Top 18 IT security frameworks and standards explained

Information security management encompasses everything from data security and encryption to application security, incident response and disaster recovery. Compliance requirements add another layer of complexity, with regulations and standards such as HIPAA, PCI DSS, SOX and GDPR shaping how organizations protect data.

CISOs and cybersecurity professionals must understand the security frameworks, standards and regulations relevant to their organizations and ensure appropriate controls are in place to demonstrate compliance during audits.

This guide explains the differences among standards, regulations, controls and frameworks; discusses common options; and outlines how to select and combine them to meet organizational needs.

What are IT security standards, regulations, controls and frameworks?

Standards delineate requirements or specifications for implementing security. A well-managed organization should comply with the requirements outlined in applicable standards, which typically have the following characteristics:

They are designed to be measurable and auditable.
They describe technical or procedural requirements.
They can be voluntary or mandatory.
Examples include ISO 27001, NIST Special Publication (SP) 800‑53 and PCI DSS.

Regulations are often legally binding and describe what must be done to comply with the rules and processes outlined in the regulation. Failure to comply with IT-focused regulations can result in financial penalties and litigation. They typically have the following characteristics:

They aren’t optional and have specific requirements for compliance.
They define what must be protected and what must be demonstrated to achieve compliance.
There are often financial penalties for noncompliance.
Examples include HIPAA, GDPR, SOX and the Gramm-Leach-Bliley Act (GLBA).

Controls typically define how to satisfy requirements of standards, regulations and frameworks. They are the primary elements in an IT audit. CISOs and their teams must be able to demonstrate compliance with relevant controls associated with specific standards and regulations. Controls have the following characteristics:

They specify activities teams must satisfy to demonstrate compliance with standards and regulations.
They can be technical, administrative or physical.
Examples include MFA use, encryption at rest and in motion, patch management and security testing.

Frameworks are high‑level, conceptual structures that detail how to develop, test, execute and maintain specific activities. A cybersecurity framework is a series of documented processes that define policies and procedures for implementing and managing cybersecurity controls. Frameworks provide a blueprint for managing risk and reducing vulnerabilities. They have the following characteristics:

They provide guidance and insights, rather than specific requirements.
They typically define domains, functions and outcomes.
They encourage flexibility in implementation.
Examples include the NIST Cybersecurity Framework (CSF), ISO 27001 — when used conceptually — and Center for Internet Security (CIS) Controls — when used as a framework.

Cybersecurity professionals use frameworks to define and prioritize the tasks required to manage enterprise security. Frameworks also help prepare for compliance and other IT audits. Therefore, they must support specific requirements defined in a standard or regulation.

Organizations can customize frameworks to solve specific security problems, such as industry-specific requirements or regulatory compliance goals. Frameworks also come in varying degrees of complexity and scale. Many frameworks overlap, so it’s important to select ones that effectively support operational, compliance and audit requirements. They should also be easy to adapt to existing security activities.

Why are security frameworks important?

Frameworks are essential resources for CISOs when establishing processes, protocols, policies and administrative activities for cybersecurity management. The following list addresses why CISOs need frameworks:

Alignment with strategic business requirements. Frameworks can help align cybersecurity with business objectives and risk appetite.
Benchmarking. They help compare program maturity against industry norms and peers.
Governance and compliance. Frameworks help establish methods for governing cybersecurity activities and ensuring compliance with relevant standards and regulations.
Consistency. CISOs can use frameworks to formulate repeatable, measurable enterprise-wide cybersecurity practices.
Risk reduction. They help implement proven, vetted and sustainable approaches to reducing cyber-risk.
Resource justification. Considering the costs associated with cybersecurity management, frameworks help CISOs understand the value of certain investments, such as IAM, logging, segmentation and patching.
Audit readiness. The use of frameworks provides CISOs with defensible evidence for regulators, auditors and boards.
Communication. The common language found in frameworks enhances communications among executives, regulators and technical teams.

Once specific compliance requirements have been identified, teams must determine which frameworks facilitate compliance with the relevant standards and regulations.

