NIST CSF, SP 800-53, ISO 27001, CIS Controls
Four documents come up whenever a security exam says “framework”: the NIST Cybersecurity Framework (CSF) 2.0, NIST SP 800-53, ISO/IEC 27001 and the CIS Controls. They are not interchangeable. CSF 2.0 organises cybersecurity outcomes and is used to plan and communicate a program. SP 800-53 is a detailed catalog of controls. ISO/IEC 27001 is a management-system standard against which an organisation can be audited and certified. The CIS Controls are a short, prioritised list of practical safeguards. The decision rule: match the verb in the question. Organise or communicate points to CSF, select detailed controls to SP 800-53, get certified to ISO 27001, and implement the most important safeguards first to CIS.
A key for telling them apart
| Framework | Publisher | Shape | Verb to remember |
|---|---|---|---|
| NIST CSF 2.0 | NIST | Six Functions: Govern, Identify, Protect, Detect, Respond, Recover | Organise, communicate |
| NIST SP 800-53 Rev. 5 | NIST | Catalog of security and privacy controls in 20 families | Select, tailor, assess |
| ISO/IEC 27001:2022 | ISO and IEC | Requirements for an information security management system (ISMS), with an Annex A control set | Certify |
| CIS Controls v8.1 | Center for Internet Security | 18 Controls, 153 Safeguards, three Implementation Groups | Prioritise |
Details worth knowing for each:
- CSF 2.0 was released on February 26, 2024. The new Function is Govern, which treats cybersecurity as a source of enterprise risk and covers how decisions are made. NIST describes it as designed for all audiences, industry sectors and organisation types, not only critical infrastructure (NIST CSF 2.0 release). It describes outcomes, not specific controls, and it is not something a company is certified against.
- SP 800-53 Rev. 5 was published in September 2020 and is the control catalog. Its companion SP 800-53B defines three security control baselines, one each for low, moderate and high impact systems, plus a privacy baseline. NIST issued Release 5.2.0 on August 27, 2025, adding a few controls and enhancements (SP 800-53 Rev. 5).
- ISO/IEC 27001:2022 requires an ISMS built on risk assessment and treatment. Its Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). The ISO/IEC 27002 companion gives implementation guidance for them. Each Annex A control must appear in a Statement of Applicability as included or excluded with a reason. Control counts come from secondary sources; the ISO store pages block automated access, so confirm against the standard.
- CIS Controls v8.1 has 18 Controls, from inventory of enterprise assets to penetration testing, and 153 Safeguards. Implementation Group 1 (IG1) is described as essential cyber hygiene, IG2 builds on it, and IG3 includes everything (CIS Implementation Groups).
One requirement, four framings
The requirement: “Administrator sign-ins must be logged and the logs reviewed.”
- CSF 2.0: two outcomes. Under Protect, log records are generated and made available for monitoring (PR.PS-04); under Detect, assets are monitored for adverse events (Continuous Monitoring, DE.CM). It says what should be true, not how.
- SP 800-53: the Audit and Accountability family, with specific control statements you tailor to your system.
- ISO 27001: an Annex A technological control on logging, which you include in the Statement of Applicability and prove with evidence at audit.
- CIS Controls: Control 8, Audit Log Management, with safeguards that say what to collect and how long to keep it.
Same intent, four levels of specificity. An exam question that wants “the framework that states the desired outcome without prescribing controls” is describing CSF.
They are used together
Real programs combine them. A company might use CSF 2.0 to structure the program and report to executives, take its detailed control wording from SP 800-53 or ISO Annex A, and use CIS Controls as the order in which to implement technical safeguards. A question that offers “use one framework instead of the others” is usually wrong; a question that asks which one fits a stated purpose is usually testing the key above. Mappings between the frameworks exist, so choosing one does not lock you out of the others.
Which exams test this
| Exam | How it appears | On this site |
|---|---|---|
| SY0-801 | Security Program Management and Oversight domain (14%): objective 5.5 lists frameworks and standards (industry-based, international, region-specific) among audit and assessment activities, and objective 5.1 covers standards and other governance artifacts | Security program management |
| SC-500 | Minor topic. Manage and monitor security posture domain (20–25%): evaluate compliance against security frameworks with Defender for Cloud. The outline does not name the frameworks; the task is reading compliance results in the tool | SC-500 security posture explained |
SY0-801 lists the category, not named documents, so expect “an international standard certifiable by auditors” rather than a page number. Other exams here point to frameworks outside this guide: CY0-001 objective 4.3 names the NIST AI Risk Management Framework and ISO AI standards, and the ISACA AI exams (AAISM, AAIR, AAIA) refer to industry frameworks and standards for AI. The NIST AI RMF is a separate NIST document about AI risk; see AI governance and risk and Zero Trust explained.
How the questions are built
- “Certified”, “audited by an accredited body”, “ISMS” means ISO/IEC 27001. CSF, SP 800-53 and CIS have no certification of the organisation.
- “Federal information systems”, “baseline for low, moderate, high impact” means SP 800-53 and 800-53B.
- “Small organisation with limited resources, where to start” means CIS Controls, specifically IG1.
- “Common language for executives and technical staff”, “profile”, “Govern” means CSF 2.0.
- The common trap is treating CSF as a checklist of controls. It is a set of outcomes; the controls come from SP 800-53, ISO Annex A or CIS.
- The second trap is mixing up 27001 and 27002. 27001 is the one you certify against; 27002 is guidance.
- A version trap: CSF 2.0 has six Functions, not five. Govern is the one added.
Next, risk management is the process that ISO 27001 builds its control selection on, and the incident response lifecycle maps naturally to CSF’s Respond and Recover Functions.
Practice questions
Question 1. A 40-person company with one IT administrator wants a practical, prioritised starting point for improving security, without implementing hundreds of detailed controls. Which resource fits best?
- A. NIST SP 800-53 high baseline
- B. CIS Controls Implementation Group 1
- C. ISO/IEC 27001 certification
- D. NIST CSF 2.0 Govern Function only
Show answer
Answer: B
The CIS Controls are a prioritised set of safeguards, and Implementation Group 1 is meant as the basic starting point for organisations with limited resources. SP 800-53 is a large control catalog suited to detailed tailoring. ISO/IEC 27001 requires building and auditing a full management system. CSF 2.0 gives outcomes but does not prioritise specific safeguards.
Question 2. A customer requires proof from an independent auditor that a service provider runs a formal information security management system. Which standard supports an independent certificate?
- A. NIST CSF 2.0
- B. NIST SP 800-53
- C. CIS Controls v8.1
- D. ISO/IEC 27001
Show answer
Answer: D
ISO/IEC 27001 specifies requirements for an ISMS and is the standard organisations are audited and certified against. CSF 2.0 is a guidance framework with no certificate. SP 800-53 is a control catalog. The CIS Controls are a set of recommended safeguards, not a certifiable management system.