Framework
A structured set of controls and processes used to organize a security program.
A framework is a structured catalog of controls and processes that organizes a security program so teams don’t start from a blank page. Common choices serve different purposes: NIST CSF for risk-based program structure, NIST SP 800-53 for a deep control catalog, ISO 27001 for a certifiable ISMS, and CIS Controls for a prioritized quick-start. Beyond structure, a shared framework gives auditors and leadership a common vocabulary.
Advertisement