, management review and the certification audit.
Read more GuideGRC
How to Run a Security Awareness Training Program That Changes Behaviour
Build a security awareness and training program that changes behaviour: role-based content, phishing simulations done fairly, policy acknowledgement, metrics that matter and reporting to leadership.
Read more