There are hundreds of complex laws and regulations worldwide that organisations find themselves required to follow to keep their data safe.
Two of the most common are NIST CSF and ISO 27001.
While both frameworks aim to protect data and contribute to a stronger security posture, they go about it in quite different ways.
Now, we will look at the similarities and differences between NIST CSF and ISO 27001, so you can decide what is best for your business.
What Is NIST CSF
The National Institute of Standards and Technology (NIST) publishes a voluntary set of guidelines for organisations to manage and reduce cybersecurity risks.
Basically, NIST CSF was created to acknowledge and standardise specific controls and processes. It builds on but does not replace security standards like NIST 800-53 or ISO 27001. NIST CSF is a great place to start if you’re looking to improve your cybersecurity on a budget.
The Five Functions of NIST
According to NIST, it’s designed to cover five functions and is defined as follows:
2. Identity
Develop an organisational understanding of how to manage cybersecurity risks to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organisation to focus and prioritise its efforts, consistent with its risk management strategy and business needs.
2. Protect
This function outlines appropriate safeguards to ensure the delivery of critical infrastructure services and supports the ability to limit or contain the impact of a potential cybersecurity event.
3. Detect
Step three defines the appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables the timely discovery of cybersecurity events.
4. Respond
This includes appropriate activities to act regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident.
5. Recover
The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. It supports timely recovery to normal operations to reduce the impact of a cybersecurity incident.
What Is ISO 27001
Published by the International Organisation for Standardisation (ISO) in partnership with the International Electrotechnical Commission (IEC), ISO 27001 is recognised worldwide. It details requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). Any organisation that collects sensitive information, small or large, government or private, profit or non-profit, can advance their business with an ISO implementation. Some vendors may require some companies to attain certification before starting a working relationship. Still, many companies pursue ISO 27001 by choice.
ISO 27001 Basics
ISO 27001:2013 is the international standard that provides a framework for Information Security Management Systems (ISMS) to provide continued confidentiality, integrity, and availability of information and information systems. The scope can be limited to some of the business units and not the whole organisation
The audit consists of two stages:
The Stage 1, audit is often called a ‘documentation review’ audit because the auditor will review your processes, policies and procedure documents to establish whether they’re in line with the requirements of ISO 27001 and whether ISMS has been implemented.
The Stage 2 audit is often referred to as the ‘Certification Audit’. During a Stage 2 audit, the auditor will conduct a thorough on-site assessment to establish whether the organisation’s ISMS complies with ISO 27001.
ISO certification is valid for 3 years after the initial issue, but companies are required to do surveillance audits for 2 years and year 3 followed by a re-certification audit.
NIST CSF and ISO 27001 Similarities
NIST CSF and ISO 27001 and complementary frameworks and both require senior management support, a continual improvement process, and a risk-based approach.
The risk management framework for both NIST and ISO are alike as well. The three steps for risk management are:
1. Identify risks to the organisation’s information
2. Implement controls appropriate to the risk
3. Monitor their performance
NIST CSF and ISO 27001 Overlap
Most people don’t realise that most security frameworks have plenty of controls in common. As a result, businesses spend a needless amount of time and money on compliance. When you’ve completed your ISO 27001, you’ve achieved 60% of your NIST CSF! What’s really cool is if you’ve implemented NIST CSF then you’re 78% of the way to the ISO 27001 finish line.
An important overlap area is related to maintaining an asset register as recognised by Annex A.8.1 of ISO27001 for asset responsibility and ID.AM of NIST CSF for asset management.
NIST CSF and ISO 27001 Differences
There are some notable variations between NIST CSF and ISO 27001. NIST was created to help US federal agencies and organisations better manage their risk. At the same time, ISO 27001 is an internationally recognised approach for establishing and maintaining an ISMS. ISO 27001 involves auditors and certifying bodies, while NIST CSF is voluntary. That’s right. NIST is a self-certification mechanism but is widely recognised.
NIST frameworks have various control catalogues and five functions to customise cybersecurity controls, while ISO 27001 Annex A provides 14 control categories with 114 controls, and has 10 management clauses to guide organisations through their ISMS.
ISO 27001 is less technical, with more emphasis on risk-based management that provides best practice recommendations to secure all information.
The ISO 27001 offers a good certification choice for organisations that have operational maturity while the NIST CSF may be best suited for organisations that are in the initial stages of developing a cybersecurity risk program or attempting to mitigate breaches.