How to choose an IT security framework

Multiple factors drive the choice to use a particular security framework, including industry or compliance requirements. Review the following criteria when evaluating prospective frameworks:

Support for regulatory requirements. Frameworks and standards that align with applicable compliance obligations — e.g., NIST SP 800-53 for organizations subject to relevant federal security requirements, PCI DSS for organizations that store, process or transmit payment card data — should rise to the top of a list of candidates.
Alignment with relevant industries. Consider frameworks that specifically align with relevant sectors — e.g., ISO 27001 for global enterprises, HITRUST for healthcare. Note that nonaligned frameworks can also provide value.
Linkage to the enterprise’s maturity. Programs in their early stages benefit from prescriptive frameworks such as CIS Controls. Established and mature programs benefit from flexible, risk‑based frameworks, such as NIST CSF.
Complexity and scope. For example, NIST SP 800‑53 is comprehensive and control‑based, ISO 27001 is governance‑focused and covers a broad spectrum of issues, and the CIS Controls are structured and focus on implementation-related issues.
Support for audit activities. Look for documents that are highly detailed in their controls and recommended processes, e.g., ISO 27001, to ensure sufficient evidence is available for an audit.
Support for cloud environments. CISOs managing extensive cloud ecosystems should consider frameworks such as the EDM Council Cloud Data Management Capabilities (CDMC) or the Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM).
Support for global operations. CISOs working in multinational firms should consider frameworks that support globally recognized standards and regulations, such as ISO 27001 and GDPR, respectively.
Alignment and integration with existing controls. CISOs should consider frameworks that map to guidance already in use, e.g., existing NIST or CIS Controls.
Recognition of board and stakeholder expectations. Some boards prefer ISO or NIST standards and guidance. CISOs must recognize that and adapt accordingly.

Although some ISO standards and EU regulations can be time-consuming to implement, CISOs must empower their teams to identify and implement the most relevant frameworks and guidance to ensure optimal cybersecurity performance and compliance.

Top IT security standards and frameworks

The following standards and frameworks help security professionals organize and manage an information security program.

1. ISO 27000 series

The International Organization for Standardization developed the ISO 27000 series, a flexible set of information security standards that applies to organizations of all types and sizes.

The two primary standards — ISO 27001 and ISO 27002 — support the creation and management of an information security management system (ISMS). ISO 27000 provides an overview and vocabulary for the series, ISO 27001 defines ISMS requirements and ISO 27002 provides guidance on information security controls.

Organizations can assess their implementation of the ISO 27000 series through audits and, in the case of ISO/IEC 27001, obtain certification of their ISMS through an accredited certification body.

2. NIST CSF

The NIST CSF was developed under Executive Order 13636, issued in 2013, as a voluntary framework to help improve cyber-risk management in U.S. critical infrastructure. In 2024, NIST released the CSF 2.0, which broadened the framework’s applicability to organizations of all sizes and sectors.

The CSF 2.0 is organized around six core functions: govern, identify, protect, detect, respond and recover. Like all IT security programs, these functions require the support of senior management.

3. NIST AI Risk Management Framework

NIST released the AI Risk Management Framework (RMF), also known as AI-100-1, in 2023 to enable organizations to address AI risks. The voluntary, rights‑preserving framework is built on four functions — govern, map, measure and manage — that help organizations incorporate responsible AI practices throughout the design, development, deployment and use of AI systems.

The AI RMF identifies several characteristics of trustworthy AI, including validity, safety, security, accountability, privacy and fairness.

4. NIST SP 800-53

“SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations” is the information security benchmark for U.S. government agencies and is widely used in the private sector. It has helped spur the development of security frameworks, including the NIST CSF.

5. NIST SP 800-171

“SP 800-171 Rev. 3: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” has gained popularity due to requirements set by the U.S. Department of Defense regarding contractor compliance with security frameworks. The DoD’s current Cybersecurity Maturity Model Certification (CMMC) requirements continue to use SP 800-171 Rev. 2 for assessments, pending future rulemaking to incorporate Rev. 3.

