Last reviewed 9 min read

Section 11

Security Frameworks

Security frameworks provide structured approaches to managing cybersecurity risk. Choosing the right framework — and mapping controls across them — is a core skill for security architects.

Frameworks vs Standards

A framework provides a flexible structure for organizing security activities (NIST CSF, SABSA). A standard defines specific requirements that can be audited (ISO 27001, PCI DSS). Most organizations use a framework to organize their program and map standards for compliance.

Security Framework Map

NIST CSF 2.0 as the organizing framework with ISO 27001/27002, CIS, 800-53, SAMM, ASVS, and SABSA overlays.

NIST Cybersecurity Framework (CSF) 2.0

The gold standard for cybersecurity programs. NIST CSF 2.0 (released Feb 2024) added a sixth function — Govern — placing governance at the center of the framework. Free to use, voluntary, and widely adopted across industries.

Official source: NIST Cybersecurity Framework
Applies to: Threat Modeling · Architecture Risk Analysis

GOVERN

Establish and monitor risk management strategy, expectations, and policy

GV.OC, GV.RM, GV.RR, GV.PO, GV.SC

IDENTIFY

Understand assets, risks, and improvement opportunities

ID.AM, ID.RA, ID.IM

PROTECT

Implement safeguards for critical services

PR.AA, PR.AT, PR.DS, PR.PS, PR.IR

DETECT

Identify occurrence of cybersecurity events

DE.CM, DE.AE

RESPOND

Take action against detected incidents

RS.MA, RS.AN, RS.CO, RS.MI

RECOVER

Restore services after an incident

RC.RP, RC.CO

NIST CSF Implementation Tiers

Tier Name Characteristics Typical Organization
Tier 1 Partial Ad hoc, reactive, limited awareness Startups, early-stage companies
Tier 2 Risk Informed Approved but not org-wide, some processes Growing companies, some compliance
Tier 3 Repeatable Formally approved, regularly updated, org-wide Mature enterprises
Tier 4 Adaptive Continuous improvement, threat-informed, agile Security leaders, critical infrastructure

ISO 27001 / 27002:2022

The international standard for Information Security Management Systems (ISMS). ISO 27001 is the certifiable requirements standard; ISO 27002 provides the control guidance. The 2022 revision reorganized 114 controls into 93 controls across 4 themes.

Official source: ISO/IEC 27001
Applies to: Defense in Depth

Organizational Controls (37)

  • • A.5.1 – Policies for information security
  • • A.5.7 – Threat intelligence
  • • A.5.23 – Information security for cloud services
  • • A.5.30 – ICT readiness for business continuity

People Controls (8)

  • • A.6.1 – Screening
  • • A.6.3 – Information security awareness & training
  • • A.6.5 – Responsibilities after termination
  • • A.6.7 – Remote working

Physical Controls (14)

  • • A.7.1 – Physical security perimeters
  • • A.7.4 – Physical security monitoring
  • • A.7.10 – Storage media
  • • A.7.14 – Secure disposal or re-use

Technological Controls (34)

  • • A.8.5 – Secure authentication
  • • A.8.9 – Configuration management
  • • A.8.16 – Monitoring activities
  • • A.8.25 – Secure development lifecycle
  • • A.8.28 – Secure coding

ISO 27001 Certification Process

1. Gap Analysis → 2. ISMS Design → 3. Implement Controls → 4. Internal Audit → 5. Stage 1 Audit → 6. Stage 2 Audit → 7. Surveillance

CIS Controls v8.1

The Center for Internet Security (CIS) Controls are a prioritized set of 18 Controls (153 safeguards) across 3 Implementation Groups (IG1–IG3). The most prescriptive and actionable framework — start here if you need a practical starting point.

