Security Frameworks: NIST CSF 2.0 & ISO 27001

Individual controls such as MFA, backups and firewalls are important, but organisations also need a way to answer bigger questions. Are we covering everything? Where are we weakest? How do we prove to a client, a regulator or an auditor that we manage security properly? Security frameworks provide that structure.

In this lesson you will learn the two frameworks you will meet most often: the NIST Cybersecurity Framework (CSF) 2.0 and ISO/IEC 27001:2022. You will also see other frameworks common in India, and use Python to measure coverage and gaps the way GRC teams do.

Why frameworks matter

A framework gives:

• A common language: "we are weak in Detect" means the same thing to the CISO, the board and the auditor.
• Coverage: a checklist of areas so nothing important is forgotten.
• A way to measure progress from year to year.
• Evidence for clients and regulators, sometimes through formal certification.

Frameworks are not the same as security. An organisation can have perfect documents and still be breached. Use them to organise real work, not to replace it.

NIST CSF 2.0

The NIST Cybersecurity Framework was first published in 2014. Version 2.0, released in February 2024, is written for organisations of every size and sector, not only critical infrastructure. Its Core is organised into six Functions:

Govern is new in 2.0. It sits at the centre and makes security a leadership responsibility rather than only an IT task. Each Function is divided into Categories (such as PR.AA, Identity Management, Authentication and Access Control) and more specific Subcategories, which link to detailed references such as ISO 27001 controls or NIST SP 800-53.

Two more ideas make the CSF practical:

• Profiles: a current profile describes what you do today; a target profile describes where you want to be. The gap between them becomes your plan.
• Tiers (1 Partial, 2 Risk Informed, 3 Repeatable, 4 Adaptive) describe how mature and consistent your approach to risk is.

A small business can build a simple profile by scoring each Function now and in the target state:

current = {"Govern": 1, "Identify": 2, "Protect": 3, "Detect": 1, "Respond": 1, "Recover": 2}
target = {"Govern": 3, "Identify": 3, "Protect": 3, "Detect": 3, "Respond": 2, "Recover": 3}

gaps = {f: target[f] - current[f] for f in current}
for function in current:
    bar = "#" * current[function] + "." * gaps[function]
    print(f"{function:<9} {bar:<5} now {current[function]}, target {target[function]}")

print("Biggest gaps:", ", ".join(f for f, g in sorted(gaps.items(), key=lambda x: -x[1]) if g == max(gaps.values())))

Govern    #..   now 1, target 3
Identify  ##.   now 2, target 3
Protect   ###   now 3, target 3
Detect    #..   now 1, target 3
Respond   #.    now 1, target 2
Recover   ##.   now 2, target 3
Biggest gaps: Govern, Detect

This pattern, strong in Protect and weak in Detect, is very common: organisations buy prevention tools but cannot see when an attacker gets past them. NIST's incident response guide (SP 800-61 Rev. 3, 2025) is itself built as a CSF 2.0 profile, as you saw in Incident Response.

ISO/IEC 27001:2022

ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, processes, people and controls an organisation uses to manage information security risk. Unlike the CSF, it is certifiable: an accredited certification body audits the organisation and issues a certificate, which many Indian IT companies need to win contracts.

The standard has two parts:

• Clauses 4 to 10: the management system requirements, all mandatory. They cover context, leadership, planning (including risk assessment and treatment), support, operation, performance evaluation and improvement. This is a "Plan, Do, Check, Act" cycle.
• Annex A: a list of 93 controls in four themes, used as a reference when treating risks.

The 2022 edition reorganised the older 2013 list of 114 controls in 14 domains into these 93 controls, including 11 new ones such as threat intelligence, information security for cloud services, data masking, data leakage prevention, web filtering and secure coding. The transition period for certified organisations ended on 31 October 2025, so certificates now follow the 2022 version. Detailed guidance for each control is in the companion standard ISO/IEC 27002:2022.

