10 Common Cybersecurity Frameworks: Choosing the Right One for Your Clients

  • November 14, 2024
Author

Anna Fitzgerald

Senior Content Marketing Manager

Reviewer

Rob Gutierrez

Senior Compliance Manager

Service providers often play a critical role in helping their clients establish a solid cybersecurity posture. One essential part of this role involves selecting the most appropriate cybersecurity framework(s) to implement. 

With an array of frameworks to choose from, each with distinct purposes, requirements, and assessments, finding the best fit is vital but often challenging for client organizations. By understanding the purpose and strengths of common cybersecurity frameworks, service providers can help select the most suitable one for their clients' needs.

In this post, we’ll provide an overview of common cybersecurity frameworks and standards and insights into how to help your clients make the right choice.

What is a cybersecurity framework? 

A cybersecurity framework is a structured set of guidelines and best practices designed to help organizations manage cybersecurity risks effectively. These frameworks define policies and procedures for establishing and maintaining security controls, enabling organizations to build resilient and proactive defenses against cyber threats.

Cybersecurity frameworks offer multiple benefits, including: 

  • Prescriptive requirements: Cybersecurity frameworks offer a roadmap to create a secure environment tailored to specific needs—be it healthcare, finance, or retail. 
  • Standardized protocols: Using frameworks helps organizations establish a consistent approach to security, making it easier to implement, scale, and sustain over time.
  • Improved incident response: Frameworks establish clear protocols for incident detection, response, and recovery, which can help minimize the impact of cybersecurity incidents.
  • Enhanced trust: Adopting widely recognized frameworks shows a commitment to high security standards, which can help bolster the confidence of customers, partners, investors, and other key stakeholders.
  • Regulatory compliance: In many cases, compliance is not optional. Failing to comply with relevant cybersecurity frameworks can result in severe financial and legal fines and penalties as well as potential damage to brand reputation.
  • Driving growth and revenue: Compliance with a cybersecurity framework can not only help you put robust security measures in place — it can also be a competitive advantage. In 2023, 72% of businesses completed a compliance audit specifically to win new business. Compliance with certain frameworks, like ISO 27001 and DORA, can also help organizations build trust with international customers and enter global markets.

Common cybersecurity framework and standards

With so many cybersecurity frameworks available, service providers should understand the unique strengths and applications of the most common in order to best guide their clients’ selections. Below are 10 widely recognized frameworks, each with specific purposes, ideal audiences, assessment types, and certification methods.

Framework Purpose Best suited for Assessment type Assessment frequency Certification
CIS Controls Enhance cybersecurity posture and mitigate the most common cyber threats Anyone, but especially organizations starting a cybersecurity program Self-assessment Continuous No
NIST CSF Improve management of cybersecurity risk Anyone, but mandatory for U.S. federal agencies Self-assessment Continuous No
SOC 2 Protect customer data Service organizations that store, process, or transmit any kind of customer data, particularly in the US Audit by CPA firm Annual typically No
ISO 27001 Build and maintain an information security management system (ISMS) Any company handling sensitive data, particularly international ones Certification, surveillance, and recertification audits by an accredited third party Annual surveillance audits and a recertification audit every three years Yes
NIS2 Directive Improve cyber resilience across essential services in the EU Public and private entities in the EU that provide essential or important services Depends on EU Member State’s national laws Depends on EU Member State’s national laws Depends on EU Member State’s national laws
CMMC Protect CUI and FCI that is shared with contractors and subcontractors of the DoD Contractors and subcontractors that are working or want to work in the DIB Self assessment for Level 1 and non-critical Level 2; C3PAO assessment for critical Level 2; Government-led assessments for Level 3 Annual for Level 1 and non-critical Level 2; Triennial for critical Level 2 and Level 3 Yes
Cyber Essentials Enhance cybersecurity posture and mitigate the most common cyber threats Anyone, but mandatory for organizations working with the UK government Self-assessment (Cyber Essentials) or third-party verification (Cyber Essentials Plus) Annual Yes
Essential Eight Enhance cybersecurity posture and mitigate the most common cyber threats Anyone, but especially organizations in Australia Self-assessment Continuous No
COBIT Align IT with business goals, security, risk management, and information governance Anyone, but especially publicly traded companies that need to comply with SOX Self-assessment Continuous No
DORA Strengthen the IT security and operational resilience of EU financial institutions EU financial entities and their critical ICT service providers Self-assessment Depends on risk profile No

1. CIS Critical Security Controls®

The CIS Critical Security Controls® (CIS Controls®) are a prioritized set of actions developed by the Center for Internet Security, Inc. (CIS®) that organizations can take to defend themselves against common cyber attack vendors. For more than 20 years, CIS has been an independent and trusted resource for cybersecurity, responsible for globally recognized best practices for securing IT systems and data.

