Working in Governance, Risk, and Compliance means knowing three things about security frameworks: what they are, when they are used, and what is involved in each one. I wanted a single reference that held all of that in one place, and once I built it, it seemed worth sharing. So here it is; a cheat sheet to help you decide how to pick out a security framework. If it helps you, pass it along. Having one will only grow more important as the threats against our environments keep multiplying.
Before the table, one idea makes all of this far easier to carry. When people first meet this list, they assume they have to learn a dozen unrelated systems. They do not. Underneath nearly every framework sits the same small core: controls that protect the confidentiality, integrity, and availability of information. Learn that core once, and each framework becomes a different way of packaging and labeling those same controls for a different audience: federal agencies, auditors, payment processors, hospitals, the Department of Defense. Learn the crosswalk, and you have learned them all at once.
Four shelves of a security framework for a crowded room
It helps to sort the frameworks into four functional groups. The group tells you why a framework exists and who tends to ask for it.
| Bucket | What it is | Examples | Who asks for it |
|---|---|---|---|
| Risk / governance | How to run a security program and make risk decisions | NIST CSF, NIST RMF, COBIT, COSO | Boards, leadership, auditors |
| Control catalogs | The actual menu of safeguards to implement | NIST 800-53, ISO 27002, CIS Controls | Engineers, GRC analysts |
| Certifiable standards | A formal seal a third party verifies | ISO 27001, SOC 2, PCI DSS, CMMC | Customers, partners, regulators |
| Laws / regulations | Legal mandates with penalties | HIPAA, FISMA, GDPR, CCPA | Government, courts |
The frameworks at a glance
Here is the reference itself. Current versions are noted with each name. “Certifiable?” tells you whether an outside party formally verifies it. “When to reach for it” is the column I most wanted, because it answers the question the others leave open: which situation actually calls for this one. Or the “why would I use this security framework”? A question those new to securing their environment will have to ask.
| Framework | Origin | What it does | Certifiable? | When to reach for it |
|---|---|---|---|---|
| NIST CSF (2.0) | NIST | Voluntary umbrella for cyber risk; six functions | No (self-assessed) | You need a common language to organize and report a whole program to leadership |
| NIST SP 800-53 (Rev 5) | NIST | Master catalog of security + privacy controls (20 families) | No (basis for FISMA/FedRAMP) | You need the actual control definitions to implement or assess |
| NIST SP 800-171 (Rev 3) | NIST | Protecting Controlled Unclassified Information in non-federal systems | Basis for CMMC | A contractor, university, or lab handles government CUI |
| NIST RMF / 800-37 (Rev 2) | NIST | Seven-step process to authorize and monitor systems | No | You must formally authorize a system to operate and keep watching it |
| ISO/IEC 27001 (2022) | ISO/IEC | Requirements for an information security management system | Yes (org certifies) | Commercial or international partners require a certifiable ISMS |
| ISO/IEC 27002 (2022) | ISO/IEC | Implementation guidance for 27001’s 93 controls | No | You are implementing 27001 and need the how-to |
| SOC 2 (TSC 2017) | AICPA | Auditor attestation on Trust Services Criteria | Yes (Type I/II) | SaaS customers want proof of operating controls during vendor review |
| PCI DSS (v4.0.1) | PCI SSC | Protecting cardholder data; 12 requirements | Yes (AOC/ROC) | The moment you store, process, or transmit payment-card data |
| CIS Controls (v8.1) | CIS | 18 prioritized, prescriptive controls | No | You are building a program from scratch and want a prioritized action list |
| CIS Benchmarks (ongoing) | CIS | Hardening configurations per technology | No | You are hardening specific systems and need exact secure settings |
| COBIT (2019) | ISACA | IT governance and management | No | The focus is governance: aligning IT to business goals and audit |
| COSO (2013 / ERM 2017) | COSO | Internal control and enterprise risk | No | The lens is internal control and financial audit (SOX) |
| CMMC (2.0) | US DoD | Certifies defense contractors against 800-171 | Yes | You are a DoD contractor that must certify CUI handling to bid |
| HIPAA Security Rule | HHS | Safeguards for electronic protected health information | No (audited) | You handle ePHI: providers, plans, and their business associates |
| FedRAMP (Rev 5) | GSA | Standardized cloud authorization built on 800-53 | Yes | You are a cloud provider selling to the federal government |
| FISMA (2002/2014) | US Congress | Requires federal agencies to secure systems | N/A (law) | You are a federal agency or its contractor, by law |
| GDPR / CCPA | EU / California | Data privacy and protection rights | N/A (law) | You process personal data of EU residents or California consumers |
| ITIL 4 (2019) | Axelos | IT service management, adjacent to security | Personal cert | The goal is service-management maturity, not security itself |
Which security framework do I actually need?
Most of the time, a single trigger decides it for you:
- You touch credit-card data: PCI DSS.
- You sell software to other businesses and they ask for assurance: SOC 2.
- You handle health information: the HIPAA Security Rule.
- You want federal or defense work: NIST 800-171, then CMMC or FedRAMP.
- You want one umbrella to organize everything else: NIST CSF.
One control, five names
Take a control almost everyone knows: multi-factor authentication. In NIST CSF it lives under PR.AA, identity and access. For 800-53 it is IA-2. In ISO 27001 it is Annex A control 8.5. Then in PCI DSS it is Requirement 8. Finally, under HIPAA it falls within the technical safeguards for access. One safeguard, five labels across each security framework. Once you can see a single control wearing five name tags, the landscape stops looking like a dozen rival systems and starts looking like one.
The structure of a security framework
Each security framework has its own structure. For instance, the CSF 2.0 functions are Govern, Identify, Protect, Detect, Respond, and Recover. You can use the mnemonic Gastro, Intestinal, Problems, Do, Really, Reek. The letters of each piece of the mnemonic are the same initials for the functions of the cybersecurity framework. Mnemonics are better if they are vivid and memorable. I’ll let you do your own for the rest of the frameworks for now.
The RMF runs in seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. SOC 2 rests on five Trust Services Criteria: Security, Availability, Processing integrity, Confidentiality, and Privacy, where Security is the only one always required.
A word before the cheat sheet does its work
A security framework is a floor, not a goal. Every framework above describes a minimum: a baseline of controls a serious organization keeps in place. Meeting that baseline is good. Mistaking it for the destination is dangerous.
There is a principle worth keeping in view, sometimes called Goodhart’s Law: when a measure becomes a target, it ceases to be a good measure. The moment “pass the audit” becomes the goal, the framework stops measuring your security and starts measuring your ability to pass the audit. Teams optimize for the checkbox instead of the outcome it was built to represent. You can satisfy every control and still be insecure, because attention quietly shifts from protecting the environment to producing the evidence.
So use these frameworks for what they are: a shared language and a tested baseline. Then aim past them. The goal is not a clean report. The goal is to be genuinely trustworthy with what has been entrusted to you: your users’ data, your organization’s systems, the people counting on both. Compliance proves you cleared the floor. Stewardship is what you do with the room above it.
Frameworks will keep growing in importance as the threats keep coming. Learn the core once, reach for the right one when the situation calls for it, and never confuse clearing the floor with finishing the work.
Found this useful? Share it with someone in IT or GRC who could use the map.
Are you looking at picking out a security framework because you got hacked? Read about what to do here:
What To Do When You Get Hacked.
Leave a Reply