Common Frameworks

Security frameworks proliferate, and the instinct is to treat them as interchangeable checklists of controls. They’re not — they differ in kind, and understanding what each is for is what lets you avoid implementing the same control seven times for seven audits. The useful distinction is the role each plays, not the controls each contains.

A landscape that moves

Framework versions, control counts, and certification schemes change. This section is about the durable shape of each framework and how they relate; verify current versions and specifics before citing them in a real assessment.

Frameworks differ by kind

Sort them by what they actually are and most of the confusion clears:

• Voluntary frameworks you adopt to structure a program — NIST CSF, CIS Controls.
• Certifiable standards a third party audits you against — ISO 27001, SOC 2.
• Mandatory regimes required to operate in a market or sector — FedRAMP, PCI DSS.
• Control catalogs you draw from rather than certify against — NIST SP 800-53.

A framework’s kind determines how you use it. You adopt CSF, get certified against ISO, achieve authorization under FedRAMP, and select from 800-53. Treating a catalog as a checklist, or a voluntary framework as a certification, is a category error that wastes effort.

The major frameworks

Each framework below has its own page — what it is, the distinction that trips people up, and where it connects to the rest of the site. They are grouped by the kind above.

Framework	Kind	The distinction that matters
NIST CSF 2.0	Voluntary	An organizing structure, not a control list — CSF 2.0 made Govern its own function
CIS Controls & Benchmarks	Voluntary	The one that tells you the actual setting, which is why it doubles as a posture baseline
ISO/IEC 27001 & 27002	Certifiable	27001 certifies the management system; 27002 is the control guidance
SOC 2	Certifiable	Type I attests design, Type II attests operation — Type II is the one customers want
FedRAMP	Mandatory	Authorization to sell cloud to the US government, built on 800-53 baselines
PCI DSS v4.x	Mandatory	Enforced by the card brands, not a government; narrow scope, deep within it
NIST SP 800-53	Catalog	The common denominator most other frameworks quietly map back to
HITRUST CSF	Certifiable	Bundles and maps other frameworks into one certifiable, healthcare-oriented program
CMMC	Mandatory	The US defense supply chain’s certification of NIST 800-171

What they share, and why that matters

Strip the vocabulary differences and the major frameworks converge on the same control families: access control, change management, logging and monitoring, incident response, vulnerability management, encryption, and vendor risk. They are largely the same controls in different language, which is the entire foundation of the common-control approach — implement the control once, evidence it against many frameworks.

That convergence is also why the controls trace to the other pillars directly: access control is IAM governance, secure change management is AppSec SDLC, logging and monitoring is detection, and encryption is key management. A framework requirement is rarely a new thing to build; it’s usually a demand for evidence that something you should already be doing is being done and can be shown.

Choosing, without collecting them all

The mistake is pursuing frameworks for their own sake. The driver should be external: customers demand SOC 2, the government market demands FedRAMP, payment processing demands PCI, the sector demands HITRUST. Choose CSF or CIS as your internal organizing spine, add certifications as the market requires them, and lean on mapping so each addition is incremental rather than a fresh program. A team chasing certifications nobody asked for is spending security budget on paperwork.

Where this connects

Frameworks are the source of the control requirements the rest of the site implements — this pillar is where IAM, AppSec, detection, and cloud get their obligations. The mechanism that stops each framework being separate work is compliance mapping, and turning the whole thing from paperwork into pipeline is GRC engineering.