Purpose

The CIS Controls aim to help organizations identify, manage, and mitigate the most prevalent cyber threats against systems and networks. 

Best suited for

The CIS Controls, which prescribe foundational security measures for strengthening an organization’s cybersecurity posture, are designed to be straightforward to implement for organizations of all sizes. Because they are easily digestible, actionable, and widely recognized and respected within the cybersecurity community, this framework can be a great starting point for any cybersecurity program.

Assessment type and frequency

Like NIST, CIS does not offer certification or require audits. Organizations often undertake internal or third-party assessments to evaluate their compliance with the CIS Controls.

2. NIST Cybersecurity Framework (CSF)

NIST CSF 2.0 is a set of standards, guidelines, and best practices developed by the National Institute of Standards and Technology to help organizations to better understand and improve their management of cybersecurity risk.

Purpose

NIST CSF is designed to help organizations better understand, manage, and reduce cybersecurity risk. 

Best suited for

While mandatory for U.S. federal agencies and widely adopted by critical infrastructure companies, many organizations across industries use the CSF on a voluntary basis.

The latest version of this framework is designed to be flexible and adaptable so organizations of any size, sector, or cybersecurity program maturity can use it and customize it to suit their specific cybersecurity needs and risk profiles.

Assessment type and frequency

NIST CSF does not offer certification or require audits. Organizations can conduct self-assessments or use third-party assessments to evaluate its cybersecurity efforts and identify areas of improvement using the six core functions (Govern, Identify, Protect, Detect, Respond, Recover).

3. SOC 2® 

SOC 2 is a security framework created by the American Institute of Certified Public Accountants (AICPA). SOC 2 specifies how service organizations should manage and store customer data based on five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

Purpose

SOC 2 is designed to ensure service organizations have adequate systems and controls in place to protect critical business information.

Best suited for

SOC 2 applies to any service organization that stores, processes, or transmits any kind of customer data. It is particularly popular among SaaS providers, cloud computing providers, and organizations handling personal or customer data in regulated industries, as it demonstrates strong data security and privacy practices.

SOC 2 reports are best known in North America and therefore typically carry more weight in the US.

Assessment type and frequency

SOC 2 requires an external audit conducted by a CPA firm. Organizations can choose between SOC 2 Type I, which is a point-in-time audit, and SOC 2 Type II, which assesses security controls over a period of time (typically three, six, nine, or twelve months). Organizations typically undergo SOC 2 Type II audits annually.

The Ultimate Guide to SOC 2

Learn everything you need to know about the requirements, process, and costs of getting SOC 2 compliant. 

4. ISO 27001

ISO/IEC 27001 is the leading international standard for information security developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

Purpose

ISO/IEC 27001 provides a framework for establishing, implementing, maintaining, and improving an information security management system (ISMS) to protect sensitive data against increasingly sophisticated attacks.

Best suited for

ISO/IEC 27001 is suitable for organizations of all sizes across industries, especially those handling sensitive data or operating in highly regulated sectors where information security is paramount.

While ISO 27001 is popular worldwide, it is most commonly requested by international customers, especially in Europe.

Assessment type and frequency

ISO/IEC 27001 certification is obtained through an external audit by an accredited ISO certification body. Initial certification involves a comprehensive audit, with surveillance audits conducted annually and a full re-certification audit every three years.

It's important to note that organizations may implement ISO 27001 and not go through the certification process.

5. NIS2 Directive

NIS2 is an updated version of the Network and Information Systems (NIS) Directive, a landmark piece of legislation aimed at enhancing cybersecurity across the European Union (EU).  Building on the original directive passed in 2016, NIS2 expands the scope to include more sectors, imposes stricter obligations, and enforces tougher penalties for noncompliance. 

Purpose

The purpose of NIS2 is to strengthen the cybersecurity framework within the European Union to improve the resilience of critical infrastructure and essential and digital services. To do this, NIS2 requires critical and important entities to adopt appropriate measures to manage cybersecurity risks, report incidents, and secure their network and information systems against cyber threats.

