Security Frameworks Compared: NIST CSF 2.0, ISO 27001 and CIS Controls

Guides › Study topics

Updated 1 Nov 2026 · 5 min read

On this page

1. Four documents, four different jobs
2. NIST CSF 2.0: outcomes, not instructions
3. ISO/IEC 27001:2022: the certifiable ISMS standard
4. ISO/IEC 27002:2022: the guidance behind the controls
5. CIS Controls v8.1: a prioritised starting list
6. How the frameworks fit together
7. How this fits your exam
8. Frequently asked questions
9. Sources

After this page you will be able to explain what NIST CSF 2.0, ISO/IEC 27001:2022, ISO/IEC 27002:2022 and CIS Controls v8.1 each are, how they are structured, and which of them an organisation can be certified against. They are often lumped together as "frameworks", but they do different jobs, and knowing the job is what lets you pick the right one in a scenario question.

Four documents, four different jobs

NIST CSF 2.0: outcomes, not instructions

NIST published CSF 2.0 as NIST CSWP 29 on 26 February 2024, the first major update since the framework was created in 2014. Before version 2.0 it was called the "Framework for Improving Critical Infrastructure Cybersecurity", and NIST says it now explicitly aims to help all organisations, not just those in critical infrastructure. The CSF offers a taxonomy of outcomes that any organisation can use regardless of size, sector or maturity, and it does not prescribe how those outcomes should be achieved. Instead it links to Informative References that point to existing standards, guidelines and frameworks.

The CSF Core is a hierarchy of Functions, Categories and Subcategories. The six Functions are:

• Govern (GV): the organisation's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. This is the Function newly added in 2.0.
• Identify (ID): the organisation's current cybersecurity risks are understood.
• Protect (PR): safeguards to manage the organisation's cybersecurity risks are used.
• Detect (DE): possible cybersecurity attacks and compromises are found and analysed.
• Respond (RS): actions regarding a detected cybersecurity incident are taken.
• Recover (RC): assets and operations affected by a cybersecurity incident are restored.

NIST says the Functions should be addressed concurrently. Two other components sit around the Core. An Organizational Profile describes current or target posture in terms of the Core's outcomes. Tiers characterise the rigour of an organisation's risk governance and management, from Partial (Tier 1) through Risk Informed (Tier 2) and Repeatable (Tier 3) to Adaptive (Tier 4).

ISO/IEC 27001:2022: the certifiable ISMS standard

ISO describes ISO/IEC 27001 as the world's best-known standard for information security management systems, and says it defines requirements an ISMS must meet. The current edition is ISO/IEC 27001:2022, edition 3, published in October 2022. It has one amendment, ISO/IEC 27001:2022/Amd 1:2024, titled Climate action changes. The 2013 edition is withdrawn.

Certification is where 27001 differs from the others. ISO says organisations implementing it can decide whether to go through a certification process, and that holding a certificate from an accredited conformity assessment body may add confidence. ISO also asks that certification be stated with the full reference, for example "certified to ISO/IEC 27001:2022". ISACA's glossary describes ISO/IEC 27001 as intended to provide the foundation for third-party audit.

The controls live in Annex A. ISO's help centre states that the 2022 revision details 93 controls grouped into four domains: organizational, people, physical and technological controls.

ISO/IEC 27002:2022: the guidance behind the controls

ISO/IEC 27002:2022 is a separate standard, edition 3, published in February 2022. ISO explains the relationship directly: ISO/IEC 27001 specifies the requirements for establishing an ISMS, while ISO/IEC 27002 provides the detailed best practices and controls that can be applied within it. ISO also states that 27002 provides best practice recommendations and cannot be certified to, but organisations can be certified to 27001, which references 27002 guidance.

People often mix these two up because the numbers are one apart and both talk about controls. The quick test is the verb: 27001 says what an ISMS must do, and 27002 explains how you might implement the controls.

CIS Controls v8.1: a prioritised starting list

CIS describes the CIS Critical Security Controls as a prescriptive, prioritised and simplified set of best practices, and as a prioritised set of Safeguards to defend against the most prevalent cyber attacks. There are 18 Controls, running from Control 1, Inventory and Control of Enterprise Assets, to Control 18, Penetration Testing. CIS counts 153 Safeguards in both v8 and v8.1.

Version 8.1 is an iterative update to v8. CIS says it adds updated alignment to industry standards and frameworks, revised asset classes and Safeguard descriptions, and the "Govern" security function introduced in NIST CSF 2.0.

Implementation Groups (IGs) tell an organisation where to start. There are three, based on the risk profile and resources an enterprise has. Every enterprise should start with IG1, which CIS defines as "essential cyber hygiene". IG2 builds on IG1, and IG3 comprises all the Controls and Safeguards.

How the frameworks fit together

These are not rivals you must choose between. The CSF is designed to be used with other resources, and NIST says it should be used in conjunction with frameworks, standards and guidelines. CIS says its Controls are mapped to and referenced by multiple legal, regulatory and policy frameworks, and v8.1 was realigned to the CSF 2.0 security functions. A reasonable way to hold them in your head: the CSF describes the outcomes, ISO/IEC 27001 gives a management system you can be certified against, ISO/IEC 27002 explains the controls, and the CIS Controls give a prioritised list to start with.

How this fits your exam

ISC2 CISSP. The outline, effective 15 April 2024, lists security control frameworks under objective 1.3 with ISO, NIST, COBIT, SABSA, PCI and FedRAMP as examples, and risk frameworks under objective 1.9. It names ISO and NIST as organisations, not specific documents such as CSF 2.0 or ISO/IEC 27001:2022. See our CISSP guide.

ISACA CISM. Domain 1, Information Security Governance (17 per cent), includes information governance frameworks and standards. Domain 3, Information Security Program (33 per cent), includes industry standards and frameworks for information security. ISACA says the outline will be updated effective 3 November 2026. More in the CISM guide.

ISACA CISA. Domain 5, Protection of Information Assets (26 per cent), includes information asset security frameworks, standards and guidelines, and Domain 2 includes laws, regulations and industry standards. The CISA study guide covers the audit side.

Frequently asked questions

Can an organisation be certified to ISO/IEC 27002?

No. ISO states that ISO/IEC 27002 provides best practice recommendations and cannot be certified to. Certification is to ISO/IEC 27001, which references the 27002 guidance.

What changed from CSF 1.1 to CSF 2.0?

One change is the Govern Function, newly added in 2.0, which brings the Core to six Functions. NIST also broadened the stated audience from critical infrastructure to all organisations and dropped the old title, "Framework for Improving Critical Infrastructure Cybersecurity".

Which CIS Implementation Group comes first?

IG1. CIS says every enterprise should start with IG1, the "essential cyber hygiene" set, then IG2 builds on it and IG3 covers all the Controls and Safeguards.

Sources

• The NIST Cybersecurity Framework (CSF) 2.0
• NIST Releases Version 2.0 of Landmark Cybersecurity Framework
• ISO/IEC 27001:2022 Information security management systems
• ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection: Information security controls
• CIS Critical Security Controls Version 8.1
• CIS Critical Security Controls Implementation Groups

Read the CISA exam guide, then test yourself with free CISA practice questions.