The managing director of a mid-sized manufacturing firm called me with a procurement questionnaire from a a new European customer. One line on it asked whether his company was ISO 27001 certified. He had already asked his IT vendor, who had come back with a quotation for a security tool.
He asked me the question I hear most often. Which framework do we need?
It is the wrong question, and it costs businesses real money. These five frameworks are not five brands of the same product. They answer five different questions, and most mid-sized companies end up using three of them at once without ever calling them by name.
Here is what each one actually does, in order to meet them.
NIST CSF 2.0 (The language for the boardroom)
This is the framework you use to talk about security with people who do not work in IT.
It organises everything into six plain words: govern, identify, protect, detect, respond, recover. That is the whole structure. Do you know what you own? Can you keep it safe? Will you notice when something goes wrong? Can you get back up afterwards?
Its value is not technical. Its value is that it gives you and your IT provider a shared platform, so the budget conversation stops being a list of products and becomes a conversation about which of those six things you are weakest at. Most businesses discover they have spent heavily on protect and almost nothing on detect and recover.
If you only ever learn one of these five, learn this one.
ISO 27001:2022 (The certificate your customers ask for)
This is the one that arrived on the manufacturing MD’s questionnaire, and it will arrive on yours.
ISO 27001 is a management standard. It says you have written down how you handle information security, you review it, you keep evidence, and an external auditor has verified that you do what you wrote.
Understand clearly what you are buying. Certification proves discipline, not safety. Certified companies still get breached. But when a customer, an insurer or a bank needs assurance from someone outside your company, this is the currency they accept. No tool purchase substitutes for it.
CIS Controls v8.1 (The check-list list for weekly audit)
NIST tells you what outcomes matter. CIS tells you what to do.
It is a prioritised list of safeguards, ordered so the first few checks stops most common attacks. Know every device and application you own. Fix default configurations. Control who holds administrator rights. Patch. Back up, and test that the backup restores.
If you have a small IT team and a real budget ceiling, start here. Not because it is the most sophisticated of the five, but because the first fifteen or twenty items on this list stop the attacks that are actually hitting businesses your size.
CISA Zero Trust Maturity Model v2.0 (A ladder, not a product)
Zero trust is sold to you as something you buy. It is not.
The principle is simple: stop assuming anyone inside your network is trustworthy. Check identity every time, check the device too, and give each person access only to what they need.
This model exists to tell you where you stand on that journey and what the next rung looks like. It scores you across five areas; Identity, devices, networks, applications and data. It matters most when your people work from anywhere, your applications sit in the cloud, and your office firewall no longer marks the edge of anything.
MITRE ATT&CK v19 (The attacker’s playbook)
This is a catalogue of how attackers normally behave, step by step.
Security teams read it backwards. They take the techniques attackers use, check whether their own monitoring would catch each one, and find the gaps.
You do not need to study it yourself. But if you pay for a monitoring service or an outsourced SOC, ask them which ATT&CK techniques they have detection coverage for. The answer tells you a great deal about what you are actually buying.
Where compliance fits
DPDP, PCI DSS, SOC 2, HIPAA, GDPR. These are obligations, not frameworks. A regulator, a card network or a customer requires them of you.
The expensive mistake is running each one as a separate project with its own consultant and its own evidence folder. They overlap heavily. Map them once into a single set of controls, then show different evidence to different auditors from the same foundation.
How the five line up, control by control
The clearest way to see that these are not competitors is to put the work in the left column and let each framework name it in its own vocabulary.
