Introduction to Cybersecurity Frameworks

Cybersecurity frameworks are structured sets of guidelines, standards, controls, and best practices that organisations use to manage and reduce information security risk. They translate complex security requirements into actionable programmes that protect people, systems, and data. Frameworks differ in scope, origin, and application: some are mandated by law, some by contract, some adopted voluntarily as best practice. Understanding when each framework applies — and how they interrelate — is foundational knowledge for security practitioners, compliance professionals, and executive leadership.

No single framework addresses every security need. In practice, most organisations operate under multiple simultaneous frameworks: a healthcare provider may be subject to HIPAA, adopt NIST CSF, implement CIS Controls, and seek ISO 27001 certification concurrently. This document provides a comprehensive reference for the most significant cybersecurity frameworks, their requirements, and their specific applications to personal privacy, federal government compliance, financial security, and broader security programme design.

Framework Categories and Primary Applications

• Personal PrivacyFrameworks governing the collection, storage, processing, and transfer of personal data. GDPR, CCPA, HIPAA Privacy Rule, and NIST Privacy Framework directly regulate how organisations handle personally identifiable information (PII) and personal health information (PHI).
• Federal GovernmentFrameworks mandated for or specifically designed for US federal agencies and their contractors: FISMA, FedRAMP, NIST SP 800-53, CMMC. These frameworks carry statutory authority and non-compliance can result in loss of federal contracts or criminal liability.
• Financial SecurityFrameworks protecting financial systems, payment data, and financial institutions: PCI DSS (payment cards), SOX (public company financial controls), GLBA (financial institutions), NY DFS 23 NYCRR 500 (New York financial services). Combine security controls with audit and accountability requirements.
• Risk ManagementFrameworks for systematic identification, assessment, and treatment of information security risk: NIST RMF, ISO 31000, FAIR (Factor Analysis of Information Risk). Provide the analytical foundation on which security investment decisions are made.
• Technical ControlsFrameworks providing prescriptive technical security configuration guidance: CIS Controls, DISA STIGs, NSA/CISA Security Advisories. Specify exact configurations, system settings, and tool deployments rather than outcome requirements.
• International StandardsGlobally recognised standards enabling cross-border security assurance: ISO/IEC 27001 (ISMS), ISO/IEC 27002 (security controls), ISO 27017 (cloud security), ISO 27701 (privacy). Certification demonstrates security capability to international customers, regulators, and partners.
• Industry-SpecificFrameworks tailored to sector-specific risk profiles: HIPAA/HITECH (healthcare), NERC CIP (energy/utilities), TSA Security Directives (transportation), NRC cybersecurity regulations (nuclear). Apply in addition to general-purpose frameworks.
• Emerging FrameworksRecently published frameworks addressing modern threat environments: NIST CSF 2.0 (2024), Zero Trust Architecture (NIST SP 800-207), Secure Software Development Framework (SSDF), OT/ICS cybersecurity (IEC 62443). Address gaps in legacy frameworks that predate cloud, container, and AI deployments.

NIST Cybersecurity Frameworks

The National Institute of Standards and Technology (NIST) is the primary source of cybersecurity framework guidance for US government and a globally respected standard-setting body for the private sector. NIST frameworks are freely available, regularly updated, and supported by extensive guidance documentation, reference implementations, and mapping tools. Multiple NIST publications form an integrated framework ecosystem that organisations apply together.

NIST Cybersecurity Framework (CSF) 2.0

NIST CSF is the most widely adopted cybersecurity framework in the United States across all sectors. Originally published in 2014 and significantly revised in 2024 (CSF 2.0), it provides a flexible, outcome-based structure for managing cybersecurity risk using six core functions that span the full security lifecycle.

