Start With Your Obligations: How to Choose a Cybersecurity Framework

How do you choose a cybersecurity framework? Start with your obligations, not with a list of popular cybersecurity frameworks. Write down the laws, regulations and contracts that apply to your organization, note which frameworks they name (if they do at all), then choose a control set that maps to all the "must have" requirements. For most organizations the answer is several frameworks may be needed to address all the mandatory and discretionary requirements necessary to be secure, compliant and resilient.

Why is "which framework is best?" the wrong first question?

Search for the "top cybersecurity frameworks" and you get ranked lists of NIST CSF, ISO 27001, SOC 2, CIS Controls, PCI DSS and HITRUST. The lists are useful, but they compare frameworks that do different jobs. NIST CSF is an outcome framework for managing cybersecurity risk. ISO 27001 defines requirements for an information security management system that an accredited certification body can certify. A SOC 2 report is an attestation issued by a licensed CPA firm. PCI DSS applies to anyone who stores, processes or transmits cardholder data.

So the useful question is not which framework wins. It is which frameworks you must or should align with and how to meet those requirements without running a separate program for each.

Step 1: What do your laws, regulations and contracts already require?

List every obligation in three buckets:

• Statutory: laws that apply because of where you operate or what data you hold, such as state privacy and breach laws or HIPAA.
• Regulatory: rules from regulators you answer to, such as NY DFS 23 NYCRR Part 500 for covered financial services firms.
• Contractual: what customers and partners require, such as PCI DSS through your card agreements, CMMC or NIST SP 800-171 in defense contracts, or a SOC 2 report in a customer's security addendum.

Sometimes the law hands you the shortlist. Texas Business and Commerce Code Section 542.004(b), added by SB 2610, lists the frameworks a covered business can follow for its breach safe harbor: the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53, the FedRAMP security assessment framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST common security framework, the Secure Controls Framework and the SOC 2 Type 2 framework (Texas statute, Chapter 542). The SCF explains the law in more detail in its Texas SB 2610 safe harbor overview.

Step 2: Which frameworks overlap with each other?

Once the list of laws, regulations and frameworks is written down, the overlap of individual requirements is usually large. Access control, risk assessment, incident response, vendor management and security awareness show up in almost every framework. The SCF's cybersecurity frameworks list compares the major frameworks side by side, including who publishes each one and whether it leads to a certification or a report.

Step 3: Should you pick one framework or use a metaframework?

If you face one obligation, use that single law, regulation or framework directly (e.g., simple Excel requirements tracker). However, if you face several laws, regulations and frameworks, then a metaframework or common controls framework saves considerable work. The Secure Controls Framework is a free metaframework of 1,500+ cybersecurity and data privacy controls in 34 domains, mapped to 200+ laws, regulations and frameworks. You implement a control once and the mappings show every requirement it supports. The full list is on the SCF's laws, regulations and frameworks page.

A simple rule of thumb:

• One obligation, no growth expected: adopt that framework.
• Two or more obligations, or more coming: build on a common control set and map outward.
• A customer wants third-party proof: choose the assessment they will accept, and scope it from the same controls.

Step 4: How will you prove it?

Decide early what evidence you need. Some obligations only ask you to maintain a program, some ask for a self-assessment, and some require an independent assessment, a certification or an attestation report. Planning this up front lets one evidence set serve several assessments instead of starting over each time. The trend is towards Continuous Assurance (CA), where self-attesting once every few years is no longer acceptable from a risk management perspective for Supply Chain Risk Management (SCRM) considerations.

Frequently Asked Questions (FAQ)

What is the most widely used cybersecurity framework? NIST CSF, ISO 27001, CIS Controls and SOC 2 are among the most commonly cited. The right choice depends on the obligations you have, not on popularity. The Secure Controls Framework (SCF) is arguablely the best cybersecurity metaframework on the market.

Can a company use more than one cybersecurity framework? Yes, and most do. A metaframework such as the SCF maps one set of controls to many frameworks so you can meet several at once.

Is the Secure Controls Framework a recognized framework? Yes. The SCF is a widely-recognized cybersecurity framework. The Texas Business and Commerce Code Section 542.004(b) names it among the frameworks a covered business can follow for the state's breach safe harbor.

Do I need a certification to follow a framework? No. Many frameworks, including NIST CSF, have no official certification. Certification or attestation matters when a customer, contract or regulator asks for independent proof.