.png)
Major Cybersecurity Frameworks
Cybersecurity frameworks compared
| Framework | Publisher | Type | Certification or report? |
|---|---|---|---|
| NIST CSF 2.0 | NIST | Voluntary framework of outcomes | No formal certification |
| NIST SP 800-53 Rev 5 | NIST | Security and privacy control catalog | No certification; used for US federal system authorizations |
| NIST SP 800-171 | NIST | Requirements for protecting Controlled Unclassified Information (CUI) | No certification by NIST; the basis for CMMC Level 2 assessments of defense contractors |
| ISO/IEC 27001:2022 | ISO and IEC | Information security management system standard | Certification by an accredited certification body |
| SOC 2 | AICPA | Trust Services Criteria for service organizations | Attestation report issued by a CPA firm |
| PCI DSS | PCI Security Standards Council | Payment card data security standard | Report on Compliance or Self-Assessment Questionnaire |
| CIS Controls | Center for Internet Security | Prioritized set of safeguards | No formal certification |
| HITRUST CSF | HITRUST | Certifiable framework | HITRUST certification |
The Most Widely Used Cybersecurity Frameworks
These are the frameworks most commonly required by contracts, mentioned in regulatory guidance, and used by security teams as program baselines. All are mapped in the SCF's Common Controls Framework®.
NIST CSF 2.0
Free
Voluntary
All Sectors
NIST Cybersecurity Framework, Version 2.0 (2024)
Created by
NIST (National Institute of Standards and Technology)
Structure
6 Functions (Govern, Identify, Protect, Detect, Respond, Recover) → Categories → Subcategories
Best for
General-purpose program baseline; widely accepted as the US de-facto standard; regulatory "reasonableness" reference
Limitation
High-level outcomes, not prescriptive controls. Organizations must interpret what "reasonable" implementation looks like
SCF Coverage
100% of NIST CSF subcategories mapped to SCF controls via STRM
NIST SP 800-53
Free
Federal / High-Rigor
Security and Privacy Controls for Federal Systems
Created by
NIST: the most comprehensive US government control catalog
Structure
20 control families; 1,000+ controls and enhancements; baseline variants (Low/Moderate/High)
Best for
Federal agencies (required by FISMA); FedRAMP cloud authorization; high-security commercial environments
Limitation
Highly prescriptive and comprehensive. Significant implementation overhead for non-federal organizations
SCF Coverage
Full NIST SP 800-53 Rev 5 mapped to SCF via STRM
ISO 27001 / 27002
Paid Standard
Certifiable
Global
International Standard for Information Security Management
Created by
ISO / IEC: international standards body
Structure
ISMS requirements (ISO 27001) + implementation guidance (ISO 27002); 93 controls in 4 themes; formal certification via accredited body
Best for
Organizations selling to EU enterprise customers; international supply chains; formal third-party certification needs
Limitation
Certification requires paid auditor; standard text requires purchase; less prescriptive than NIST
SCF Coverage
Full ISO 27001:2022 Annex A mapped to SCF controls
CIS Controls v8
Free
Prioritized
Practical
Center for Internet Security Critical Security Controls
Created by
Center for Internet Security (CIS): community-developed
Structure
18 control groups; 153 safeguards; three Implementation Groups (IG1/2/3) based on organization size and risk
Best for
Practical, prioritized starting point; SMBs using IG1; technically-oriented security teams; quick wins identification
Limitation
Not comprehensive enough for regulatory compliance on its own; limited privacy and GRC coverage
SCF Coverage
All CIS v8 safeguards mapped to SCF controls
SOC 2
Audit Required
B2B / SaaS
US
Service Organization Control 2: Trust Services Criteria
Created by
AICPA (American Institute of CPAs)
Structure
Trust Service Criteria: Security (required) + Availability, Confidentiality, Privacy, Processing Integrity (optional); Type I or Type II reports
Best for
SaaS and cloud companies; B2B vendor assurance; customer security questionnaire replacement
Limitation
Requires licensed CPA firm audit; significant cost; report confidential and not publicly shareable without NDA
SCF Coverage
All SOC 2 Trust Service Criteria mapped to SCF controls
PCI DSS v4.0
Free (Standard)
Audit Often Required
Payments
Payment Card Industry Data Security Standard
Created by
PCI Security Standards Council (Visa, Mastercard, Amex, Discover, JCB)
Structure
12 requirements; 300+ sub-requirements; Cardholder Data Environment (CDE) scoping; SAQ or QSA assessment
Best for
Any organization accepting, processing, storing, or transmitting payment card data, contractually required by card brands
Limitation
Highly prescriptive; technically complex CDE scoping; not a general security framework with a narrow payment card focus
SCF Coverage
All PCI DSS v4.0 requirements mapped to SCF controls
HITRUST CSF
Subscription Required
Healthcare
Certifiable
Health Information Trust Alliance Common Security Framework
Created by
HITRUST Alliance: a healthcare industry consortium
Structure
19 domains; control selection based on risk factors; three assurance levels (e1 / i1 / r2); requires HITRUST-authorized assessor
Best for
Healthcare vendors and covered entities; organizations replacing multiple HIPAA questionnaires with one certification
Limitation
Significant cost (licensing + assessor); complex scoping; primarily US healthcare focus
SCF Coverage
The SCF does not map to HITRUST CSF
Framework Comparison
Major Frameworks: Feature Comparison
How the most common cybersecurity frameworks compare across key features: cost, certifiability, privacy coverage, GRC breadth, and SCF mapping status.
Framework
Free?
Certifiable?
Privacy Coverage?
GRC Coverage?
MCR-Tagged?
Mapped in SCF?
SCF
✓ Free
✓ SCR CAP
✓ Full
✓ Full
✓ Yes
✓ It IS the map
NIST CSF 2.0
✓ Free
- No
Partial
✓ Yes
- No
✓ Yes
NIST SP 800-53
✓ Free
- FedRAMP
✓ Yes
✓ Yes
- No
✓ Yes
ISO 27001/2
- Paid
✓ Yes
ISO 27701
Partial
- No
✓ Yes
CIS Controls v8
✓ Free
- No
- No
Partial
- No
✓ Yes
SOC 2
- Paid Audit
✓ Yes
Optional
Partial
- No
✓ Yes
PCI DSS v4
Std Free / Audit Paid
✓ QSA/SAQ
- No
- No
- No
✓ Yes
%20(white).png)