NIST SP 800-53 — Security and Privacy Controls for Federal Systems

NIST SP 800-53 Rev. 5 is the most comprehensive catalogue of security and privacy controls for federal information systems. It is mandatory for federal agencies under FISMA and is adopted voluntarily by private sector organisations as the most thorough available control catalogue. Revision 5 (2020) integrated privacy controls directly alongside security controls — a landmark change reflecting the inseparability of security and privacy in modern information systems.

NIST Risk Management Framework (RMF)

The NIST Risk Management Framework (SP 800-37 Rev. 2) provides the structured process through which federal agencies categorise information systems, select and implement security controls, assess their effectiveness, authorise system operation, and continuously monitor security posture. It integrates the full NIST 800-53 control catalogue into a repeatable lifecycle process.

NIST SP 800-171 & 800-172 — Protecting Controlled Unclassified Information

NIST SP 800-171 defines the security requirements for protecting Controlled Unclassified Information (CUI) in non-federal systems and organisations. It is the direct basis for the CMMC framework requirements and applies to any organisation handling CUI received from federal agencies under contract.

Federal Government Compliance Frameworks

Federal government cybersecurity compliance is governed by a hierarchy of statutes, executive orders, and agency-specific regulations that create binding legal obligations for agencies and their contractors. Unlike voluntary frameworks, federal compliance frameworks carry statutory authority — non-compliance results in legal consequences, loss of federal contracts, and in some cases criminal liability. Understanding the federal compliance landscape is essential for any organisation that provides services to or handles data from federal agencies.

FISMA — Federal Information Security Modernization Act

FISMA (44 U.S.C. § 3551 et seq.) is the primary federal law governing information security for federal agencies. Originally enacted in 2002 and modernized in 2014, FISMA requires federal agencies to develop, document, and implement agency-wide information security programmes. It delegates technical standard-setting to NIST and oversight to OMB and CISA.

FedRAMP — Federal Risk and Authorization Management Program

FedRAMP provides a standardised approach to security assessment, authorisation, and continuous monitoring for cloud products and services used by federal agencies. Any cloud service provider (CSP) offering services to federal agencies must obtain a FedRAMP authorisation. This “authorise once, use many times” model avoids redundant security assessments across agencies.

CMMC — Cybersecurity Maturity Model Certification

CMMC 2.0 is the DoD’s contractor cybersecurity certification programme that replaces self-attestation of NIST 800-171 compliance. It establishes three certification levels based on the sensitivity of information handled, with the most sensitive levels requiring independent third-party assessment rather than contractor self-reporting.

Executive Orders and Presidential Directives

Personal Privacy Frameworks and Regulations

Privacy frameworks govern how organisations collect, use, store, share, and delete personal information. Unlike security frameworks that focus primarily on preventing unauthorised access, privacy frameworks address the legitimate use of personal data — requiring organisations to process personal data only in accordance with individuals’ expectations and legal rights. The past decade has seen a global proliferation of privacy regulations, transforming privacy from an aspirational principle to a legally enforced operational requirement.

GDPR — General Data Protection Regulation

The EU General Data Protection Regulation (Regulation 2016/679), effective May 2018, is the most comprehensive and globally influential privacy law in force. GDPR applies to any organisation that processes the personal data of EU/EEA residents, regardless of where the organisation is located. Its extraterritorial scope and substantial penalties have made it the de facto global privacy standard.

CCPA / CPRA — California Consumer Privacy Act

The California Consumer Privacy Act (2018) and California Privacy Rights Act (2020) together create the strongest US state privacy law. CPRA significantly expanded CCPA protections and created the California Privacy Protection Agency (CPPA) as a dedicated enforcement authority. California’s law serves as the de facto US national privacy standard, with most large organisations extending its protections beyond California residents.

HIPAA — Health Insurance Portability and Accountability Act

HIPAA (1996) and its implementing regulations — the Privacy Rule (2003), Security Rule (2003), Breach Notification Rule (2009), and Omnibus Rule (2013) — create the federal framework for protecting Protected Health Information (PHI) in the US healthcare system. HITECH (2009) significantly strengthened HIPAA penalties and extended requirements to Business Associates.

