Top 15 IT security frameworks and standards explained | TechTarget

What are IT security standards, regulations and frameworks?

Standards are like recipes; they list steps to follow. A well-managed IT organization must comply with the requirements set forth in a standard.

Regulations, in contrast, have a legally binding impact. The way they describe how to do something indicates government and public support for the rules and processes set forth in the regulation. Failure to comply with IT-focused regulations can result in financial penalties and litigation.

Frameworks detail how to develop, test, execute and maintain something. A cybersecurity framework is a series of documented processes that defines policies and procedures for implementing and managing infosec controls. Such frameworks are a blueprint for managing risk and reducing vulnerabilities.

Information security professionals use frameworks to define and prioritize the tasks required to manage enterprise security. Frameworks also help prepare for compliance and other IT audits. Therefore, they must support specific requirements defined in a standard or regulation.

Organizations can customize frameworks to solve specific information security problems, such as industry-specific requirements or regulatory compliance goals. Frameworks also come in varying degrees of complexity and scale. Today’s frameworks often overlap, so it’s important to select ones that effectively support operational, compliance and audit requirements. They should also be easy to adapt to existing security activities.

Why are security frameworks important?

Frameworks provide a starting point for establishing processes, policies and administrative activities for infosec management.

Security requirements often overlap, resulting in “crosswalks” that can be used to demonstrate compliance with different regulatory standards. For example, information security policy is defined in the following standards:

• ISO 27002 defines it in Section 5.
• Control Objectives for Information and Related Technology (COBIT) defines it in the “Align, Plan and Organize” section.
• HIPAA defines it in the “Assigned Security Responsibility” section.
• PCI DSS defines it in the “Maintain an Information Security Policy” section.

Using a common framework, such as ISO 27002, an organization can establish crosswalks to demonstrate compliance with multiple regulations, including HIPAA, SOX, PCI DSS and the Graham-Leach-Bliley Act.

Unlike standards and regulations, frameworks do not always have compliance requirements. For example, “ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements” has specific compliance mandates, whereas “ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls” does not.

After identifying a compliance requirement, security analysts should look for frameworks that help the organization comply with the primary standard or regulation. This is how ISO 27002 supports ISO 27001.

How to choose an IT security framework

Multiple factors drive the choice to use a particular security framework, including industry or compliance requirements. Publicly traded companies, for example, might want to use COBIT to comply with SOX, while the healthcare sector might consider the HITRUST (Health Information Trust Alliance) framework to comply with the HITECH (Health Information Technology for Economic and Clinical Health) Act. The ISO 27000 series of information security standards and frameworks, by contrast, is applicable in public and private sectors.

ISO standards are often time-consuming to implement, but they are helpful when an organization needs to demonstrate its information security capabilities using ISO 27000 certification. While NIST Special Publication (SP) 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations is a standard required by U.S. federal agencies, any organization can use it to build a technology-specific information security plan.

Top IT security standards and frameworks

The following standards and frameworks help security professionals organize and manage an information security program. The only bad choice among these frameworks is not choosing any of them.

1. ISO 27000 series

The ISO 27000 series was developed by the International Organization for Standardization. It is a flexible cybersecurity framework that applies to organizations of all types and sizes.

The two primary standards — ISO 27001 and 27002 — establish the requirements and procedures for creating an information security management system (ISMS). Having an ISMS is an important audit and compliance activity. ISO 27000 consists of an overview and vocabulary and defines ISMS requirements. ISO 27002 specifies the code of practice for developing ISMS controls.

Compliance with the ISO 27000 series of standards is established through audit and certification processes, typically provided by third-party organizations approved by ISO and other accredited agencies.

The ISO 27000 series has 60 standards that cover a broad spectrum of cybersecurity issues, including the following:

• ISO 27017 describes security controls for cloud environments.
• ISO 27018 addresses the protection of personally identifiable information (PII) in cloud computing.
• ISO 27031 provides guidance on business continuity and related activities.
• ISO 27037 addresses the collection and protection of digital evidence.
• ISO 27040 addresses storage security.
• ISO 27400 covers IoT security and privacy.
• ISO 27799 defines information security in healthcare.

2. NIST SP 800-53

NIST has developed an extensive library of IT standards, many of which focus on information security. First published in 1990, the NIST SP 800 series addresses virtually every aspect of information security, with an increasing focus on cloud security.

SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations is the information security benchmark for U.S. government agencies and is widely used in the private sector. It has helped spur the development of information security frameworks, including the NIST Cybersecurity Framework (CSF).

3. NIST SP 800-171

SP 800-171 Rev. 3: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations has gained popularity due to requirements set by the U.S. Department of Defense regarding contractor compliance with security frameworks. Government contractors are a frequent target for cyberattacks due to their proximity to federal systems. To bid on federal and state business opportunities,  manufacturers and subcontractors must have a cybersecurity framework.

Controls included in the SP 800-171 framework are directly related to SP 800-53 but are less detailed and more generalized. It’s possible to build a crosswalk between the two standards if an organization must show compliance with SP 800-53, using SP 800-171 as the base. This creates flexibility for smaller organizations — they can show compliance as they grow using the additional controls included in SP 800-53.

4. NIST CSF

The NIST Framework for Improving Critical Infrastructure Cybersecurity, later known as the NIST CSF, was developed under Executive Order 13636, released in 2013. It was created to address U.S. critical infrastructure, including energy production, water supplies, food supplies, communications, healthcare delivery and transportation. These industries must maintain a high level of preparedness because they have all been targeted by nation-state actors.

Unlike other NIST frameworks, the CSF focuses on cybersecurity risk analysis and risk management. Security controls in the framework are based on the five phases of risk management: identify, protect, detect, respond and recover. Like all IT security programs, these phases require the support of senior management. NIST CSF is suitable for both public and private sectors.

The CSF 2.0, released in 2024, broadened the framework’s applicability to organizations of all sizes, expanded its response core function activities, added a new core function to emphasize the importance of governance, and made ransomware and supply chain threats more prominent.

5. NIST SP 1800 series

The NIST SP 1800 series, also known as the NIST Cybersecurity Practice Guides, is a set of documents that complement the SP 800 series of standards and frameworks. The guides offer information on how to implement and apply standards-based cybersecurity technologies in real-world applications.

The SP 1800 series publications provide the following:

• Examples of specific situations and capabilities.
• Experience-based, how-to approaches using multiple products to achieve the desired result.
• Modular implementation guidance on capabilities for organizations of all sizes.
• Specifications of required components and installation, configuration and integration information so organizations can easily replicate the process themselves.

Guides include implementing zero trust, DevSecOps practices, mobile device security, 5G security and data confidentiality.

6. COBIT

COBIT was developed in the mid-1990s by ISACA, an independent organization of IT governance professionals. ISACA offers the well-known Certified Information Systems Auditor and Certified Information Security Manager certifications.

COBIT originally focused on reducing IT risks. COBIT 5, released in 2012, included new technology and business trends to help organizations balance IT and business goals. The current version is COBIT 2019. It’s the most used framework to achieve SOX compliance. Numerous publications and professional certifications address COBIT requirements.

7. CIS Controls

The Center for Internet Security (CIS) Critical Security Controls, Version 8.1 — formerly the SANS Top 20 — lists technical security and operational controls that can apply to any environment. It does not address risk analysis or risk management like NIST CSF; rather, it solely focuses on reducing risk and increasing resilience for technical infrastructures. It was updated in 2024 to align with the updated NIST CSF 2.0.

The 18 CIS Controls include the following:

• Inventory and control of enterprise assets.
• Data protection.
• Audit log management.
• Malware defenses.
• Penetration testing.

CIS Controls link with existing risk management frameworks to help remediate identified risks. They’re useful resources for IT departments that lack technical security experience.

8. HITRUST Common Security Framework

The HITRUST Common Security Framework (CSF) includes risk analysis and risk management frameworks, along with operational requirements. The framework has 14 different control categories and applies to almost any organization, including healthcare. Categories include access control, HR security, risk management, physical and environmental security, and privacy practices.

The HITRUST CSF is a massive undertaking due to the heavy weight given to documentation and processes. As a result, many organizations end up scoping smaller areas of focus for HITRUST. The costs of obtaining and maintaining HITRUST certification add to the level of effort required to adopt this framework. The certification is audited by a third party, which adds a level of validity.

