The National Institute of Standards and Technology (NIST) and the International Standardization Organization both have created globally accepted approaches to handling the information security of an organisation.
When an organisation wants to improve their approach to information security they are met with a common crossroad in which they choose to either adopt the NIST Framework or ISO 27001 or on some occasions both.
So far we have looked at understanding the NIST Framework, its core functions, the key NIST framework benefits, and how best to implement it into your organization.
This article hopes to clear up the differences between the two standards so that your organization can make an educated decision on which approach to information security is right for you.
|
NIST Framework |
ISO 27001 |
|
NIST was primarily created to help US federal agencies and organizations better manage their risk |
ISO 27001 is an internationally recognised method of creating and managing an Information Security Management System |
|
Consists of various control catalogs - 5 functions, 21 categories & 78 sub categories |
Consists of an Annex A that has 14 Control Domains, with 114 total controls |
|
Made up of three main sections; Framework Core, Implementation Tiers & Profiles. Each Core Function consists of categories that are required to be completed for that function to be considered fulfilled. |
Utilises a risk-based management that consists of recommendations on how best to secure information in the organization. |
|
Has voluntary self-assessment and self-compliance. |
Relies on independent audit and certification bodies. Organization’s will get a certification on completion. |
|
Uses five main functions to customise cybersecurity controls |
Has 10 clauses to guide an organization through their Information Security Management System |
Protect, Certify & Grow Your Business
Build resilient governance practices that can adapt and strengthen with evolving threats.
At the end of the day, which framework best suits your business is entirely dependent on the needs of your business and what it wants to achieve, for example Company X is looking to eventually earn ISO 27001 certification, then ISO 27001 is the obvious choice for Company X.
On the other hand another important consideration an organization should be taking when deciding between the two, is considering what the current level of maturity your organization’s cyber security is at and its overall risk preparation.
For example, Company Y has never considered its cyber security in the past and is trying to build a risk management program for the first time. The NIST Framework will effectively identify the company’s current maturity level of cybersecurity and create a list of risks based on the priority in which they need to be addressed. This list of risks will also be accompanied with clear instructions on how to best address mitigation. This makes the NIST Framework a good starting point for Company Y, as it may progress through the critical areas needed to reach compliance and focus on the specifics required for each stage.
A common misunderstanding is that companies have to pick one or the other and stick with it, or that one is better than the other. In fact, both frameworks can be applied to a single organization due to their synergy and can greatly increase its data security, risk assessments and security programs.
In conclusion, it is important for your organization to understand where it is at, analyzing industry standards and making a list of your goals and priorities can help you make an informed decision on which framework to choose. With ISO 27001 and the NIST Framework your organization has the advantage that several key areas of improvement overlap between both. Plus, they are both superbly designed and established methods of improving your overall information security to a high standard.
Looking for some professional guidance to make the choice between NIST or ISO 27001? Book a free consultation with one of our experts, and we can assist in making the right choice for your business.
Where are you at your cybersecurity maturity journey? Get an assessment of your current security posture and identify the gaps and challenges that you need to act upon.