GRC · 5 min
Frameworks & Standards
What each one is actually for
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Five you'll hear constantly
Different purposes, different mechanisms.
- NIST Cybersecurity Framework — voluntary guidance for organizing a security program around outcomes; not certifiable, though some contracts or sectors require its use
- NIST SP 800-53 — a detailed control catalog, mandatory for many US federal systems and used voluntarily elsewhere
- ISO/IEC 27001 — an information security management system standard that an accredited body can certify against
- CIS Controls — a prioritized, practical set of defensive actions, useful as a starting point
- SOC 2 — an attestation report produced by a CPA firm against the Trust Services Criteria; not a government certification
Certification, attestation, guidance
These words are not interchangeable, and using them loosely creates real contractual confusion.
- Certification — an accredited body certifies conformity (ISO/IEC 27001)
- Attestation — an auditor reports on assertions and testing results (SOC 2)
- Guidance — a resource you adopt by choice or by requirement (NIST CSF, CIS Controls)
Loading the interactive lesson…