9. GDPR

The EU’s GDPR is a framework of security requirements that global organizations must implement to protect the security and privacy of EU citizens’ personal information.

GDPR requirements include controls for restricting unauthorized access to stored data and access control measures, such as the principle of least privilege, role-based access and MFA. Failure to comply with GDPR requirements can result in significant fines.

10. COSO

The Committee of Sponsoring Organizations of the Treadway Commission is a joint initiative of five professional associations that has published two complementary frameworks. Its Internal Control — Integrated Framework, released in 1992 and updated in 2013, helps companies achieve a risk-based approach for internal controls. It covers the following components, referred to as the five pillars:

1. Control environment.
2. Risk assessment.
3. Control activities.
4. Information and communication.
5. Monitoring activities.

COSO is developing a Corporate Governance Framework in collaboration with the National Association of Corporate Directors. The framework, expected to be released in late 2025, aims to unify existing corporate governance activities in U.S. public companies. It will complement existing COSO frameworks, including its Enterprise Risk Management Framework.

11. PCI DSS

PCI DSS is a set of requirements and guidelines designed to help ensure secure business transactions and protect cardholder data, including credit card numbers, expiration dates and security codes.

The 12 PCI DSS requirements include the following:

• Install and maintain network security controls.
• Protect stored account data.
• Develop and maintain secure systems and software.
• Test system and network security regularly.

Created in 2004 by five major credit card companies and updated to version 4.0 in 2022, it called for more rigorous security measures, such as MFA and strong passwords. Version 4.0.1, released in 2024, did not add or remove requirements but clarified existing requirements and updated terminology.

12. CMMC

The Cybersecurity Maturity Model Certification is a framework developed by the U.S. Department of Defense to ensure government-approved contractors comply with cybersecurity requirements. It is built on the controls and guidance in NIST SP 171: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and defines the following three certification levels:

• Foundational, minimum security requirements for basic government contracting.
• Advanced, for contractors that handle controlled unclassified information.
• Expert, for contractors handling highly classified information.

CMMC 1.0 was released in 2020. Version 2.0 was finalized in 2024.

13. FISMA

The Federal Information Security Modernization Act, which aligns closely with the NIST Risk Management Framework, provides a security framework for protecting federal government data and systems.

FISMA requires U.S. federal agencies, as well as third parties, contractors and vendors that handle federal systems, to develop, document and implement security programs. Compliance requirements include continuous monitoring, annual security reviews and baseline security controls, such as those outlined in NIST SP 800-53.

FISMA was introduced in 2002 and updated in 2014. It is currently undergoing legislative efforts for an update.

14. NERC CIP

The North American Electric Reliability Corporation Critical Infrastructure Protection framework includes 14 ratified and proposed standards that apply to utility companies within the bulk power system. The standards outline recommended controls and policies to monitor, regulate, manage and maintain the security of critical infrastructure systems. Bulk power system owners, operators and users must comply with the NERC CIP framework.

CIP standards include the following:

• CIP-004-7 Cyber Security — Personnel and Training.
• CIP-008-6 Cyber Security — Incident Reporting and Response Planning.
• CIP-013-2 Cyber Security — Supply Chain Risk Management.
• CIP-014-3 Physical Security.

15. SOC 2

System and Organizational Controls 2 is a framework developed by the American Institute of Certified Public Accountants that assesses how organizations manage and protect data. It is an internal control that enables companies to demonstrate that they meet the following Trust Services Criteria:

• Security. Protects data and maintains its privacy during creation, use, processing, transmission and storage. Focuses on preventing data leakage, unauthorized access and damage to systems that affect the availability, integrity and confidentiality of data.
• Availability. Puts controls in place that ensure systems are operational, available and monitored.
• Processing integrity. Confirms that processing is complete, accurate, timely, authorized and secure.
• Confidentiality. Protects data designated confidential.
• Privacy. Ensures PII is collected, used, retained, disclosed and disposed of properly.

A SOC 2 audit, performed by a third-party CPA, examines whether an organization’s controls meet SOC 2 criteria. While not a legal requirement, many customers use it to assess the security and privacy controls of their vendors and service providers.

Paul Kirvan, FBCI, CISA, is an independent consultant and technical writer with more than 35 years of experience in business continuity, disaster recovery, resilience, cybersecurity, GRC, telecom and technical writing.