NIST Privacy Framework

The NIST Privacy Framework (Version 1.0, 2020) provides a voluntary tool for organisations to manage privacy risks and demonstrate compliance with applicable privacy requirements. It deliberately parallels the structure of NIST CSF to enable joint implementation and aligns with NIST 800-53 Rev. 5 privacy controls.

Financial Security Frameworks

Financial sector cybersecurity is governed by a dense, overlapping set of regulations from banking regulators, securities regulators, payment networks, and state authorities. Financial institutions face some of the most sophisticated and persistent threat actors — nation-state groups specifically target financial infrastructure for geopolitical and criminal purposes. Financial security frameworks reflect this elevated threat environment through specific technical requirements, incident response obligations, and regulatory examination programmes.

PCI DSS v4.0 — Payment Card Industry Data Security Standard

PCI DSS is a contractual security standard mandated by the payment card brands (Visa, Mastercard, Amex, Discover) for all organisations that store, process, or transmit cardholder data. Version 4.0 (released 2022, fully effective 2025) significantly modernised the standard to address cloud, e-commerce, and emerging threats while maintaining backward compatibility with existing programmes.

SOX — Sarbanes-Oxley Act

The Sarbanes-Oxley Act (2002) was enacted following the Enron and WorldCom accounting scandals to improve the accuracy and reliability of financial disclosures from public companies. Section 302 (CEO/CFO certification of financial reports) and Section 404 (management and auditor assessment of internal controls) created significant cybersecurity implications for all public companies.

GLBA — Gramm-Leach-Bliley Act Safeguards Rule

GLBA (1999) and the FTC’s Safeguards Rule (amended 2023) require financial institutions to protect the security and confidentiality of customer financial information. The 2023 Safeguards Rule update brought GLBA requirements into alignment with modern security practices, adding specific technical requirements that parallel NIST 800-53 and CIS Controls.

FFIEC — Federal Financial Institutions Examination Council

The FFIEC coordinates the examination of US financial institutions by five federal regulatory agencies (Federal Reserve, OCC, FDIC, NCUA, CFPB). FFIEC IT Examination Handbook booklets provide supervisory guidance that bank examiners use to assess cybersecurity programmes during safety-and-soundness examinations.

NY DFS 23 NYCRR 500

New York Department of Financial Services (NY DFS) Part 500 is the most prescriptive state-level cybersecurity regulation for financial services, applying to all DFS-regulated entities including insurance companies, banks, and licensed lenders. Its 2023 amendments significantly strengthened requirements and are being watched as a template for other state regulators.

International Standards and Cross-Sector Frameworks

International standards and cross-sector frameworks provide the building blocks of enterprise security programmes that transcend specific regulatory regimes. Unlike sector-specific regulations, these frameworks apply across industries and geographies, enabling organisations to build a coherent security programme that satisfies multiple regulatory requirements through a single integrated implementation.

ISO/IEC 27001 — Information Security Management System

ISO/IEC 27001 is the internationally recognised standard for information security management systems (ISMS). Published jointly by ISO and IEC, it specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS. ISO 27001 certification — awarded by accredited certification bodies following a formal audit — is the gold standard for demonstrating security programme maturity to customers, regulators, and partners worldwide.

CIS Controls — Center for Internet Security Critical Security Controls

The CIS Controls (version 8.0) provide 18 prioritised security actions that address the most common cyber-attacks. Originally developed by SANS Institute and now maintained by CIS, the Controls are derived from analysis of actual attack data — each control addresses specific attack techniques documented in real-world breaches. CIS Controls are the most widely adopted technical security framework in the private sector.

SOC 2 — System and Organisation Controls

SOC 2 reports (developed by AICPA) provide assurance on a service organisation’s controls related to security, availability, processing integrity, confidentiality, and privacy. Unlike certifications with pass/fail outcomes, SOC 2 reports describe the organisation’s system and controls and express an opinion on whether those controls were suitably designed and operated effectively.

