Your company needs standards to benchmark against industry best practices, to reduce losses, to maintain your customers’ trust, and protect your bottom line. When it comes to cybersecurity, the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO) dominate the standards scene. But which set of standards should you pursue and implement?
Because you are investing precious time and energy into developing your information security program, you’ll want to consider NIST vs ISO — which set of standards is most relevant to you and your business right now? This article provides an overview of the differences and overlaps between NIST’s Cybersecurity Framework (CSF) and ISO 27001 to help you make the right choice for your business.
What Is NIST CSF (Cybersecurity Framework)?
NIST Cybersecurity Framework (CSF) is a voluntary cybersecurity framework that allows companies to develop their information security, risk management and control programs. The CSF was developed by the National Institute of Standards and Technology, a United States non-regulatory governmental agency housed under the Department of Commerce. Today, NIST standards are employed in fields from nanotechnology to cybersecurity (and they even have their own measurement superheroes). In 2013, NIST was tasked with developing a Cybersecurity Framework through an executive order, and published version 1.0 of the Framework for Improving Critical Infrastructure Cybersecurity in February 2014. Version 1.1 was made publicly available in April 2018.
The CSF is one of NIST’s voluntary programs that is based on existing standards and guidelines and is developed with flexibility to help organizations better manage and reduce cybersecurity risk. The CSF is presented in a 48-page document that details different cybersecurity activities and desired outcomes that organizations can leverage for assessing an organization’s cybersecurity risk, risk maturity, and infrastructure around information security.
What Is NIST CSF Used For?
The CSF has three major components — the framework core, implementation tiers, and profiles — designed to help you benchmark your organization’s risk maturity and prioritize actions you need to take to make improvements.
The Framework Core:
The “core” is divided into five functions: Identify, Protect, Detect, Respond, and Recover. While the CSF applies these functions to cybersecurity issues, they are really essential activities in most risk management systems. The functions are further divided into 23 categories, which cover the fundamentals of building a cybersecurity program.
Implementation Tiers:
For each of these five functions, NIST CSF uses a ranking system on a scale of 0-4 to come up with a final number which can help an organization benchmark their level of risk maturity.
Profiles:
Based on the “tier”, the profile lets an organization pinpoint its current level of risk tolerance and prioritize security controls and risk mitigation tactics. This section is designed to help an organization grow by comparing its current profile with target profiles, helping you determine how to allocate budget and employee resources to improve cybersecurity practices over time.
What Is ISO 27001?
ISO is a non-governmental organization (NGO) operating in Geneva, Switzerland that has released over 22,600 standards across a variety of industries since its inception in 1954. Their 27000 family of standards is one of their most popular, covering a wide range of controls related to IT security risk management. ISO 27001 presents a framework for developing and implementing information security management systems (ISMS). The ISO/IEC 27000 family was originally released in 2005, was substantially updated in 2013, and, like the NIST CSF, was updated most recently in 2018. The 27000 family of standards is often integrated with the ISO 9000 family of standards for Quality Management Systems (QMS).
What Is ISO 27001 Used For?
ISO 27001 is designed to help an organization systematize cybersecurity controls that they may have developed to cover particular situations or compliance needs into full-fledged information security management systems (ISMS). It is also possible to achieve official ISO 27001 certification through a third-party auditor. Like NIST CSF, ISO 27001 doesn’t promote specific processes or products, but its framework offers more detail than NIST on security controls, working hand-in-hand with the 2019 ISO/IEC TS 27008 updates on new cybersecurity threats. An operationally mature organization which has already, for example, achieved compliance or certification with ISO 9001, may be ready to tackle ISO 27001.
What Are the Commonalities Between ISO and NIST?
In comparing NIST CSF vs ISO 27001, both offer robust frameworks for cybersecurity risk management. An organization seeking to become compliant to ISO 27001 standards and implement the NIST CSF framework will find them easy to integrate. Their control measures are similar and the definitions and codes are fairly transferable across frameworks. Both frameworks offer simple vocabulary that allow you to communicate clearly about cybersecurity issues across multidisciplinary teams and with external stakeholders.
What Is the Difference Between ISO and NIST?
When it comes to NIST CSF vs ISO 27001, there are a few key differences, including risk maturity, certification, and cost.
Risk Maturity
ISO 27001 is a good choice for operationally mature organizations seeking certification and NIST CSF may be best for organizations who are in the first stages of developing a cybersecurity risk management plan or attempting to mitigate prior failures or data breaches.
Certification
ISO 27001 offers globally-recognized certification via third-party audit that can be costly, but can enhance your organization’s reputation as a business that stakeholders can trust. NIST CSF does not offer such certification.
Cost
The NIST CSF is available free of charge, while the ISO 27001 charges to access their documentation — another reason an upstart might want to initiate their cybersecurity risk management program with NIST CSF and then make a bigger investment in the process as they scale with ISO 27001.
NIST vs ISO: Which One Is Right for My Business?
Ultimately, what’s right for your business depends on its maturity, goals, and specific risk management needs. ISO 27001 is a great choice for operationally mature organizations facing external pressure to certify. However, you may not be ready to invest in an ISO 27001 certification journey quite yet, or your organization may be at a stage where it would benefit from the clear assessment framework offered by NIST Cybersecurity Framework. Conducting an NIST audit can give you a sense of where your organization stands prior to developing and implementing more stringent cybersecurity measures and controls.
The two frameworks can be integrated as your organization matures — following the NIST CSF framework can be a useful precursor to your ISO 27001 certification journey. NIST CSF offers growing organizations a way to first structure their IS risk assessments. If you already have these structures in place, you might consider going straight for ISO security and compliance certifications. Regardless of whether you’re starting with NIST CSFor growing with ISO 27001, a proactive and efficient information security management system benefits from the right software. AuditBoard stands ready to help — get started with our compliance management software today.
