ISO/IEC 27001 or NIST CSF: which do you need?
ISO/IEC 27001 is a management system standard. You build an information security management system, an independent body audits it, and you can hold a certificate. The NIST Cybersecurity Framework 2.0 is a framework of outcomes organised around Govern, Identify, Protect, Detect, Respond and Recover. It offers no certificate.
Use ISO/IEC 27001 when customers or regulators want formal proof. Use the NIST framework when you want a common language for risk, a way to describe current and target maturity, or a structure for board reporting.
They fit together well. Many organisations run an ISMS for certification and use the NIST functions to check coverage, particularly for detection and recovery. A single control library mapped to both avoids duplicate evidence.
Keep reading
Which standard should you start with?
Most organisations face several standards at once. Here is how to pick a starting point without doing the work twice.
12 November 2026 · 1 min read
ComplianceWhat a good gap assessment should deliver
A gap assessment is only useful if it ends in decisions. What to expect in the report.
10 November 2026 · 1 min read
ComplianceAudit evidence that holds up
Policies are not proof. What auditors actually ask to see, and how to keep it ready.
9 November 2026 · 1 min read