Module 7: Frameworks Made Simple

Free course · Start Your Cybersecurity Career · Module 7 of 8 · About 20 minutes

Frameworks can sound intimidating, but they are simply shared ways of organising security work. Employers mention them in job posts, and interviewers often ask about them. This module explains the frameworks you will meet most, in plain language.

NIST Cybersecurity Framework 2.0

NIST Cybersecurity Framework 2.0: six functions: slide 3 of Module 7, Frameworks Made Simple

The NIST Cybersecurity Framework (CSF), from the US National Institute of Standards and Technology, organises security into six functions:

Govern: strategy, roles, responsibilities and policy.
Identify: know your assets and risks.
Protect: put safeguards in place.
Detect: find attacks and anomalies.
Respond: act on incidents.
Recover: restore normal operations.

Version 2.0, published in 2024, added Govern, placing security strategy and leadership at the centre. The framework is flexible and works for organisations of any size or country.

ISO/IEC 27001

ISO/IEC 27001:2022 at a glance: slide 4 of Module 7, Frameworks Made Simple

ISO/IEC 27001 is the international standard for an information security management system (ISMS): a structured way to plan, run, check and continuously improve security. Organisations can be certified against it by an independent auditor, which is why customers often ask suppliers for it.

The 2022 edition includes 93 controls in Annex A, grouped into four themes: organisational (37), people (8), physical (14) and technological (34). Organisations choose the controls that fit their risks and explain their choices in a Statement of Applicability. A companion standard, ISO/IEC 27002, gives detailed guidance on each control.

CIS Controls v8.1

Which framework, when?: slide 7 of Module 7, Frameworks Made Simple

The CIS Controls, from the Center for Internet Security, are a prioritised list of practical actions: 18 controls containing 153 safeguards. They are grouped into three Implementation Groups:

IG1, essential cyber hygiene: 56 safeguards every organisation should apply first.
IG2: adds safeguards for organisations with IT staff and more sensitive data.
IG3: all safeguards, for organisations facing advanced attackers.

If someone asks “where should a small company start?”, IG1 is an excellent answer.

Other frameworks you will meet

OWASP Top 10: the most common web application security risks, used by developers and testers.
MITRE ATT&CK: a knowledge base of real attacker tactics (their goals) and techniques (how they achieve them), used heavily in SOCs and threat intelligence.
Japan’s METI Cybersecurity Management Guidelines: guidance for company leaders on managing cybersecurity as a business risk.
ISO/IEC 27002: detailed implementation guidance for the ISO 27001 controls.

Which framework, when?

NIST CSF 2.0 to organise and explain a security programme to management.
ISO/IEC 27001 when customers or partners need certification.
CIS Controls for a practical, prioritised to-do list.
MITRE ATT&CK for detection and threat analysis.
OWASP Top 10 for secure web development and testing.

Many organisations combine them: NIST CSF or ISO 27001 as the overall structure, and CIS Controls for practical priorities.

Frameworks in job interviews

“Which framework have you used?” Explain one framework clearly, with a real or home-lab example.
“How would you start securing a small company?” Begin with the CIS IG1 essentials, then grow.
“What is the difference between ISO 27001 and NIST CSF?” ISO 27001 is a certifiable standard for a management system; NIST CSF is a flexible framework for organising security.
“How do you map an attack to ATT&CK?” Tactics describe the attacker’s goals; techniques describe how they achieve them.

Quick check

Which function did NIST CSF 2.0 add?
How many Annex A controls does ISO/IEC 27001:2022 have?
Which CIS Implementation Group should every organisation start with?

Answers: 1. Govern. 2. 93. 3. IG1, essential cyber hygiene.

Key takeaways

NIST CSF organises security into six functions, starting with Govern.
ISO/IEC 27001 is the certifiable standard; CIS Controls give practical priorities.
Knowing when to use each framework impresses interviewers.

Next: Module 8 · Getting Your First Job. Portfolios, CVs, the Japanese hiring process and interview preparation.