CompTIA Security+ Preparation · lesson 2 of 45 · 25 min
Why Frameworks Exist
A security framework is a structured set of guidelines, best practices, and standards that organizations use to manage cybersecurity risk. Without a framework, security programs become ad hoc — teams patch the loudest problems without a coherent strategy, leaving systematic gaps.
Frameworks provide a common language between security teams, executives, auditors, and regulators. When a CISO says “we are at NIST CSF Tier 3,” every stakeholder understands the maturity level without needing a detailed technical briefing.
The Security+ exam tests your ability to identify frameworks by name, understand their purpose, and recognize which framework applies to a given scenario. You do not need to memorize every control — you need to know what each framework is for and who uses it.
Key insight
Frameworks are not laws — they are voluntary best-practice guides (unless a regulation mandates them). However, many regulations (HIPAA, PCI-DSS) reference specific frameworks, making them effectively required in those industries.
NIST Cybersecurity Framework (CSF)
The NIST CSF (currently version 2.0) is the most widely adopted cybersecurity framework in the United States. Published by the National Institute of Standards and Technology, it organizes security activities into six core functions:
NIST CSF Tiers
The CSF also defines four implementation tiers that describe an organization’s cybersecurity maturity: Tier 1 (Partial) → Tier 2 (Risk Informed) → Tier 3 (Repeatable) → Tier 4 (Adaptive). Higher tiers mean more proactive, integrated, and continuously improving security programs.
NIST SP 800-53 and SP 800-171
NIST SP 800-53 is a comprehensive catalog of security and privacy controls for federal information systems. It is organized into 20 control families (Access Control, Audit and Accountability, Incident Response, etc.) and is required for US federal agencies under FISMA. It is also widely adopted by contractors and enterprises.
NIST SP 800-171 is a subset of 800-53 tailored for protecting Controlled Unclassified Information (CUI) in non-federal systems — primarily defense contractors. Compliance is required to bid on Department of Defense contracts.
ISO/IEC 27001 and 27002
ISO/IEC 27001 is an international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Organizations can be formally certified against ISO 27001 by an accredited auditor — making it the gold standard for demonstrating security maturity to international clients and partners.
ISO/IEC 27002 is the companion code of practice that provides detailed guidance on implementing the controls referenced in 27001’s Annex A. Think of 27001 as the “what” and 27002 as the “how.”
ISO 27001 vs NIST CSF
NIST CSF is US-centric and free to use — ideal for domestic organizations. ISO 27001 is internationally recognized and certifiable — ideal for global businesses or those needing to prove compliance to international partners. Many organizations align to both.
Industry-Specific Frameworks
Flashcard Drill
NIST CSF Voluntary US framework with 6 functions: Govern, Identify, Protect, Detect, Respond, Recover. NIST SP 800-53 Comprehensive control catalog for US federal systems; required under FISMA. NIST SP 800-171 Controls for protecting CUI in non-federal systems; required for DoD contractors. ISO/IEC 27001 International certifiable standard for an Information Security Management System (ISMS). ISO/IEC 27002 Code of practice providing implementation guidance for ISO 27001 controls. PCI-DSS Payment Card Industry Data Security Standard — 12 requirements for protecting cardholder data. HIPAA Security Rule US law requiring administrative, physical, and technical safeguards for ePHI in healthcare. CIS Controls 18 prioritized, practical security controls applicable to any organization; free to use. SOC 2 AICPA audit standard for SaaS/cloud providers covering the 5 Trust Services Criteria. CMMC Cybersecurity Maturity Model Certification — required for US Department of Defense contractors.
Scenario Practice
The Hospital Breach
Implement only PCI-DSS because they accept payments. Implement HIPAA Security Rule for ePHI and PCI-DSS for payment data; align to NIST CSF for overall program structure. Implement ISO 27001 only — it covers everything. Use CIS Controls only — they are the simplest. 1 Healthcare organizations handling ePHI must comply with HIPAA. If they process card payments, PCI-DSS also applies. NIST CSF provides the overarching program structure. Multiple frameworks often apply simultaneously.
The Defense Contractor
ISO 27001 — it is internationally recognized. NIST SP 800-171 / CMMC — required for DoD contractors handling CUI. SOC 2 — required for all government contractors. CIS Controls — they are the most practical. 1 DoD contracts require NIST SP 800-171 compliance and CMMC certification for handling CUI. ISO 27001 and SOC 2 are not DoD requirements.
Knowledge Check
Security Frameworks — 10 Questions
Which NIST CSF function focuses on understanding assets, risks, and business context?
- Protect
- Identify
- Detect
- Govern
Answer: Identify
The Identify function covers asset inventory, risk assessment, and understanding the business environment.
An organization wants international certification for its security management system. Which standard should it pursue?
- NIST CSF
- CIS Controls
- ISO/IEC 27001
- PCI-DSS
Answer: ISO/IEC 27001
ISO 27001 is the internationally certifiable ISMS standard.
NIST SP 800-171 is specifically designed to protect Controlled Unclassified Information in non-federal systems.
- True
- False
Answer: True
NIST 800-171 was created to protect CUI in contractor and non-federal environments.
Which framework is mandatory for any organization that processes, stores, or transmits credit card data?
- HIPAA
- SOC 2
- PCI-DSS
- CMMC
Answer: PCI-DSS
PCI-DSS applies to any entity handling payment card data, regardless of size or industry.
The NIST CSF implementation tier that describes a proactive, continuously improving security program is Tier _____.
Answer: 4
Tier 4 (Adaptive) represents the highest maturity — proactive, continuously improving, and integrated with business risk management.
Which frameworks would apply to a US hospital that accepts credit card payments? (Select all that apply)
- HIPAA Security Rule
- PCI-DSS
- CMMC
- NIST CSF
- SOC 2
Answer: HIPAA Security Rule
PCI-DSS
HIPAA applies because they handle ePHI. PCI-DSS applies because they accept card payments. NIST CSF is voluntary (though useful). CMMC is for DoD contractors. SOC 2 is for cloud/SaaS providers. ISO/IEC 27002 is best described as:
- A certifiable ISMS standard
- Implementation guidance for ISO 27001 controls
- A US federal regulation
- A payment card security standard
- Answer: Implementation guidance for ISO 27001 controls
ISO 27002 is the code of practice — it explains how to implement the controls referenced in ISO 27001. The CIS Controls are best described as:
- A certifiable international standard
- 18 prioritized, practical security controls free to use
- A US federal law
- A healthcare-specific framework
- Answer: 18 prioritized, practical security controls free to use
CIS Controls are 18 prioritized, actionable controls applicable to any organization and freely available.
CMMC certification is required for all US federal government contractors, regardless of whether they handle classified information.
- True
- False
Answer: False
CMMC is specifically required for Department of Defense contractors handling CUI — not all federal contractors.
Which NIST CSF function was added in version 2.0 and focuses on strategy, policy, and accountability?
- Identify
- Protect
- Govern
- Recover
Answer: Govern
The Govern function was added in NIST CSF 2.0 to emphasize cybersecurity governance, risk management strategy, and organizational accountability.
Previous lesson: Security control categories (technical, managerial, operational, physical)
Back to CompTIA Security+ Preparation
Next lesson: Security policies, standards, procedures, and guidelines