Security Frameworks and Standards: NIST CSF, CIS, ISO 27001, SOC 2 and CMMC

Five words that sound alike and are not

Executives lose money in this area by hearing "we need to be compliant" and buying the wrong thing. The vocabulary is the first fix. Five terms cover almost every conversation you will have with a customer, an auditor, an insurer or an IT provider.

A framework cannot be failed, so it is a planning tool and a way to describe your program to a board. Anything an outsider signs costs real money and calendar time, so you buy it because a buyer demanded it or because it replaces a stack of customer questionnaires. Buying it for prestige is a poor use of a small-company budget.

NIST Cybersecurity Framework 2.0

The National Institute of Standards and Technology (NIST) published version 2.0 of its Cybersecurity Framework (CSF) on February 26, 2024. Version 1.1 had five functions. Version 2.0 added a sixth, Govern, and widened the audience from critical infrastructure to every organization. The document itself lists the six Functions as Govern, Identify, Protect, Detect, Respond and Recover. Underneath them sit 22 Categories and 106 Subcategories (Govern 6 categories and 31 subcategories, Identify 3 and 21, Protect 5 and 22, Detect 2 and 11, Respond 4 and 13, Recover 2 and 8).

That Govern function is the part a management audience should read first. It covers organizational context, risk management strategy, roles and responsibilities, policy, oversight and supply chain risk. In plain words, it puts the owner and the board inside the framework instead of leaving security as an IT-department topic. If lesson 01 of this module argued that management owns the risk, Govern is the framework's version of the same sentence.

CSF 2.0 introduces two working tools worth knowing by name. Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) describe how disciplined your risk management is, from ad hoc to continuously improving. Organizational Profiles describe where you are (a Current Profile) and where you intend to be (a Target Profile). The gap between the two is your roadmap, and it makes a clean one-page board exhibit. Lesson 03 of this module covers profiles in the risk assessment context; here the point is that CSF is the language most boards and insurers already speak.

NIST publishes Quick Start Guides, including one for small businesses, and the Federal Trade Commission's small business cybersecurity page points owners to that guide and describes CSF as "free, voluntary, and flexible." That is an accurate summary of how much the framework asks of you: a great deal of thinking, no certificate, no auditor.

CIS Controls v8.1 and Implementation Groups

The Center for Internet Security (CIS) is a nonprofit that publishes the CIS Controls: 18 prioritized Controls broken into 153 Safeguards. Version 8.1 arrived in 2024 and, according to CIS, updated its mappings to NIST CSF 2.0, revised the asset classes and Safeguard descriptions, and added a Governance function that mirrors the new NIST Govern function. CIS says the Safeguard total is 153 in both v8 and v8.1.

The feature a smaller company should care about is the Implementation Groups (IGs). CIS sorts the Safeguards so you can start with the cheapest, highest-value ones.

A note on sourcing: CIS's own web pages confirm the 153 total and the three-group design but show the per-group counts only as a picture. The 56, 74 and 23 figures come from CIS's published v8 Implementation Groups handout, reproduced by a university security office. Treat them as correct for v8 and confirm in the current v8.1 workbook before you put a number in a contract.

For a company of 10 to 100 people, IG1 is a sensible first finish line. It asks for an inventory of devices and software, data protection, secure configuration, account and access management, patching, email and browser protection, malware defense, backups, a network baseline, training, service provider management and an incident response process. Modules 71 and 72 of this site teach how to do the hands-on parts; this module teaches you to ask whether they are done and to prove it.

ISO/IEC 27001:2022 and 27002

ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current edition is the third, published in October 2022. It is a management standard: it tells you to define scope, assess risk, choose controls, assign roles, measure results, audit yourself and improve. Clauses 4 through 10 are mandatory. Annex A is a reference list of controls you compare against your own risk treatment, and you may leave a control out if you can explain why in a Statement of Applicability.

Annex A was rewritten in 2022. The old version had 114 controls in 14 sections. The new one has 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). The companion guidance, ISO/IEC 27002, was published in February 2022 and explains each control. In 2024 ISO issued Amendment 1, titled "Climate action changes," which is sold separately from the base standard.

Certification works through accredited certification bodies, not through ISO itself. The usual sequence is a documentation review and readiness check (often called stage 1), then an on-site or remote effectiveness audit (stage 2), then a certificate valid for three years with surveillance audits in between. That cycle is general industry practice under the accreditation rules rather than something ISO publishes on its 27001 page, so ask the body you are considering for its exact schedule. Organizations certified to the 2013 edition had until October 31, 2025 to transition; as of October 2026, an audit for a new certificate uses the 2022 edition.