Not every control applies to every organisation. Selection is risk-based, and the Statement of Applicability (SoA) records each control, whether it applies, why, and whether it is implemented:

soa = [
    ("5.7", "Threat intelligence", True, "implemented"),
    ("5.23", "Information security for use of cloud services", True, "partial"),
    ("6.3", "Information security awareness, education and training", True, "implemented"),
    ("7.4", "Physical security monitoring", True, "planned"),
    ("8.11", "Data masking", True, "partial"),
    ("8.28", "Secure coding", True, "implemented"),
    ("8.30", "Outsourced development", False, "not applicable: no outsourced development"),
]

themes = {"5": "Organisational", "6": "People", "7": "Physical", "8": "Technological"}
applicable = [c for c in soa if c[2]]
done = [c for c in applicable if c[3] == "implemented"]

for ref, name, applies, status in soa:
    print(f"A.{ref:<5} {themes[ref.split('.')[0]]:<15} {status:<12} {name}" if applies else f"A.{ref:<5} {'excluded':<15} {status}")
print(f"Implemented {len(done)} of {len(applicable)} applicable controls ({100 * len(done) // len(applicable)}%)")

A.5.7   Organisational  implemented  Threat intelligence
A.5.23  Organisational  partial      Information security for use of cloud services
A.6.3   People          implemented  Information security awareness, education and training
A.7.4   Physical        planned      Physical security monitoring
A.8.11  Technological   partial      Data masking
A.8.28  Technological   implemented  Secure coding
A.8.30  excluded        not applicable: no outsourced development
Implemented 3 of 6 applicable controls (50%)

A certificate is valid for three years, with surveillance audits in between and a recertification audit at the end. Professional roles around the standard include ISO 27001 Lead Implementer (building an ISMS) and Lead Auditor (auditing one).

CSF and ISO 27001 together

The two frameworks complement each other. Many organisations use the CSF to explain their security posture to leadership in six simple functions, and ISO 27001 to run and certify the management system. NIST publishes mappings between CSF subcategories and other standards, so work done for one counts towards the other.

Other frameworks you will meet

• CIS Critical Security Controls: a prioritised list of 18 practical controls with implementation groups, popular with smaller teams that want a clear starting order.
• PCI DSS: mandatory for anyone storing, processing or transmitting payment card data.
• SOC 2: an audit report on a service provider's controls, often requested by US clients of Indian IT and SaaS companies.
• Indian regulators: RBI cyber security requirements for banks and payment companies, SEBI's Cybersecurity and Cyber Resilience Framework for market entities, IRDAI guidelines for insurers, the CERT-In directions and the DPDP Act for personal data.

Common mistakes

• Treating a certificate as proof of security. ISO 27001 shows a management system exists; it does not guarantee every risk is handled well.
• Copying another company's policies without adapting them to your own risks and context.
• Implementing all 93 controls blindly. Select controls based on risk and record the reasons in the SoA.
• Ignoring Govern. Without leadership ownership, budgets and decisions stall.
• Doing framework work only before an audit. Frameworks work only as a continuous cycle.

Key points

• Frameworks give a common language, coverage, measurable progress and evidence.
• NIST CSF 2.0 (February 2024) has six functions: Govern, Identify, Protect, Detect, Respond and Recover, plus profiles and tiers.
• ISO/IEC 27001:2022 defines a certifiable ISMS: clauses 4 to 10 are mandatory, Annex A has 93 controls in four themes.
• The Statement of Applicability records which controls apply and why; selection is risk-based.
• In India, also consider CERT-In directions, the DPDP Act and sector rules from RBI, SEBI and IRDAI.

from collections import defaultdict

soa = [
    ("5.7", True, "implemented", "IT"),
    ("5.23", True, "partial", "IT"),
    ("6.3", True, "implemented", "HR"),
    ("7.4", True, "planned", "Admin"),
    ("8.11", True, "partial", "IT"),
    ("8.28", True, "implemented", "IT"),
    ("8.30", False, "not applicable", "IT"),
]

totals = defaultdict(lambda: [0, 0])
for ref, applies, status, owner in soa:
    if applies:
        totals[owner][0] += 1
        if status != "implemented":
            totals[owner][1] += 1

for owner, (count, pending) in totals.items():
    print(f"{owner:<6} applicable: {count}, not fully implemented: {pending}")