Best suited for

NIS2 applies to a broad range of public and private organizations that provide services that are deemed essential or important to the European economy and society, including: 

  • Energy
  • Health
  • Transport
  • Finance
  • Public administration
  • Space
  • Water supply
  • Digital infrastructure
  • Postal services
  • Waste management
  • Chemicals
  • Research
  • Foods
  • Manufacturing
  • Digital providers

Assessment type and frequency

Assessment requirements vary depending on how the EU Member States have transposed — or will transpose — NIS2 into their national laws. Most will likely require internal audits as well as periodic audits conducted by regulatory authorities, based on the guidelines included in the draft Implementing Regulation published by the European Commission and legislation passed by Member States. Some Member States may accept corresponding certification, like Belgium accepts ISO/IEC 27001 certification issued by an accredited conformity assessment body for essential entities. 

6. Cybersecurity Maturity Model Certification (CMMC)

CMMC is a comprehensive framework created by the U.S. Department of Defense (DoD) to enhance the cybersecurity of contractors within the Defense Industrial Base (DIB).

Purpose

The purpose of CMMC is to ensure that companies working with the DoD protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) from cyber threats and unauthorized access. 

Best suited for

Any organization that works or wants to work with the DoD, either directly or as a subcontractor, and handles FCI or CUI will need to comply with CMMC.

Assessment type and frequency

Organizations pursuing Level 1 certification or non-critical Level 2 certifications can perform self-assessments annually. For critical Level 2 certifications, organizations must undergo an assessment conducted by a certified Third-Party Assessment Organization (C3PAO) triennially. Organizations seeking Level 3 certification, which involves handling the most sensitive DoD information, will be subject to assessments led by government officials triennially.

7. Cyber Essentials

Cyber Essentials is a UK government-backed scheme that offers basic cybersecurity measures organizations can implement to reduce their vulnerability to common cyber attacks.

Purpose

Cyber Essentials is designed to help organizations in the UK and abroad guard against the most common cyber threats and demonstrate their commitment to cybersecurity.

Best suited for

While Cyber Essentials is suitable for all organizations of any size and in any sector, it is particularly recommended for organizations that handle personal data or are suppliers to government bodies. It is mandatory for suppliers bidding for certain types of public contracts with the UK government.

Assessment type and frequency

The assessment requirement varies depending on the level of certification an organization is pursuing:

  • Cyber Essentials: This requires organizations to complete a self-assessment questionnaire, with the responses independently reviewed by an external certifying body.
  • Cyber Essentials Plus: This involves both the self-assessment questionnaire and an independent external test of the organization's cyber security approach.

Since the certificate is valid for 12 months from the date of issue, organizations must re-assess annually to maintain their certification

8. The Essential Eight

The Essential Eight is a prioritized set of mitigation strategies developed by the Australian Cyber Security Centre (ACSC) to help organizations protect themselves against various cyber threats.

Purpose

The Essential Eight is designed to help organizations protect their internet-connected information technology networks against a wide range of cyber threats by prioritizing and implementing essential mitigation strategies.

Best suited for

While initially aimed at Australian organizations, the principles and strategies are universally applicable and are considered best practices for enhancing cybersecurity globally. The Essential Eight framework is sector-agnostic and can be applied to any organization—public or private—across various industries. 

Assessment type and frequency

Organizations should conduct assessments against the Essential Eight using the Essential Eight Maturity Model, which describes three target maturity levels. Organizations are encouraged to progressively implement, and assess their implementation of, each maturity level until their target maturity level is achieved. They can do so through self- or third-party assessments. 

9. Control Objectives for Information and Related Technology (COBIT)® 

COBIT is a framework developed by ISACA for the governance and management of enterprise IT, focusing on aligning IT strategy with business goals, security, risk management, and information governance.

Purpose

COBIT helps organizations develop, implement, monitor, and improve IT governance and management practices, aiming to help businesses achieve their objectives while managing IT-related risks appropriately. 

Best suited for

COBIT is industry-agnostic and can be applied to any enterprise regardless of size, sector, or geography. This includes (but is not limited to) finance, healthcare, IT, manufacturing, and government entities.

Since COBIT is often used to comply with Sarbanes-Oxley (SOX) rules, it is commonly implemented by publicly traded companies. 

Assessment type and frequency

Organizations can conduct self-assessments or external assessments may be carried out by third-party auditors as needed to validate compliance with the practices and processes set forth by COBIT.