What it proves: that a management system exists, is scoped, is run, is internally audited and was independently sampled. What it does not prove: that no breach will occur, that every control in your scope is strong, or that anything outside your stated scope is safe. Always ask to see the scope statement. A certificate for "the head office IT function" says little about the cloud application your customers actually use.

SOC 2: the report customers actually ask for

System and Organization Controls (SOC) is a suite of reporting services from the American Institute of Certified Public Accountants (AICPA). A SOC 2 report is written by a licensed CPA firm about the controls at a service organization. It is measured against the Trust Services Criteria, which cover five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. The current criteria are the 2017 edition with revised points of focus published in 2022. Security is the base every SOC 2 includes. You add the others only when your service makes promises in those areas.

SOC 2 is an attestation, and the result is a report, not a pass or a fail. The report contains management's description of the system, the auditor's opinion (unqualified, qualified, adverse or disclaimer) and a list of any exceptions found in testing. Lesson 09 teaches how to read one when a vendor hands it to you. A caution from the AICPA itself: its SOC landing page currently states that it is investigating anonymous allegations about the business practices of a compliance vendor that offers SOC services, and that SOC services should be thoroughly evaluated by service organizations and CPA firms. Choose a firm with real SOC experience, check that it is a licensed CPA firm, and be wary of any offer that promises a report on a fixed date with no testing.

NIST SP 800-171 and CMMC 2.0 for defense contractors

This section matters only if you sell, directly or as a subcontractor, to the Department of Defense (DoD). If you do, it matters a great deal, and the dates are close.

NIST Special Publication 800-171 lists security requirements for protecting Controlled Unclassified Information (CUI) on systems outside the government. Revision 3 was published in May 2024 and reorganizes the requirements into 17 families. Revision 3 has 97 requirements against 110 in Revision 2 (a count reported by law-firm and compliance summaries; the NIST catalogue page does not state it, so check the PDF before quoting it). What matters for planning is this: the Cybersecurity Maturity Model Certification (CMMC) program rule, published at 32 CFR Part 170 and effective December 16, 2024, references Revision 2 and its 110 requirements, not Revision 3.

The second rule that makes CMMC a contract term is the Defense Federal Acquisition Regulation Supplement (DFARS) final rule, published September 10, 2025. Phase 1 began November 10, 2025. The original published schedule is below. Law-firm reports from July 2026 say DoD suspended Phase 2 by memo on July 13, 2026, leaving Phase 1 self-assessments in place and letting program offices require only Level 1 or Level 2 self-assessments while a reform task force reviews the program. We could not retrieve the DoD memos themselves, so treat the suspension as reported, not confirmed, and read each solicitation:

The DoD may adjust or delay requirements at its discretion, so the contracting officer's solicitation controls. Every manager in this sector should absorb these points: the prime contractor flows the requirement down to subcontractors, so a 40-person machine shop can face Level 2 without ever holding a contract with the DoD; and an annual affirmation is signed by a senior company official, which puts a personal name on a compliance statement. Make sure the person who signs understands the technical evidence behind it.

HITRUST and FedRAMP in one paragraph each

HITRUST is a private assurance program popular in health care. HITRUST publishes three validated assessments: e1 (43 foundational controls, valid one year), i1 (182 control requirements, valid one year) and r2 (the broadest, valid two years, intended for organizations that must show compliance with frameworks such as HIPAA or the NIST framework). If a hospital customer asks a small vendor for HITRUST, it is usually asking for e1 or i1, not r2.

FedRAMP, the Federal Risk and Authorization Management Program, is run by the General Services Administration. It authorizes cloud services for use by federal agencies and lists them in the FedRAMP Marketplace. It matters to you only if you sell a cloud product to federal agencies. As of October 2026 the Marketplace page shows a newer program track called FedRAMP 20x alongside the traditional route; the details of that track changed repeatedly in 2025 and 2026, so read the program's own pages before planning around it.

Comparison table

How to choose: a decision table

Certification, attestation or self-assessment: what each buys

Costs and timelines, labeled honestly

No federal agency or standards body publishes a price list for audits, so every number here is a planning range from general market experience and is not sourced. Use it to size a budget line, then collect two or three written quotes. Audit fees depend on scope, headcount, number of systems and how clean your evidence is. Staff time often costs more than the auditor.

• CIS IG1 or CSF self-assessment with a consultant's help: weeks, and a low five-figure sum at most, including the work to close the easy gaps.
• SOC 2 Type 1: typically two to four months from kickoff, mostly policy and evidence work.
• SOC 2 Type 2: a first observation window of three to twelve months after Type 1, with the report issued some weeks after the window closes.
• ISO 27001: commonly six to twelve months from decision to certificate for a company that already has decent controls, with a three-year certificate and yearly surveillance audits.
• CMMC Level 2 readiness for a small contractor that has never documented its CUI boundary: often a year or more, because the work is technical (separate enclave, logging, access control) and the assessor schedule is a bottleneck.