The security requirements in SP 800-171 are based on a subset of the controls in SP 800-53, tailored to protecting controlled unclassified information in nonfederal systems and organizations. It’s possible to build a crosswalk between the two standards to identify corresponding controls and requirements. However, compliance with SP 800-171 doesn’t automatically demonstrate compliance with SP 800-53. Organizations can use the crosswalk to identify additional controls that might be needed to meet their specific requirements.

6. NIST SP 1800 series

The NIST SP 1800 series, also known as the NIST Cybersecurity Practice Guides, is a set of documents that complement the SP 800 series of standards and frameworks. They provide guidance on implementing and applying standards-based cybersecurity technologies in real-world applications.

The SP 1800 series publications provide the following:

Examples of specific situations and capabilities.
Experience-based, how-to approaches using multiple products to achieve the desired result.
Modular implementation guidance on capabilities for organizations of all sizes.
Specifications of required components and installation, configuration and integration information so organizations can easily replicate the process themselves.

Guides include implementing zero trust, DevSecOps practices, mobile device security, 5G security and data confidentiality.

7. COBIT

COBIT, released in 1996 by ISACA, originally focused on helping auditors navigate IT environments. Versions 3 and 4 added cybersecurity guidelines. COBIT 5, released in 2012, included new technology and business trends to help organizations balance IT and business goals. The current version is COBIT 2019. It’s a widely used framework that helps organizations support SOX compliance by strengthening IT governance and internal controls. Numerous publications and professional certifications address COBIT requirements.

8. CIS Controls

CIS Critical Security Controls, Version 8.1 — formerly the SANS Top 20 — lists technical security and operational controls that can apply to any environment. It doesn’t address risk analysis or risk management as the NIST CSF does; rather, it focuses primarily on reducing risk and increasing resilience for technical infrastructure. It was updated in 2024 to align with the updated NIST CSF 2.0.

The 18 CIS Controls include inventory and control of enterprise assets, data protection, audit log management, malware defenses and penetration testing.

9. HITRUST Common Security Framework

The HITRUST Common Security Framework includes risk analysis and risk management frameworks, as well as operational requirements. The framework comprises 14 control categories and applies to almost any organization, including healthcare organizations. Categories include access control, HR security, risk management, physical and environmental security and privacy practices.

10. GDPR

The EU’s GDPR is a regulation that requires organizations within its scope to protect individuals’ personal data and privacy rights.

GDPR requirements include protecting stored data against unauthorized access, using measures such as the principle of least privilege, role-based access and MFA, where appropriate. Failure to comply with GDPR requirements can result in significant fines.

11. COSO

The Committee of Sponsoring Organizations of the Treadway Commission is a joint initiative of five professional associations that has published two complementary frameworks.

Its Internal Control – Integrated Framework, released in 1992 and updated in 2013, helps companies adopt a risk-based approach to internal controls. It covers the following components, referred to as the five pillars:

Control environment.
Risk assessment.
Control activities.
Information and communication.
Monitoring activities.

12. PCI DSS

PCI DSS is a set of industry requirements and guidelines designed to help ensure secure business transactions and protect payment account data and cardholder data, including credit card numbers, expiration dates and security codes.

The 12 PCI DSS requirements include the following:

Installing and maintaining network security controls.
Protecting stored account data.
Developing and maintaining secure systems and software.
Testing system and network security regularly.

13. CMMC

The CMMC is a framework developed by the DoD to ensure government-approved contractors comply with cybersecurity requirements. It defines the following three certification levels:

Foundational. Minimum security requirements for contractors handling federal contract information.
Advanced. For contractors handling controlled unclassified information.
Expert. For select contractors handling controlled unclassified information that requires enhanced protection against advanced persistent threats.

CMMC 1.0 was released in 2020. Version 2.0 went into effect in December 2024. In July 2026, the DoD suspended the CMMC’s second phase, but the first phase remains in place.

14. FISMA

The Federal Information Security Modernization Act, which is implemented in part through the NIST RMF, establishes requirements for protecting federal government data and systems.

