NIST CSF vs. Other Cybersecurity Frameworks

With the new SEC Cybersecurity Disclosure Rule  requiring both the reporting of material cybersecurity events and the  disclosure of cybersecurity programs for public companies, those affected are taking a closer look at cybersecurity frameworks that—while previously considered optional or “nice to have”—could help their organization meet the new regulatory requirements.

One in particular—the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)—is getting a lot of attention right now, having become a popular choice for organizations seeking to improve their cybersecurity posture (and meet that new SEC Rule).

As cybersecurity experts who have been conducting assessments against a wide range of different standards for over 20 years, we agree that the NIST CSF presents a potentially good avenue for you. To help you discern whether it’s right for you, we’re going to explore the key differences between the NIST CSF and some other popular framework options you have.

Maybe the NIST CSF is the best path for your organization, or maybe it’s not, but after reading your decision will be much better informed because we're about to really geek out on frameworks.

What is the NIST CSF?

The NIST CSF is a voluntary framework designed to provide a flexible, risk-based approach to managing cybersecurity risks. The framework consists of three main parts:

Given its holistic approach and the associated benefits, the NIST CSF has become a widely recognized and adopted framework that provides a common language for communicating cybersecurity risks and practices. Its popularity should continue to climb, as—when implemented correctly—it addresses each aspect of the new SEC requirements and positions companies well to adhere to the cybersecurity disclosure rule.

But is it the right framework and assessment for your organization? Let’s compare how it stacks up against other, similar standards.

ISO/IEC 27001 vs. the NIST CSF

Having been pursued for decades and now one of the most popular security frameworks, ISO 27001 is an international standard for information security management that—like the NIST CSF—provides a systematic approach to managing sensitive company information so that it remains secure. Both frameworks are also well admired for their ability to be tailored to the uniqueness of each organization.

Despite both being designed to provide a comprehensive and integrated approach to managing information security risks, there is one key difference between ISO 27001 and NIST CSF—the measurement of implementation and controls:

Further, ISO 27001 compliance generally must be certified by an external assessor as proof of advanced security, whereas the NIST CSF can be used just to guide you to more secure environments based on its standards (though you can also have your NIST CSF efforts assessed should you so choose).

All that being said, ISO 27001 certification may be more appropriate for organizations that have a specific customer request to undergo a third-party certification assessment whereas the NIST CSF may be most appropriate for those looking to satisfy internal requests or requirements such as from a board of directors who not only want to see where your organization stands but to track growth over time. 

Center for Internet Security’s (CIS) Controls Framework vs. NIST CSF

The CIS Controls Framework is another standard that shares some similarities with NIST CSF in that it also contains a set of prioritized cybersecurity best practices designed to help you improve your cybersecurity posture.

But again, there are also some key differences between the two frameworks:

In comparison with NIST CSF, the CIS Cybersecurity Framework may be more appropriate for organizations that want a more technically focused approach to their compliance program while you may choose the NIST CSF if you’re looking for guidance and more flexibility around implementing stronger cybersecurity measures. 

COBIT vs. the NIST CSF

Another option you have is COBIT, which is a framework designed to guide processes in a way that enables business executives to implement major policies and procedures across various areas such as:

• Strategy;
• Innovation;
• Risk management; and
• Asset management.

Like the NIST CSF, COBIT is also organized into five domains—each of which represents a specific area of IT governance:

• Evaluate
• Direct
• Monitor
• Align
• Plan

One advantage that COBIT does bring to the table is its historical alignment with Sarbanes Oxley and COSO, a framework generally recognized by the SEC. However, unlike the NIST CSF—as well as the aforementioned ISO 27001 and CIS Controls that all focus heavily on IT—COBIT instead emphasizes the implementation and sustainability of a governance program through the completion of risk management objectives.

Still, given these differences in what they address, aligning to both COBIT and NIST CSF would provide a more robust cyber risk management approach that you may be seeking.

Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) vs. the NIST CSF

A comprehensive set of guidelines that provides a structured framework for organizations to assess the overall security risks and maturity of their cloud services, the CSA CCM is a popular cybersecurity framework used by organizations that operate in the cloud.

The NIST CSF—with its scalable approach to managing cybersecurity risk—can also be used by cloud service providers to improve their security posture. In another important similarity, if you were to opt for CSA STAR certification, the CCM requirements that would be tested would also be given a maturity score like the NIST CSF, allowing you to measure the improvements to their security over time.

This puts START Certification in the unique category with the NIST CSF as a standard that measures improvements or change over time, but despite these important similarities, the CSA CCM and NIST CSF do take different approaches:

Given this, the CSA CCM may be more appropriate for organizations that operate primarily in the cloud, while the NIST CSF may be better suited for organizations that need a more general cybersecurity framework.

Moving Forward with Your Cybersecurity

Cybersecurity threats are becoming more sophisticated, complex, and frequent, posing significant risks to businesses of all sizes and across all sectors, making security frameworks all the more important. The trouble usually comes in deciding which standard is right for your organization, and the NIST CSF is a good option for most—especially those now particularly concerned with meeting the new SEC rule’s transparency and oversight mandates.

But whichever way you choose, keep in mind that a combination of frameworks may actually be the strongest route to improving your cybersecurity posture. Now that you understand—at a base level—the strengths and weaknesses of a few different frameworks, you can more easily choose the one or the combination that’s best suited to your comprehensive cybersecurity strategy and aligns with your business goals and objectives.

If you’re interested in getting an expert opinion, please reach out to us so we can answer your questions regarding your cybersecurity goals. In the meantime, check out our other content that can further point you in the right direction:

• Cyberthreats You Need to Know (and What to Do About Them)
• Schellman’s CSET Ransomware Guide
• Cybersecurity and the Federal Government