Questions to ask your IT provider or consultant

• Which framework do you map our controls to, and can you give us the mapping spreadsheet in an editable file we own?
• What is in scope for our assessment, and which systems did you leave out on purpose?
• For each open gap, who is the named owner, what is the cost and what date will it close?
• Which evidence do you collect automatically, and what must our staff produce by hand each quarter?
• If we pursue SOC 2 or ISO 27001, which accredited body or licensed CPA firm do you work with, and what did their last three engagements find?
• Do you hold the keys, admin accounts and documentation, or do we?
• If we ended our contract, how would our evidence package move to a new provider?

Questions and answers

Do we need a framework if we already have antivirus, backups and a firewall?

Those are controls. A framework tells you which controls you are missing and how to prove the rest. Without one, most companies cannot say what their coverage is, and they cannot answer a customer questionnaire from a single source of truth. Pick CIS IG1 or CSF 2.0 and use it as an index.

Which is better for a small business, NIST CSF or CIS Controls?

They do different jobs. CSF 2.0 describes outcomes at a level boards understand, and it covers governance. CIS gives concrete, prioritized safeguards with a ready starting set (IG1). Many companies use CSF to organize reporting and CIS IG1 to drive the technical to-do list. CIS publishes mappings between the two.

Can a customer force us to get SOC 2 or ISO 27001?

Not by law, in the general case. But a customer can make it a condition of the contract or the renewal. That is a business decision for you: price the cost of the report against the revenue it protects, and ask whether a completed questionnaire plus a CIS IG1 evidence pack would satisfy them first.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 is the requirements standard you certify against. ISO 27002 is guidance that explains the controls in Annex A. You can be certified to 27001; there is no certificate for 27002.

If we have SOC 2, do we still need to fill out customer questionnaires?

Often fewer, but not none. Many enterprise customers accept the report in place of most of the questionnaire, then ask a short list of extra questions. Offer the report under a nondisclosure agreement first.

Our parent customer says we need CMMC Level 2. Where do we start?

Find out what data you handle (FCI or CUI), and where it lives. Then run a gap assessment against the 110 requirements in NIST SP 800-171 Revision 2. The scope is the biggest cost lever, so isolate the CUI before you spend on controls.

How often should we reassess against a framework?

At least yearly, and again after a major change such as a merger, a new cloud platform or an incident. SOC 2 Type 2 and ISO surveillance audits force a yearly rhythm. A self-assessment should keep the same rhythm so the board sees a trend line.

Does PCI DSS belong with these frameworks?

It is a standard with its own validation process, and it is a contract obligation rather than a statute. It has its own lesson next in this module.

Hard questions

"Isn't a certificate just paperwork? Companies with ISO certificates get breached."

Yes, certified companies have had breaches. A certificate proves a management system existed and was sampled by an auditor. It does not prove every control is strong. Its value is that it forces regular risk review, evidence and management attention, which many smaller companies would skip. Buy it for that discipline or for a customer who requires it, and do not treat it as a security guarantee. Read the scope.

"The compliance-automation platforms promise SOC 2 in weeks. Why wait months?"

The tool can collect evidence fast. It cannot create an observation period. A Type 2 report tests how controls worked over time, so the calendar sets the minimum. Type 1 can come sooner because it tests design at one date. The AICPA's own notice on its SOC page, which says SOC services should be thoroughly evaluated, is a reason to check the CPA firm's license and experience, whatever the platform promises.

"Why spend on any of this when attackers hit companies that follow every framework?"

Because the common attacks are still the common ones. Credential theft, unpatched systems and unmanaged remote access show up in incident after incident, and the IG1 safeguards target exactly those. The honest claim is that a framework lowers the odds and shortens the damage, and gives you evidence that you acted reasonably. It does not make you immune.

"Our IT provider says we are 'compliant.' Compliant with what?"

That is the right question. Ask for the named framework or rule, the assessment date, the scope, and the signed report. If the answer is a general statement with no document behind it, treat the claim as unproven and plan your own gap assessment.

"CMMC keeps changing. Should we wait?"

The original schedule had Phase 2 starting November 10, 2026. Law-firm reports say DoD suspended it on July 13, 2026, and the rule lets DoD adjust requirements case by case. Waiting does not remove the exposure. Documenting your CUI boundary and running a gap assessment are useful whichever way the dates move, and they are required work for any contract that includes the clause.