Official source: CIS Critical Security Controls
Applies to: Defense in Depth · Cloud-Native Security

# Control IG1 IG2 IG3
1 Inventory & Control of Enterprise Assets ● ● ●
2 Inventory & Control of Software Assets ● ● ●
3 Data Protection ● ● ●
4 Secure Configuration of Assets & Software ● ● ●
5 Account Management ● ● ●
6 Access Control Management ● ● ●
7 Continuous Vulnerability Management ● ● ●
8 Audit Log Management ● ● ●
9 Email & Web Browser Protections ● ● ●
10 Malware Defenses ● ● ●
11 Data Recovery ● ● ●
12 Network Infrastructure Management ● ● ●
13 Network Monitoring & Defense ○ ○ ●
14 Security Awareness & Skills Training ● ● ●
15 Service Provider Management ○ ● ●
16 Application Software Security ○ ● ●
17 Incident Response Management ● ● ●
18 Penetration Testing ○ ○ ●

Implementation Groups Explained

IG1 — Essential Cyber Hygiene

56 safeguards. For small organizations with limited IT resources. Minimum viable security.

IG2 — Mid-size Enterprise

74 additional safeguards. Organizations handling sensitive data with dedicated IT staff.

IG3 — Mature Organization

23 additional safeguards. Full coverage including advanced techniques like pen testing.

NIST SP 800-53 Rev 5

The most comprehensive security control catalog — 1,000+ controls across 20 families. Required for US federal agencies (FISMA) and commonly referenced by anyone building systems for the government.

Official source: NIST SP 800-53 Rev 5
Applies to: Defense in Depth · Zero Trust Architecture

AC

Access Control

AU

Audit & Accountability

CA

Assessment & Authorization

CM

Config Management

IA

Identification & Auth

IR

Incident Response

RA

Risk Assessment

SC

System & Comms Protection

SA

System & Services Acquisition

SI

System & Info Integrity

PE

Physical & Environmental

SR

Supply Chain Risk Mgmt

OWASP SAMM 2.0

The Software Assurance Maturity Model (SAMM) is the leading framework for measuring and improving software security practices. Five business functions, each with three security practices rated across maturity levels 0-3.

Official source: OWASP SAMM
Applies to: Secure SDLC Integration · Security Design Patterns

Governance

Strategy & Metrics | Policy & Compliance | Education & Guidance

Level 0: Implicit Level 1: Ad-hoc Level 2: Structured Level 3: Optimized

Design

Threat Assessment | Security Requirements | Security Architecture

Implementation

Secure Build | Secure Deployment | Defect Management

Verification

Architecture Assessment | Requirements Testing | Security Testing

Operations

Incident Management | Environment Management | Operational Management

SABSA (Enterprise Security Architecture)

Sherwood Applied Business Security Architecture — a layered framework for developing security architectures that are driven by business requirements. Widely used in enterprise consulting alongside TOGAF.

Official source: The SABSA Institute
Applies to: Reference Architectures · Secure by Design Principles

Layer View What (Assets) Why (Motivation)
Contextual Business Business assets Business risk
Conceptual Architect Information assets Control objectives
Logical Designer Information domains Security policies
Physical Builder Security mechanisms Security rules
Component Tradesman Products & tools Security standards

Framework Selection Decision Matrix

Choose the right framework based on your organization's drivers. Most mature organizations use multiple frameworks together.

Framework Best For Certifiable? Cost Complexity
NIST CSF 2.0 Overall program structure, risk management No (self-assessment) Free Medium
ISO 27001 International compliance, customer trust Yes (3rd party) $$$ High
CIS Controls Prescriptive implementation, quick wins No (benchmark) Free Low-Medium
NIST 800-53 US Federal / FedRAMP, comprehensive controls Yes (ATO) Free Very High
OWASP SAMM Software development maturity, AppSec No (self-assessment) Free Medium
SOC 2 Customer assurance for SaaS / cloud service providers Attestation (CPA report, not a certification) $$$ Medium
SABSA Enterprise security architecture design No (individual certification only) $$ High

How to Choose a Framework

Pick one organizing framework — for most teams that is NIST CSF 2.0 — and treat every other framework as an overlay rather than a second program. Add ISO 27001/27002 when you need a certifiable management system, CIS Controls for prescriptive quick wins, NIST SP 800-53 when you need a comprehensive control catalogue (or FedRAMP), OWASP SAMM/ASVS for application-security maturity and verification, and SABSA when the architecture itself is the deliverable. Map each overlay back to the organizing framework instead of running parallel workstreams. Chasing all of them at once produces compliance theatre — pick the one your business driver actually requires, and add the next only when the first is operational.

