13 Cybersecurity Frameworks, Standards and Regulations Explained
Summary
An explainer distinguishes 13 cybersecurity frameworks, standards, attestations, and regulations, outlining their scope and requirements and offering steps for mapping obligations to controls and maintaining ongoing risk management.
Key points
- NIST CSF 2.0 is voluntary, outcomes-based guidance with six functions; it has no formal certification.
- ISO/IEC 27001 can be certified for a defined ISMS scope, while ISO/IEC 27002 provides supporting control guidance.
- CIS Controls offer prioritized safeguards; SOC 2 reports provide independent assessments of controls within a defined system and period.
- Requirements such as PCI DSS, HIPAA, GDPR, DORA, and NIS2 apply according to organizational scope, sector, contracts, and jurisdiction.
- The article recommends identifying applicable obligations, choosing a core framework, mapping shared controls, testing and monitoring them, and reporting material risks.
- The author notes that frameworks and assessments have scope and time limits, so organizations need ongoing evidence to track changing exposure.
Article Details
- Topic
- Cybersecurity frameworks, standards, and regulations for managing cyber risk and compliance
Vendors
Products
Bitsight External Attack Surface ManagementBitsight External Attack Surface Management helps organizations discover internet-facing assets, identify externally observable exposures, and prioritize vulnerabilities. This can reveal assets or issues that areBitsight Third-Party Risk ManagementBitsight Third-Party Risk Management provides ongoing external insight into vendors and their broader technology relationships. Risk teams can use it to identify changes between scheduled reviews, investigate emergingCIS Critical Security Controls3. CIS Critical Security Controls v8.1COBIT 2019COBIT 2019 (Control Objectives for Information and Related Technologies) Large enterprises, public-sector bodies, and regulated organizations that need formal governance of information and technology. Vendors areCybersecurity Maturity Model Certification (CMMC)Industry or contractual requirement Applies through an industry program or contract PCI DSS, CMMCDORA27001 to build a formal management system, SOC 2 reports to assess vendors, and laws such as HIPAA, GDPR, DORA, or NIS2 to meet legal obligations. Those names are often grouped together, even though they serveFISMALaw or mandatory sector standard Creates enforceable duties for organizations in scope HIPAA, FISMA, GDPR, DORA, NIS2, NERC CIPGDPR27001 to build a formal management system, SOC 2 reports to assess vendors, and laws such as HIPAA, GDPR, DORA, or NIS2 to meet legal obligations. Those names are often grouped together, even though they serveHIPAA Security RuleHIPAA Security Rule (health insurance portability and accountability act) U.S. health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically in connection with aISO/IEC 27001work from a single rulebook. They may use the NIST Cybersecurity Framework to organize the program, ISO/IEC 27001 to build a formal management system, SOC 2 reports to assess vendors, and laws such as HIPAA, GDPR,ISO/IEC 270022. ISO/IEC 27001 and ISO/IEC 27002NERC CIPLaw or mandatory sector standard Creates enforceable duties for organizations in scope HIPAA, FISMA, GDPR, DORA, NIS2, NERC CIPNIS2 DirectiveThe NIS2 Directive establishes a common cybersecurity baseline across 18 critical sectors in the EU. Member states were required to transpose it into national law by October 17, 2024. Registration, supervision,NIST Cybersecurity FrameworkSecurity teams rarely work from a single rulebook. They may use the NIST Cybersecurity Framework to organize the program, ISO/IEC 27001 to build a formal management system, SOC 2 reports to assess vendors, and laws suchNIST Risk Management Framework9. FISMA and the NIST Risk Management FrameworkPCI DSSIndustry or contractual requirement Applies through an industry program or contract PCI DSS, CMMCSOC 2NIST Cybersecurity Framework to organize the program, ISO/IEC 27001 to build a formal management system, SOC 2 reports to assess vendors, and laws such as HIPAA, GDPR, DORA, or NIS2 to meet legal obligations. Those
Countries
Canadatransmission, distribution, balancing, and reliability organizations in the United States and parts of Canada. Technology and service vendors are generally affected through utility procurement and supply chain riskUnited Statescertain generation, transmission, distribution, balancing, and reliability organizations in the United States and parts of Canada. Technology and service vendors are generally affected through utility procurement
Industries
Critical infrastructureand Technology Cybersecurity Framework) Organizations in any sector. It is widely used by critical infrastructure, government, healthcare, financial services, technology, and other risk sensitive industries.DefenseCMMC (Cybersecurity Maturity Model Certification) U.S. defense contractors and subcontractors when a solicitation of contract requires a CMMC status because they will process, store, or transmit FCI or CUI onDigital infrastructureEssential and important entities across 18 EU sectors, including energy, transport, health, digital infrastructure, public administration, manufacturing of specified critical products, and certain digitalEnergyand Information Systems Directive) Essential and important entities across 18 EU sectors, including energy, transport, health, digital infrastructure, public administration, manufacturing of specified criticalFinancial Services Organizations in any sector. It is widely used by critical infrastructure, government, healthcare, financial services, technology, and other risk sensitive industries. Suppliers may be asked to align with NIST CSFGovernmentCybersecurity Framework) Organizations in any sector. It is widely used by critical infrastructure, government, healthcare, financial services, technology, and other risk sensitive industries. Suppliers may beHealthcareFramework) Organizations in any sector. It is widely used by critical infrastructure, government, healthcare, financial services, technology, and other risk sensitive industries. Suppliers may be asked to alignManufacturing18 EU sectors, including energy, transport, health, digital infrastructure, public administration, manufacturing of specified critical products, and certain digital services. Exact scope depends on national law.Public administrationentities across 18 EU sectors, including energy, transport, health, digital infrastructure, public administration, manufacturing of specified critical products, and certain digital services. Exact scope dependsTechnologyNIST CSF 2.0 (National Institute of Standards and Technology Cybersecurity Framework) Organizations in any sector. It is widely used by critical infrastructure, government, healthcare, financial services, technology,TransportSystems Directive) Essential and important entities across 18 EU sectors, including energy, transport, health, digital infrastructure, public administration, manufacturing of specified critical products,