| Control Group | NIST CSF 2.0 | ISO 27001:2022 | CIS Controls v8.1 | CISA ZTMM v2.0 | MITRE ATT&CK v19 |
|---|---|---|---|---|---|
| Governance, Roles & Risk | GV.OC, GV.RM, GV.RR, GV.PO | A.5.1, A.5.2, A.5.35 | Not a control | Governance (cross-cutting) | — |
| Asset & Software Inventory | ID.AM | A.5.9, A.8.1 | Controls 1, 2 | Devices pillar | Discovery tactic |
| Identity & Access, Privilege | PR.AA | A.5.15–A.5.18, A.8.2, A.8.5 | Controls 5, 6 | Identity pillar | Credential Access, Privilege Escalation |
| Secure Configuration & Hardening | PR.PS, PR.IR | A.8.9, A.8.19 | Control 4 | Devices, Applications | Defense Evasion |
| Vulnerability & Patch | ID.RA, PR.PS | A.8.8 | Control 7 | Devices, Applications | Initial Access, Execution |
| Data Protection & Classification | PR.DS | A.5.12, A.8.10–A.8.12, A.8.24 | Control 3 | Data pillar | Collection, Exfiltration |
| Network Segmentation & Defense | PR.IR | A.8.20–A.8.23 | Controls 12, 13 | Networks pillar | Lateral Movement, C2 |
| Logging & Monitoring | DE.CM, DE.AE | A.8.15, A.8.16 | Control 8 | Visibility & Analytics | The whole matrix |
| Incident Response | RS.MA, RS.AN, RS.MI, RS.CO | A.5.24–A.5.28 | Control 17 | Automation & Orchestration | Techniques become playbooks |
| Backup & Recovery | RC.RP, RC.CO | A.8.13, A.5.29, A.5.30 | Control 11 | Data pillar | Impact tactic |
| Supplier & Third Party | GV.SC | A.5.19–A.5.23 | Control 15 | Governance | Initial Access via trusted relationship |
| People & Awareness | PR.AT | A.6.3, A.6.1–A.6.6 | Control 14 | Identity pillar | Initial Access via phishing |
Three things stand out when you read down the columns.
NIST and ISO cover all twelve rows. CIS covers ten and says nothing about governance, because it assumes someone above it has already decided. That is not a weakness. It is precisely why a lean team can start there without first forming a committee.
Zero trust and ATT&CK are deliberately partial. The maturity model speaks only to the rows where who and what do we trust is the question. ATT&CK speaks only to the rows an attacker touches, which is why the logging row is where it earns its keep.
And every blank in the CIS column is a decision someone in the business has to make. If nobody has made it, that is where the programme eventually stalls.
So what should you do
Do CIS. Speak NIST. Certify to ISO when a customer makes it a condition of business. Climb the zero-trust ladder as your people and applications move out of the office. Bring in ATT&CK when you have someone watching alerts full time.
One last thing worth saying plainly. The framework is not the security.
Conclusion
Choosing a cybersecurity framework is not a procurement decision. It is a decision about which question your business most needs answered. 1) Where you are weakest 2) what you must prove to customers 3) Or, what you should fix first.
At DEV Information Technology Ltd., we help businesses map their current controls against NIST CSF, ISO 27001 and CIS, so leadership can see one consolidated picture instead of five disconnected ones. Whether you are responding to a customer questionnaire or building a security programme from the ground up, the right starting point saves years of rework.
FAQs
These five cybersecurity frameworks serve different purposes. NIST CSF 2.0 helps organizations manage cybersecurity risk, ISO 27001 establishes requirements for an information security management system and certification, and CIS Controls provides prioritized security safeguards. CISA’s Zero Trust Maturity Model helps organizations assess their progress toward zero trust, while MITRE ATT&CK documents adversary tactics and techniques to support threat detection and security testing.
CIS Controls is a practical starting point for many small and mid-sized businesses because it provides prioritized safeguards for common security risks. NIST CSF 2.0 can help leadership assess overall cybersecurity risk and set priorities. The best starting point depends on the organization’s existing security controls, available resources, risk exposure and customer requirements.
ISO 27001 certification is not universally mandatory for every business. However, customers, enterprise procurement teams, regulators or contractual agreements may require it in particular situations. Certification provides independently assessed evidence that an organization operates an information security management system that meets the standard’s requirements. Businesses should confirm the specific requirements applicable to their industry and customers.
Yes. Organizations can use multiple cybersecurity frameworks together because they address different aspects of security. For example, NIST CSF can guide risk management, ISO 27001 can support an auditable information security management system, and CIS Controls can guide technical implementation. Mapping overlapping requirements to a common set of controls can reduce duplicated work and simplify reporting.
A business should begin by identifying its security risks, customer and regulatory requirements, existing controls, and available resources. It can then assess gaps against a suitable framework, prioritize corrective actions, assign responsibilities, and establish a process for monitoring progress. A cybersecurity assessment from an experienced provider such as DEV IT can help consolidate these findings into a practical implementation roadmap.
Related Blogs