FISMA requires U.S. federal agencies to develop, document and implement security programs. Its requirements also apply to contractors and other third parties that support federal information systems. Compliance requirements include continuous monitoring, annual security reviews and baseline security controls, such as those outlined in NIST SP 800-53.

15. NERC CIP

The North American Electric Reliability Corporation Critical Infrastructure Protection standards apply to certain registered entities within the bulk power system. The standards establish mandatory requirements for monitoring, managing and maintaining the cybersecurity and physical security of critical electric grid infrastructure. Applicable registered entities must comply with the NERC CIP requirements.

CIP standards include the following:

CIP-004-7 Cyber Security — Personnel and Training.
CIP-008-6 Cyber Security — Incident Reporting and Response Planning.
CIP-013-2 Cyber Security — Supply Chain Risk Management.
CIP-014-3 Physical Security.

16. SOC 2

System and Organization Controls 2 is an examination and reporting engagement developed by the American Institute of Certified Public Accountants (AICPA). It enables service organizations to demonstrate how their controls address security and other aspects of their systems and services.

SOC 2 examinations use the following AICPA Trust Services Criteria:

Security. Protection of systems against data loss, unauthorized access and other threats.
Availability. Ensures systems are operational, available and monitored.
Processing integrity. Completeness, accuracy, timeliness and authorization of systems processing.
Confidentiality. Protection of data designated as confidential.
Privacy. Appropriate collection, use, retention, disclosure and disposal of personally identifiable information.

17. FAIR

Developed by the Jack Jones and Factor Analysis of Information Risk Institute, FAIR is a quantitative risk analysis model that helps CISOs understand, analyze and measure information and operational risk in financial terms. It breaks down risk into two elements:

Loss event frequency. This attribute considers how often a loss event might occur.
Loss magnitude. This estimates the magnitude of potential losses, including primary losses — e.g., downtime — and secondary losses — e.g., reputational damage.

18. CSA Cloud Controls Matrix

The CCM is a comprehensive vendor-neutral cybersecurity framework designed for cloud environments. Version 4.1 has 207 security and privacy controls across 17 domains. The framework is designed to help organizations assess, implement and manage a broad range of cloud security risks, while clarifying shared security responsibilities.

The CCM aligns with CSA Security Guidance and maps to several key industry standards, such as ISO 27001, 27017 and 27018; NIST SP 800-53; AICPA’s Trust Services Criteria and SOC 2 Type 2 report; and PCI DSS 4.0.

How to use multiple cybersecurity frameworks

Cybersecurity frameworks aren’t one-size-fits-all, so many medium- to large organizations today use more than one. Blending frameworks can provide the following additional benefits:

Broad-based holistic coverage. For a comprehensive program, CISOs should consider using the NIST CSF for strategy, NIST SP 800‑53 for controls and ISO 27001 for governance.
Mapping to multiple requirements. In situations where overlapping regulatory obligations — e.g., HIPAA, SOX, GDPR, PCI DSS — exist, multiple frameworks can cover all the bases.
Support for cloud and modern infrastructures. To ensure coverage of identity, entitlements and data lineage, CISOs might combine traditional frameworks — ISO, NIST — with cloud‑specific ones, such as CCM or CDMC.
Establishing control harmonization. To reduce redundancy, CISOs can map controls across frameworks, thereby establishing a uniform control catalog.
Risk alignment across vendors and third parties. The use of SOC 2 and ISO 27001 can help CISOs establish a more complete risk posture.

Small and medium-sized companies might obtain good results from a single framework. The following are some reasons why this makes sense:

Smaller organizations might have limited resources and budgets.
Organizations that must satisfy only one regulation or standard, such as payment card firms complying with PCI DSS, might only need a PCI-optimized framework.
Cybersecurity programs in their early development stages might need only one framework for simplicity and clarity.
Organizations that must comply with specific regulations and standards might need specific guidance to achieve certification, e.g., ISO 27001 certification and SOC 2 attestation.

Paul Kirvan, FBCI, CISA, is an independent consultant and technical writer with more than 35 years of experience in business continuity, disaster recovery, resilience, cybersecurity, GRC, telecom and technical writing.