When you’re looking into ways of protecting your organisation from cyberattacks, you’ll find there are various frameworks to do so.
This can be a bit overwhelming and it might not be clear straight off the bat which one suits your organisation’s needs best.
In this article we’ll compare ISO 27001 and NIST Cybersecurity Framework (CSF) to help you determine exactly that.
Let’s start off by examining each of the frameworks individually.
What is the NIST Cybersecurity Framework?
The National Institute of Standards and Technology (NIST) is a US agency previously known as the National Bureau of Standards.
On their website, NIST provides a useful infographic which clearly defines the CSF (Cyber Security Framework), a voluntary standard that organisations can use to manage their cybersecurity risks.
As critical infrastructure systems become more intricate, they also become more vulnerable.
When at risk, these systems can result in not only financial risks, but reputational risks for organisations, especially fledgling organisations that don’t have robust security frameworks in place, yet.
The NISC was tasked with strengthening the resilience of the critical infrastructure through the Cybersecurity Act of 2014.
The CSF is the result of the NIST identifying:
“[A] prioritized, flexible, repeatable, performance-based, and cost-effective approach. Including information security measures and controls that may be voluntarily adopted by owners and operators of critical infrastructure to help them identify, assess, and manage cyber risks.”
What is NIST CSF used for?
The NIST CSF helps businesses manage their cybersecurity risk better. It shows them how to manage and reduce IT infrastructure risks by providing guidelines on how to detect, prevent and respond to cyberattacks.
Because the CSF is not a certifiable framework like ISO 27001, it can be more difficult to prove to customers that your business has measures in place to protect their data.
Five functions of NIST CSF
According to the NIST’s official documentation, the framework provides a way for organisations to:
- Describe their current cybersecurity posture.
- Describe their target state for cybersecurity.
- Identify and prioritise opportunities for improvement within the context of a continuous and repeatable process.
- Assess progress toward the target state.
- Communicate among internal and external stakeholders about cybersecurity risk.
What is ISO 27001?
ISO 27001 is an international standard for information security management. It provides a framework for businesses to follow in order to ensure their information security systems are effective. ISO 27001 consists of 11 clauses, 7 of which are mandatory requirements.
There are 14 domains of the ISO 27001 controls. They are:
- Information Security Policies
- Organisation of Information Security
- Human Resources Security
- Asset Management
- Access Control
- Cryptography
- Physical and Environmental Security
- Operational Security
- Communications Security
- Systems Acquisition, Development and Maintenance
- Supplier Relationships
- Information Security Incident Management
- Information Security aspects of Business Continuity Management
- Compliance
Data Guard provides a detailed guide to ISO’s Annex A controls, a set of information security controls that you can select from depending on which fits your organisation’s scope.
What is ISO 27001 used for?
ISO 27001 provides a framework for businesses to follow in order to ensure their information security systems (ISMS) are effective.
It’s a voluntary standard, but many businesses choose to adopt it in order to demonstrate their commitment to information security.
Companies receive a certificate at the end of their ISO 27001 journey, which can be used to prove to customers their data is safe and secure.
This is one of the biggest differentiators between ISO 27001 vs the NIST Cybersecurity Framework.
The similarities between ISO 27001 and NIST Cybersecurity Framework
The goals of ISO 27001 and NIST CSF are almost identical – to ensure confidentiality, integrity, availability and security.
But that’s not where the similarities end.
The implementation of either of these risk-based frameworks would need the buy-in and support of senior management. Both should also be maintained once implemented.
The good news is that they are easily integrated, because they have several principles in common, e.g., risk identification, control implementation and monitoring performance.
The differences between ISO 27001 and NIST Cybersecurity Framework
Essentially NIST CSF is a voluntary, non-certifiable security framework while ISO 27001, although also voluntary, requires an independent audit to ensure compliance and earn a certification.
Many say that less mature companies such as start-ups can use the NIST CSF and later graduate to ISO 27001, although it is possible to implement both. This table provides a basic overview of the differences between ISO 27001 vs NIST CSF.
| NIST CSF | ISO 27001 | |
| Framework | 5 Functions 23 Categories | 11 Sections 1 Annex |
| Certifiable | No | Yes |
| Mandatory documents | None specified | Unofficially: – Scope of ISMS – Information security policy and objectives – Risk assessment and risk treatment methodology – Statement of Applicability – Risk treatment plan – Risk assessment report – Definition of security roles and responsibilities – Inventory of assets – Acceptable use of assets – Access control policy – Operating procedures for IT management – Secure system engineering principles – Supplier security policy – Incident management procedure – Business continuity procedures – Statutory, regulatory, and contractual requirements Check out the article we wrote on the mandatory documents for ISO 27001. |
| Cost | Free | Varies. Requires expenditure on templates, documentation, audits and certification. +/- €50.000 |
Risk security
According to NIST, ‘risk’ is defined as:
“A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.”
Risk security, therefore, consists of any measures taken to counteract these threats and it also encompasses risk management.
Risk management is at the core of both the NIST and the ISO frameworks. They each have their own common language that allows stakeholders to understand and identify risks and how to address them.
NIST was created to assist US federal agencies to manage their risk, while ISO is used internationally to guide organisations in establishing and maintaining an ISMS (Information Security Management System).
Certification process
NIST doesn’t have an official certificate, so there is no certification process.
However, according to Babbage Simmel, NIST provides a seven-step guideline for establishing new security programmes or improving existing ones.
The seven steps are:
- Prioritise and Scope
- Orient
- Create a Current Profile
- Conduct a Risk Assessment
- Create a Target Profile
- Determine, Analyse and Prioritise Gaps
- Implement Action Plan
The certification process for ISO 27001 is somewhat more complicated.
According to Kolide:
“ISO 27001 certification is a multi-step process, requiring a great deal of work before an auditor even gets involved.”
They go on to provide this simplified infographic of the process:
How do the costs of Iso 27001 vs Nist cybersecurity framework compare?
Since there are no costs associated with NIST CSF, it’s best for start-ups or those companies with low budgets for security.
Due to the evolving nature of cyberattacks, allocating a budget to the implementation of an Information Security Management System is definitely something to consider.
Of course, the actual cost depends on how you go about tackling the implementation of ISO 27001. There is a multistage process involved and there are variables allowing various amounts of involvement from external parties, meaning the costs can vary quite significantly.
Overall you’re looking at €40.000 to €60.000 for the entire process from preparation to maintenance.
Is ISO better than NIST?
ISO is better for larger organisations, those with a budget for security frameworks and/or those that need their customers to take them more seriously when it comes to data protection and cybersecurity.
NIST is sufficient for those starting out and is a good first step in understanding and implementing a security framework in your business.
Iso 27001 vs Nist cybersecurity framework : Which one is best for your business?
If your business is new or if you have a low budget, then NIST would probably be more useful to your organisation, but if you’ve scaled up or a have a good budget for cybersecurity, then ISO 27001 is certainly preferable.
Being able to show a certificate to your stakeholders might prove invaluable in pitches or in retaining existing clients.
Lean compliance: simplifying ISO 27001
Choosing ISO 27001 will be worth your while in the long run.
Doing so doesn’t mean that you’ll be complicating your security process. In fact, simplifying ISO 27001 is what we do best at Compleye. Find out how, by using a lean compliance approach to ISO 27001, we are making compliance (almost) fun.
By the way, if you’re interested in learning more about how ISO 27001 compares to SOC 2, we wrote about that, too.