Industry-Specific and Sector Cybersecurity Frameworks

Beyond general-purpose frameworks, many industries operate under sector-specific cybersecurity requirements driven by the unique risk profiles, regulatory structures, and societal consequences of security failures in those sectors. Understanding sector-specific requirements is essential for organisations operating in critical infrastructure, healthcare, energy, or other regulated industries.

NERC CIP — North American Electric Reliability Corporation

NERC Critical Infrastructure Protection (CIP) standards are mandatory reliability standards for bulk electric system owners and operators in North America. NERC CIP addresses the unique challenges of operational technology (OT) cybersecurity in energy infrastructure — systems where security failures can result in physical damage, widespread power outages, and threats to public safety.

HITRUST CSF — Healthcare Information Trust Alliance

HITRUST CSF is a healthcare-specific security framework that integrates requirements from HIPAA, NIST, ISO 27001, PCI DSS, and other standards into a single, prescriptive, assessable framework. HITRUST Certification has become the de facto standard for demonstrating healthcare security programme maturity and is increasingly required in healthcare business associate agreements.

TSA Security Directives — Transportation Sector

Following the Colonial Pipeline ransomware attack (2021), the Transportation Security Administration (TSA) issued binding Security Directives for pipeline, rail, and aviation operators with specific cybersecurity requirements that marked a significant escalation of federal cybersecurity mandates for transportation critical infrastructure.

IEC 62443 — Industrial Automation and Control Systems Security

IEC 62443 is the international standard for Industrial Automation and Control System (IACS) cybersecurity, covering both the procedures and technical requirements for securing operational technology (OT) environments across all industrial sectors. It defines roles, responsibilities, and security requirements for product suppliers, system integrators, and asset owners.

Zero Trust Architecture and Emerging Security Frameworks

Traditional security architectures relied on network perimeter defences: everything inside the network perimeter was trusted, everything outside was untrusted. The combination of cloud migration, remote work, mobile devices, and sophisticated supply chain attacks has fundamentally invalidated the perimeter trust model. Zero Trust Architecture (ZTA) replaces implicit perimeter trust with explicit, continuous verification of every access request regardless of source. Several authoritative frameworks now define ZTA implementation.

NIST SP 800-207 — Zero Trust Architecture

NIST SP 800-207 is the definitive federal guidance on Zero Trust Architecture, defining the principles, logical components, deployment scenarios, and migration roadmap for enterprise ZTA implementation. EO 14028 directed federal agencies to develop plans to implement NIST 800-207 principles.

NIST AI Risk Management Framework (AI RMF)

The NIST AI Risk Management Framework (2023) provides a voluntary framework for managing the risks of AI systems. EO 14110 directed NIST to lead federal AI risk management standards. As AI systems become embedded in security tools, business processes, and government operations, AI RMF provides the governance structure for managing AI-specific risks including privacy violations, bias, security vulnerabilities, and misuse.

NIST Secure Software Development Framework (SSDF)

NIST SP 800-218 (SSDF) provides a set of fundamental secure software development practices for integrating security into the software development lifecycle. EO 14028 directed NIST to publish secure software development guidance and directed OMB to require software vendors to comply with SSDF as a condition of federal procurement.

Framework Selection, Integration, and Compliance Reference Matrix

No organisation should implement frameworks in isolation. The most cost-effective compliance approach identifies the most comprehensive applicable framework as the foundation and demonstrates how its implementation satisfies the requirements of all other applicable frameworks. The following matrix maps each framework to its applicability context and primary CIA Triad focus.

Multi-Framework Compliance Strategy

Organisations subject to multiple frameworks can dramatically reduce compliance costs and complexity by implementing a single comprehensive control framework as the foundation and mapping to other frameworks’ requirements rather than treating each framework independently.