Cross-Framework Control Mapping

Use this mapping to satisfy multiple frameworks with a single set of controls. When you implement a control for one framework, check which others it also satisfies.

Security Domain NIST CSF ISO 27002 CIS Control NIST 800-53
Asset Inventory ID.AM A.5.9 CIS 1, 2 CM-8
Access Control PR.AA A.8.2-A.8.5 CIS 5, 6 AC-1 to AC-25
Data Protection PR.DS A.8.10-A.8.12 CIS 3 SC-8, SC-28
Vulnerability Mgmt ID.RA A.8.8 CIS 7 RA-5, SI-2
Logging & Monitoring DE.CM A.8.15-A.8.16 CIS 8 AU-1 to AU-16
Incident Response RS.MA A.5.24-A.5.28 CIS 17 IR-1 to IR-10
Secure Development PR.PS A.8.25-A.8.31 CIS 16 SA-11, SA-15
Network Security PR.IR A.8.20-A.8.23 CIS 12, 13 SC-7, SC-8

Practical Implementation Guide

Start Small, Map Outward

Start with CIS Controls IG1 for immediate security wins. Map those controls to your target framework (NIST CSF or ISO 27001) to get dual compliance value. Add complexity incrementally.

Phase 1: Foundation (Months 1-3)

  • • Select primary framework based on business drivers
  • • Conduct gap assessment against chosen framework
  • • Implement CIS IG1 safeguards for immediate protection
  • • Establish asset inventory (CIS 1 & 2)

Phase 2: Build Out (Months 3-9)

  • • Document policies and procedures (ISO 27001 clauses 4-10)
  • • Implement technical controls per gap assessment
  • • Deploy monitoring and logging (NIST CSF Detect)
  • • Develop incident response plan (NIST CSF Respond)

Phase 3: Mature (Months 9-18)

  • • Conduct internal audits and management review
  • • Measure effectiveness with metrics and KPIs
  • • Pursue certification if needed (ISO 27001, SOC 2)
  • • Integrate OWASP SAMM for software assurance

Industry-Specific Overlays

Healthcare

  • • HIPAA Security Rule
  • • HITRUST CSF
  • • NIST SP 800-66 (HIPAA mapping)

Financial Services

  • • PCI DSS v4.0.1
  • • SOX (Sarbanes-Oxley)
  • • FFIEC IT Examination Handbook

Cloud / SaaS

  • • SOC 2 Type II (AICPA)
  • • CSA STAR
  • • FedRAMP (NIST 800-53)

Critical Infrastructure

  • • NERC CIP (Energy)
  • • TSA Security Directives (Pipeline)
  • • IEC 62443 (Industrial)

Framework Alignment

NIST CSF 2.0: the organizing framework — GV, ID, PR, DE, RS, RC provide the structure the other frameworks plug into
ISO 27001/27002:2022, CIS Controls v8.1, NIST SP 800-53: control overlays for management-system compliance, prescriptive implementation, and a comprehensive control catalog
OWASP SAMM 2.0: software assurance maturity for application security practices
SABSA: enterprise security architecture design method
Related: Case Studies → | Reference Architectures →

Security Framework Labs

Map controls across frameworks and score your program against a maturity model.

Build a Control Crosswalk Custom Lab medium
Pick the framework that matches your main driver (NIST CSF 2.0 is the common organizer)List the controls you already run and map each to a NIST CSF functionAdd the ISO 27002, CIS v8.1, and NIST 800-53 references for the same controlsFind the controls with no owner and assign oneRun a gap assessment against CIS IG1 and record the top three gaps
Score Software Assurance Maturity Custom Lab easy
Take the OWASP SAMM self-assessment for one business function (for example Design)Score each practice 0-3 and record the evidence behind the scorePick the lowest-scoring practice and write the next maturity stepRepeat for the Verification function and compare
Need help setting up? Check our Lab Setup Guide →