Cybersecurity Frameworks: Which One Your Business Actually Needs
Cybersecurity frameworks are structured sets of guidelines that help a business manage cyber risk. The most common are the NIST Cybersecurity Framework, CIS Controls, ISO 27001, SOC 2, PCI DSS, HITRUST, and CMMC. Most small businesses should start with NIST CSF or CIS Controls, then add whatever framework their customers, insurers, or regulators require.
I spent a decade doing IT inside the government-contractor world, where audits weren't an annual event. They were the weather. That job taught me the expensive mistake usually isn't picking the wrong framework. It's picking three of them at once, buying a binder for each, and implementing none. Frameworks aren't trophies. They're a to-do list somebody smart already wrote for you. The trick is choosing the list that matches your business, and actually doing what's on it.
TL;DR: A cybersecurity framework tells you what good security looks like. NIST CSF is the best general starting point, CIS Controls is the most practical checklist, and frameworks like SOC 2, PCI DSS, CMMC, and HITRUST usually come from a customer or contract that requires them. Pick one to build on, map the others to it, and focus on doing the work, not collecting badges.
What Are Cybersecurity Frameworks?
A cybersecurity framework is a written structure for managing security. It tells you which areas to cover, such as access control, backups, and incident response, and gives you a way to measure how well you're doing.
Frameworks don't install anything. They're closer to a building code than a contractor. They tell you what the finished building should have. You still need someone to build it.
Most frameworks fall into three types:
Program frameworks describe your whole security program. NIST CSF and ISO 27001 are examples.
Control frameworks list specific safeguards to put in place. CIS Controls and NIST SP 800-171 are examples.
Risk frameworks help you measure and prioritize risk. NIST's Risk Management Framework is an example.
Why Your Business Needs One
Without a framework, security decisions get made by whoever shouted last. A vendor pitches a shiny tool, someone reads a scary headline, and suddenly you've bought something that solves a problem you didn't have.
A framework gives you a few practical things:
A shared language between you, your IT provider, your auditors, and your insurer
A way to prioritize what to fix first
Evidence when a customer, bank, or insurer asks how you protect data
A baseline to measure progress year over year
It also makes conversations with cyber insurers much easier. When they send a 40-question form, the answers are already written down.
NIST Cybersecurity Framework (CSF 2.0)
The NIST CSF is the most widely used framework in the US. NIST released version 2.0 on February 26, 2024, and expanded its focus from critical infrastructure to organizations of every size.
CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern is new in 2.0, and it covers the part most small businesses skip: who owns security, what the policy is, and how decisions get made.
NIST Director Laurie E. Locascio described it this way: "CSF 2.0, which builds on previous versions, is not just about one document. It is about a suite of resources that can be customized and used individually or in combination over time as an organization's cybersecurity needs change and its capabilities evolve."
NIST also published a free Small Business Quick Start Guide for CSF 2.0. It's short and readable, which is not a sentence I get to write about government documents very often.
CIS Controls
If NIST CSF tells you what areas to cover, the CIS Controls tell you exactly what to do. They're a prioritized list of 18 controls from the Center for Internet Security.
The best part for small businesses is Implementation Group 1. CIS describes IG1 as "essential cyber hygiene and represents an emerging minimum standard of information security for all enterprises." It contains 56 safeguards, things like keeping an inventory of devices, using MFA, managing patches, and keeping backups.
If you don't know where to start, start here. IG1 is achievable for a 20-person office, and every other framework will thank you for it.
ISO/IEC 27001
ISO 27001 is the international standard for an information security management system (ISMS). Unlike NIST CSF, it's certifiable: an accredited auditor can certify that your program meets the standard. The 2022 version includes 93 controls in Annex A, and ISO 27002 explains how to implement them.
It makes the most sense if you sell to international customers or larger enterprises that ask for it by name. Our guide to the ISO 27001 certification process covers the steps and timeline.
SOC 2
SOC 2 isn't technically a framework, and it isn't a certification either. It's an audit report, based on the AICPA's Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Software companies and service providers get SOC 2 reports because their customers ask for them.
If you're a SaaS company or an MSP, you'll probably need one eventually. If you're a law firm or a dental office, you'll more likely be asking your vendors for theirs. Our post on the SOC 2 report explains how to read one.
PCI DSS, HITRUST, CMMC, and Other Industry Frameworks
These usually aren't optional. They come from your industry or a contract.
PCI DSS applies to any business that stores, processes, or transmits card data. Version 4.0.1 is current, and its future-dated requirements took effect March 31, 2025.
HITRUST CSF is common in healthcare, especially for vendors selling to hospitals and health plans. It maps HIPAA, NIST, ISO, and others into one certifiable framework.
CMMC applies to defense contractors handling Federal Contract Information or Controlled Unclassified Information. Level 2 is built on the 110 requirements of NIST SP 800-171. Our CMMC compliance checklist breaks it down.
COBIT, from ISACA, focuses on IT governance and is more common in larger organizations.
Cloud Controls Matrix from the Cloud Security Alliance covers cloud providers and cloud-heavy businesses.