Note: COBIT does offer certifications for individuals who pass certification exams. But it does not offer certifications to organizations that undergo an audit, like ISO 27001. 

10. Digital Operational Resilience Act (DORA)

DORA is an EU regulation that aims to help financial entities and their providers of information and communications technology (ICT) withstand, respond to, and recover from all types of ICT-related disruptions and threats. 

Purpose

The purpose of DORA is to improve the digital operational resilience of the EU's financial sector by establishing robust standards for ICT risk management, incident reporting, operational resilience testing, and third-party risk monitoring.

Note that unlike NIS2, DORA is unique in its focus on strengthening the digital resilience of the European financial ecosystem and is applicable specifically to the financial sector.

Best suited for

DORA applies broadly to financial entities, which includes most types of financial services entities regulated in the EU, such as banks, payments and e-money firms, investment firms, insurers, and crypto asset firms. It also applies to critical ICT third-party service providers of these financial entities.

Assessment type and frequency

According to a draft Supplementing Regulation published by the European Commision, financial entities must undergo internal audits on a regular basis that aligns with the financial entities’ audit plan. Auditors must possess sufficient knowledge, skills, and expertise in ICT risk, and appropriate independence. It does not specify frequency— just that the frequency and focus of these audits be commensurate to the ICT risk of the financial entity.

Tips for choosing the right framework for you or your clients

Selecting the right cybersecurity framework involves evaluating the client’s industry, regulatory requirements, cybersecurity maturity, and risk tolerance. To make an informed recommendation:

  • Understand industry standards and regulations: For regulated sectors (e.g., finance, healthcare), frameworks like NIS2 and DORA may be mandatory. For other industries such as SaaS, compliance with a standard like SOC 2 may not be legally required but be expected by customers and other stakeholders. 
  • Review contract requirements: Some clients may need formal certification (e.g., CMMC, Cyber Essentials, ISO 27001) to bid on or maintain contracts with customers, especially if in the government.   
  • Ask their geographical location: Some cybersecurity frameworks are required or tailored for organizations based in certain locations. NIS2 and DORA are for EU entities, for example. 
  • Assess client objectives: Determine what the client’s primary goal is, both in the short and long-term. Whether it’s setting up foundational security measures, reducing risk, or earning client trust, these objectives will shape framework selection.
  • Identify the type of information they handle: The type of information your client is handling can help determine the framework or certification they need. For example, if handling CUI, they will need CMMC certification. 
  • Evaluate their current security posture: Assessing their current security measures can help you identify and prioritize areas for improvement and select the framework that will best fill those gaps. If they’ve already complied with one framework, you could select a framework with common controls that’s relatively easy and fast to comply with.
  • Consider resources and scalability: Consider the client’s budget, staffing, and long-term goals to choose a framework that’s feasible to achieve and sustainable to maintain.
  • Provide continuous support: Ensure the client has a roadmap for continuous monitoring and improvement, as cybersecurity is an ongoing process.

Questions to help you select a cybersecurity framework

We've created a decision tree to help service providers suggest frameworks that align with the unique requirements and regulatory obligations of their clients, using a series of high-level business and geographical questions. We’ve limited our focus to the cybersecurity frameworks and standards discussed above.

Cybersecurity frameworks decision tree

Use this series of questions to help select the best cybersecurity framework(s) based on your or your clients' industry, data, and needs.

How Secureframe can simplify cybersecurity compliance

Navigating the complex requirements of various cybersecurity frameworks can be challenging, especially as organizations aim to maintain compliance in an ever-evolving threat landscape. This is where a compliance automation solution like Secureframe can be invaluable.

Secureframe streamlines the compliance process by automating gap analysis, evidence collection, control mapping, continuous monitoring, and more. For service providers, using Secureframe can mean less time manually managing compliance tasks and more time focusing on strategic goals for your clients. The platform’s centralized dashboard provides real-time insights into compliance status, helping client organizations quickly identify and address potential gaps across multiple frameworks—whether they’re working toward ISO/IEC 27001 certification, a SOC 2 report, or NIST CSF compliance.

By leveraging Secureframe, service providers can help clients reduce the time, cost, and effort required for compliance. This not only simplifies adherence to industry standards and compliance requirements — it also helps clients build a robust, scalable cybersecurity foundation that instills confidence and trust with customers and regulatory bodies alike.

Automate cybersecurity compliance

Request a demoangle-right
cta-bg