Cybersecurity Frameworks 101

The CIS Controls are a prioritized, prescriptive set of 18 top-level controls and 153 safeguards designed to mitigate the most common cyberattacks. Developed by a global community of practitioners, they are organized into three Implementation Groups (IGs) based on organizational size and risk profile — making them uniquely accessible to organizations with limited resources.

IG1 represents "essential cyber hygiene" and is the recommended starting point for any organization. IG2 and IG3 build progressively for organizations handling sensitive data or facing advanced threats.

The NIST CSF is the most widely adopted cybersecurity framework in the United States. Version 2.0 (released February 2024) expanded the original five core functions to six: Govern, Identify, Protect, Detect, Respond, and Recover. The new "Govern" function elevates cybersecurity governance and supply chain risk management to a top-level concern.

The CSF is intentionally high-level and outcome-focused. It tells you what to achieve rather than how to achieve it, making it applicable across industries and organization sizes. It's designed to be used alongside more prescriptive control sets like CIS Controls or NIST 800-53.

NIST SP 800-53 is the most comprehensive catalog of security and privacy controls available, containing over 1,000 controls across 20 control families. It is the authoritative source used by the federal government to protect information systems under FISMA (Federal Information Security Modernization Act) and is the technical backbone of the NIST Risk Management Framework (RMF).

While exhaustive, 800-53 is not intended to be implemented in its entirety by any single organization. Controls are selected based on system categorization (Low, Moderate, or High impact via FIPS 199) and tailored to the organization's specific risk environment.

NIST SP 800-171 defines the security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations. If you're a defense contractor, subcontractor, university, or any organization handling CUI, this standard applies to you — typically as a flow-down clause in your federal contract (via DFARS 252.204-7012).

The standard contains 110 security requirements (Rev. 2) across 14 families, derived from the Moderate baseline of NIST 800-53. Rev. 3 realigns with 800-53 Rev. 5 and is expected to be referenced in future CMMC rulemaking.

CMMC 2.0 is the DoD's verification mechanism that ensures defense contractors actually implement the cybersecurity requirements they've been self-attesting to for years. It adds a third-party assessment layer on top of existing NIST 800-171 requirements.

CMMC has three levels: Level 1 (17 practices — basic safeguarding of Federal Contract Information), Level 2 (110 practices — aligned with NIST 800-171, requires C3PAO assessment), and Level 3 (110+ practices — aligned with a subset of NIST 800-172, assessed by DIBCAC). The final rule (32 CFR Part 170) was published in October 2024, with phased rollout beginning in 2025.

The HIPAA Security Rule establishes national standards for protecting electronic Protected Health Information (ePHI). It applies to covered entities (healthcare providers, health plans, clearinghouses) and their business associates — including any technology vendor, cloud provider, or managed service provider that creates, receives, maintains, or transmits ePHI.

The Security Rule defines safeguards across three categories: Administrative (policies, training, risk analysis), Physical (facility access, workstation security), and Technical (access control, encryption, audit logging). Safeguards are classified as "Required" or "Addressable" — but "addressable" does not mean optional. It means you must implement the safeguard or document why an equivalent alternative is appropriate.

ISO 27001 is the international gold standard for Information Security Management Systems (ISMS). Rather than prescribing specific technical controls, it defines the requirements for establishing, implementing, maintaining, and continually improving a systematic approach to managing information security risk.

Annex A of the 2022 revision contains 93 controls (down from 114 in the 2013 version) organized into four themes: Organizational, People, Physical, and Technological. Organizations select controls through a formal risk assessment process and document their applicability in a Statement of Applicability (SoA). Certification is granted by accredited third-party audit bodies.

SOC 2 is an attestation framework — not a certification — performed by licensed CPA firms. It evaluates a service organization's controls relevant to five Trust Services Criteria: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. Organizations choose which criteria are in scope based on their services and customer commitments.

A Type I report assesses control design at a point in time. A Type II report evaluates both design and operating effectiveness over a period (typically 6–12 months) and is considered significantly more valuable. SOC 2 reports are restricted-use documents shared under NDA with customers and prospects.