Outside the US, you'll see Cyber Essentials (UK) and the Essential Eight (Australia).
A Law Isn't a Framework
This trips up a lot of business owners. HIPAA, GLBA, and state privacy laws are regulations. They tell you that you must protect data. They don't give you a step-by-step program for doing it.
That's where frameworks come in. A medical practice uses NIST CSF or the HHS 405(d) practices to meet HIPAA. A tax preparer uses a written security plan built on a framework to meet the FTC Safeguards Rule. The law sets the requirement. The framework is how you meet it.
How the Major Cybersecurity Frameworks Compare
Here's the short version:
NIST CSF 2.0: Free, flexible, any size business. Not certifiable. Best general starting point.
CIS Controls: Free, specific, prioritized. Best for "just tell me what to do."
ISO 27001: Certifiable, international, more paperwork. Best when customers require it.
SOC 2: Audit report for service providers. Best when your customers ask for it.
PCI DSS: Required if you handle card data.
CMMC: Required for many defense contractors.
HITRUST: Common for healthcare vendors.
How to Choose the Right Framework
Answer three questions:
Does a law, contract, or customer require a specific one? If yes, that's your framework. Defense contract means CMMC. Card payments mean PCI DSS. A big SaaS customer asking for SOC 2 means SOC 2.
If nothing is required, how big and complex are you? Under 50 people, start with CIS IG1 and use NIST CSF to organize it. Larger or growing, use NIST CSF as the backbone.
Who's going to do the work? A framework you can't maintain is shelfware. Pick one that matches your team, or your IT provider's.
Then map. Most frameworks overlap heavily, and NIST, CIS, and others publish mappings between them. Do the work once, and point each framework at it.
A Compliance Badge Isn't the Same as Being Secure
My one strong opinion on cybersecurity frameworks: a compliance badge is not the same thing as being secure.
Plenty of providers sell a checklist and a certificate without the security practice behind it. Picture a beautiful patching policy sitting next to a server that hasn't been patched since it was installed. The auditor checks whether the policy exists. Nobody checks whether patches are actually happening. The binder passes. The network doesn't.
Frameworks work when they describe what you actually do every day: patching, monitoring, tested backups, MFA everywhere. If your framework lives in a SharePoint folder nobody opens between audits, it's decoration. A good cybersecurity risk assessment checks the network, not just the paperwork.
What It Really Costs and How Long It Takes
Honest numbers vary a lot, so here's the honest shape instead:
CIS IG1 or NIST CSF basics: mostly your time and your IT provider's time. A small business can make real progress in 60 to 90 days.
SOC 2 or ISO 27001: add auditor fees, a compliance tool, and several months of evidence collection.
CMMC Level 2: often the heaviest lift, especially if you need GCC High or major network changes.
The cheapest path is always the same: do the basics first, then add certifications only when a customer is paying you for them.
When You Don't Need Us for This
Plenty of businesses can start on their own.
You're under 15 people with no regulated data. Download the NIST Small Business Quick Start Guide and the CIS IG1 list. Work through them with whoever manages your IT.
You have a sharp internal IT person. Give them a quarter, a budget, and the CIS Controls. Check in monthly.
You just need to answer an insurance questionnaire. Answer it honestly, then fix the "no" answers one at a time.
Where it's worth getting help: a contract that requires CMMC or SOC 2, an upcoming audit, multiple frameworks overlapping, or no one who owns security. That's where our NIST compliance audit services and virtual CISO services earn their keep.
Straight Answers About Cybersecurity Frameworks
What are the most common cybersecurity frameworks?
NIST CSF, CIS Controls, ISO 27001, SOC 2, PCI DSS, HITRUST CSF, CMMC, and COBIT. NIST CSF is the most widely used in the US.
What are the five functions of the NIST Cybersecurity Framework?
Earlier versions had five: Identify, Protect, Detect, Respond, and Recover. CSF 2.0, released in February 2024, added a sixth function, Govern, which covers strategy, policy, and oversight.
Which cybersecurity framework is best for small businesses?
Start with CIS Controls Implementation Group 1 for practical safeguards, organized under NIST CSF 2.0. Both are free. Add industry frameworks like PCI DSS or CMMC only if your business requires them.
Is HIPAA a cybersecurity framework?
No. HIPAA is a law. Its Security Rule sets requirements for protecting health information, and practices often use a framework like NIST CSF or the HHS 405(d) practices to meet them.
What is the difference between NIST and ISO 27001?
NIST CSF is a free, voluntary US framework that isn't certifiable. ISO 27001 is an international standard you can be certified against by an accredited auditor. Many organizations use NIST to build the program and ISO 27001 to prove it.
Can a business follow more than one framework?
Yes, and most eventually do. Pick one as your foundation, then map the others to it so you're not doing the same work twice.
Still Stuck? Give Us a Call
If you're not sure which cybersecurity framework fits your business, give us a call at 410-703-3857 or send us a note. We work with businesses and government contractors across Maryland, Virginia, and DC, including McLean and Columbia.
We'll help you pick one framework and actually do it. The binder is optional. The patching isn't.
Comments